KR20060093932A - Method that can secure keyboard key stroke using secure input filter driver and keyboard secure input bho of internet explorer in windows operating system - Google Patents

Abstract

The present invention is a software-based hacking prevention method for preventing keyboard hacking between the keyboard hardware 100 of the Internet user and the Internet Explorer 400 (hereinafter referred to as IE) of Microsoft Corporation.

The present invention installs the secure input filter driver 200 in the kernel mode (Ring 0) and checks the filter driver and the interrupt service routine (hereinafter referred to as ISR) that can be installed on the top and bottom of the keyboard driver 120 of the operating system. The keyboard input information of the kernel mode is protected from hacking at source and receives the input, and the input keyboard input information is directly transmitted to the keyboard input security BHO 300 installed inside the IE 400, so that the user mode (Ring 3) and In kernel mode (Ring 0), keystroke hacking is inherently protected.

In the data transmission / reception between the security input filter driver 200 and the keyboard input security BHO 300, the API hook monitoring unit 32 and the subclassing monitoring unit 330 monitor and protect the transmission between the two parties. It includes a function.

Most of the existing key stroke inventions have been secured from the keyboard all the way to the application software or in the middle of certain weak points.

Due to the development of Internet technology, new hacking methods using the weaknesses of these conventional technologies are emerging.

If keystroke security is defined as information entered from the keyboard, rather than up to the final stage of the end application desired by the user, it is not possible to achieve complete security with conventional techniques for all application software.

Unlike the existing technologies, the present invention secures a key stroke only for a specific operating system and a specific application.

According to the present invention, keyboard hardware 100 input information (key stroke) input through a PS / 2 or a USB port may be used for the Microsoft Internet Explorer 400 of the Microsoft Windows operating system. It is aimed to prevent keyboard input information hacking up to the IE text box 420.

Keyboard, Security, Hacking, Key Stroke, Filter Driver, Browser Help Object (BHO), Interrupt Service Routine (ISR)

Description

Secure input filter driver and keyboard inside Internet Explorer How to prevent hackers from hacking keyboard input information through Internet Explorer {Method that can secure keyboard key stroke using secure input filter driver and keyboard secure input BHO of Internet Explorer in windows operating system}

1 illustrates a basic keyboard input structure diagram of a Windows operating system.

2 illustrates a case in which a security program does not operate in the keyboard input structure diagram according to the present invention.

3 illustrates a case in which a security program operates among the keyboard input structure diagram according to the present invention.

4 is a diagram illustrating the overall configuration of a keyboard input information security program according to the present invention.

5 illustrates a flow chart of a keyboard input security BHO 300 in accordance with the present invention.

6 illustrates a flow diagram of a secure input filter driver 200 in accordance with the present invention.

7 illustrates a flowchart between the management server 700 and the keyboard input security BHO 300 according to the present invention.

8 is a flowchart of the filter driver monitoring unit 210 according to the present invention.

9 illustrates a flowchart of an interrupt service routine monitoring unit 230 according to the present invention.

Korean Patent Application Laid-Open No. 2001-0099090 "ActiveX-based keyboard hacking prevention input window"

Korean Patent Application Publication No. 2002-0048313 "Keyboard hacking prevention method"

Patent Document 10-2004-0092101 "Keyboard hacking prevention method using a virtual keyboard data transmission"

Publication 10-2004-0072044 "Computer security system using a security input device"

The present invention relates to a security system for preventing hacking of keyboard input information of a user among computer information security.

With the rapid development of the Internet, a number of tasks are being carried out on the Internet that contain financial transactions (Internet banking, stock trading, etc.) and important personal information of ordinary users.

Many existing security technologies have focused on server security and data transmission between users and servers.

Increasingly, spyware or keystroke loggers, which take keyboard input information from general users' computers that are relatively insecure, have been used to acquire and steal personal information.

The most common way to do this is to install spyware detection and removal software on your computer.

However, the basic principle of operation of such security software is that it cannot detect modified hacking tools that are not known.

One of the easiest ways to get the user's information is to hack keyboard input. To solve this problem, various methods have been developed and used.

The most common way to prevent keyboard hacking is KT's keyboard hacking prevention system, which has been in service as of February 2005.

The keyboard hacking prevention program requests 230 through AttachInputThread to turn IE 400 threaded messages into a message queue unique to the hacking prevention program. The request then sends all IE 400 messages to the keyboard security program. These messages have key values, and the keyboard security program stores the actual key values and generates an input message with the fake key values. And send it to the IE thread message queue 410.

After that, the keyboard security program sends the stored value to the window procedure of the IE 400 and at the same time sends a command to delete the fake key value.

Eventually, a hacker who hooks a thread to a web browser will get a message that contains a mixture of key values rather than the actual key values.

However, such a security system can be easily avoided in many ways. Hackers can install hooks in the security program's thread. As a result, the hacker may have both the input message of the IE text box 420 and the input message of the security program.

Another way is that after a security program asks the operating system for an AttachInputThread, the hacking program can ask the operating system for an AttachInputThread again. Due to the nature of the Windows operating system, the system is not a security program

The input message is sent to the last requested application 500, that is, the hacking program.

Alternatively, the hacking program may be used to change the window procedure of the IE text box 420.

The hacking program replaces the default window procedure with the hacking program's own window procedure. This technique is called subclassing. Using this technique, hackers can easily take text box input messages.

As a technique of a method other than the above-described security method, there is a patent-pending patent-protected input window based on ActiveX.

This patent deletes the keyboard trace data remaining in the keyboard port after buffering the keyboard input information, and then transfers the keyboard data to the application as a separate transmission section instead of the existing buffered keyboard data flow. How to protect it. Due to this patented technology, higher level input data such as application programs such as intercepting the above-mentioned keyboard input information can be protected. However, as disclosed in Korean Patent Laid-Open Publication No. 10-2004-0072044, the keyboard input information can be intercepted before the secure input keyboard driver used in this technology.

In FIG. 1, there is a keyboard driver 120, and n filter drivers may be installed above or below it.

That is, n bottom filter drivers may be installed from the keyboard hardware 100 to the keyboard driver 120, and n top filter drivers may be installed between the keyboard driver 120 and the keyboard class driver 140.

In this way, a hacker can receive keyboard input information before the secure input keyboard driver used by this technology.

Another security method is Patent Publication No. 2002-0048313 "Keyboard hacking prevention method". In this method, the keyboard input information leaving the keyboard hardware 100 in kernel mode (Ring 0) to the system message queue 210, which is the user mode (Ring 3), is described as a single step called a secure keyboard driver. Doing.

As described above, in order to reach the system message queue 210 of the user mode (Ring 3), the keyboard input information leaving the keyboard hardware 100 in the kernel mode (Ring 0) must pass through drivers provided by at least two operating systems.

The keyboard hardware 100 and the keyboard driver 120, the keyboard driver 120 and the keyboard class driver 140 is an area in which communication methods and features thereof are different and different types of filter drivers can be installed.

After all, this patent discloses a technical description that is so simple that the installation location of the secure keyboard driver in this technology in kernel mode (Ring 0) is not clear and in particular the load order between filter drivers and the security method between each driver. Since it is not described, hackers can intercept or copy information in the middle by exploiting features between each driver through load order changes and other methods.

In addition, as a technique for creating a table, encrypting and decrypting it in the middle, the keyboard input information can be lost again in the process of transferring to a specific program. In other words, as described above, the technology is applied to various types of browsers and all applications, in other words, the technology protects the keyboard input information only until it is transmitted to the application 500.

There are completely different applications 500 in the browser, such as Internet Explorer (IE), Netscape, Opera, and these have their own characteristics.

Considering the domestic Internet environment, most users use the Windows operating system and the IE 400. If the user does not consider the features of the IE 400, the user may actually input the keyboard input information into the IE text box in the process of using the Internet. Protection up to 420 is impossible.

This can also be found in Patent Document 10-2004-0092101 "Keyboard hacking prevention method using a virtual keyboard data transmission" Publication 10-2004-0072044 "Computer security system using a secure input device".

Patent Document 10-2004-0092101 "Keyboard hacking prevention method using a virtual keyboard data transmission" is the same as the security program of the above-described KT and its basic principle. The difference is that if KT receives and encrypts keyboard input information in user mode (Ring 3), the technology encrypts in one step in kernel mode (Ring 0). But in the end, they have the same problems.

First, in kernel mode, the load order between the upper and lower filter drivers is not checked and the interrupt service routine (ISR) that is operated before the keyboard driver 120 is not checked.

This allows hackers to install the filter driver and their own Interrupt Service Routine (ISR) again after the security program has been installed, which allows the hacker to take keyboard input information.

In addition, the user mode (Ring 3) has the same problems as described above KT security program.

Eventually, all passwords and passwords are decrypted before the application and passed to the application. If the concept of the keyboard input information security is not the application but the inside of the application, the keyboard input information security is separate according to the application 500. Design is necessary. Otherwise, hacking may be performed when the keyboard input information is transmitted from the security program to the application 500 by using the characteristics of each application program 500.

The "computer security system using a security input device" is an interrupt service routine that is basically provided by an operating system registered in an interrupt descriptor table (IDT) after installing a lower filter driver at the bottom of the keyboard driver 120. Register your own Interrupt Service Routine (ISR) rather than (ISR).

Eventually, the message is sent to the self-input security DLL installed in the user mode (Ring 3) directly without passing through the operating system's interrupt service routine (ISR) and keyboard driver 120, and then passed from the secure input DLL to the application 500. That's how.

It also includes the ability to check for interrupt service routines (ISRs) and maintain their own interrupt service routines (ISRs).

The problem with this technique is that there is no process of first replacing the interrupt service routine (ISR) and then undoing it. This behavior is inconsistent with Microsoft's operating system specifications.

There are a number of programs in the software that require the installation of their own interrupt service routine (ISR). Except for illegal software, any software intended to install an Interrupt Service Routine (ISR) must comply with Microsoft's operating system specifications.

Patent Document 10-2004-0072044 has a design that does not follow this, and when the software is running, the execution of its own interrupt service routine (ISR) or other software that requires an operating system's interrupt service routine (ISR) within the same system. Other software that requires it will be disabled. Software conflicts occur in the system. Just installing your own Interrupt Service Routine (ISR) does not mean that the software is a hacking program.

Many of the software, especially those related to system management, include this feature. A series of actions that violate operating system specifications and interfere with the normal operation of other software are those seen in viruses or hacking programs. After all, if you apply this technology to a Windows operating system, it will not be recognized as normal processing by the operating system itself, and you will be limited to using other software.

Second, there is a risk of hacking in the process of passing the data to the application 500 by the secure input DLL existing in the user mode (Ring 3). For example, using IE subclassing technology, one of the hacking techniques described above, can intercept keyboard input information transmitted from the secure input DLL to the IE.

The present invention aims to protect keyboard input information from the user's keyboard hardware 100 to the IE text box 420 when the user's computer operating system is Windows and the browser uses the IE 400. .

It is essential to prevent illegal keyboard input information hacking occurring within the user's computer and to notify the user of the hacking and to have no effect on the user's normal execution of other programs.

To this end, a technique for monitoring the processing itself, not a method of an existing security program that relies only on a list, and a process of transmitting an interrupt service routine (ISR) and a filter driver list to the management server 700 and being notified of the risk are required.

Instead of recognizing the entire IE 400 as an application 500 and passing the keyboard input information in one step, it creates its own keyboard input security BHO 300 and installs it inside the IE 400, which in turn is an IE thread. Keyboard input information must be entered into the IE text box 420 without going through the message queue 410.

In addition, the secure input filter driver 200 installed in the kernel mode (Ring 0) and the keyboard input security BHO 300 must communicate with each other directly.

The configuration of the present invention is the security input filter driver 200 installed in the kernel mode (Ring 0) and the keyboard input security BHO 300 installed in the IE 400 of the user mode (Ring 3), and the management server 700 It consists of.

1 is a basic keyboard input structure diagram of Windows.

2 is a keyboard input structure diagram according to the present invention, in accordance with the purpose of the present invention, the application 500 of FIG. 1 has an IE 400 and the IE 400 is again a keyboard input security BHO 300 and IE thread Message queue 410, IE text box 420 is composed of. N filter drivers may be installed at the bottom and top of the keyboard driver 120. In the present invention, the security input filter driver 200 is installed at the top.

2 is a flowchart illustrating keyboard input information when a security program is not operated. As shown in the flowchart, only the kernel mode (Ring0) and the user mode (Ring 3) have many steps compared to FIG. 1, and the keyboard input information is transmitted through the same path.

3 illustrates the flow of keyboard input information when the security program according to the present invention operates in the keyboard input structure diagram of FIG. 2. When the keyboard input information starts from the keyboard hardware 100 and arrives through the keyboard driver 120 of the operating system to the secure input filter driver 200, the secure input filter driver 200 is a filter driver or a keyboard class of the operating system. The keyboard input information is directly sent to the keyboard security input BHO 300 in the IE 400 without going through the steps existing above the driver 140. Keyboard security input BHO 300 enters keyboard input information directly into IE text box 420 without going through IE thread message queue 410.

In FIG. 3, only steps in which keyboard input information is directly transmitted are described in detail with reference to FIG. 4.

4 shows a configuration inside the keyboard input security BHO 300 and a configuration inside the security input filter driver 200, and also shows a management server 700.

The present invention does not work when the user starts typing through the keyboard hardware 100, but in the previous step, the user places the mouse in the IE text box 420 and clicks or enters the cursor there automatically for input. If present, that is, a 'got focus' event occurs and the security program is running.

5 is a flowchart of a keyboard input security BHO 300.

The management unit 310 of the keyboard input security BHO 300 checks whether there is a focus in the IE text box 420. The Windows operating system is an operating system that supports multitasking, and can open and work with multiple windows, that is, applications 500 at the same time. The focus is on being able to easily explain how to enter data into multiple applications 500 through one keyboard hardware 100. That is, the keyboard input information is transmitted to the application program 500 in focus by the operating system. If the user is using another application (500) opens IE 400 or selects something that has already been opened, it may be said that IE 400 is in focus. More specifically, for example, when a mouse is clicked on the ID field to check an email, the corresponding IE text box 420 among the IE 400, in this case, the ID field has the focus. In this case, the security program according to the present invention operates.

In FIG. 5, if the management unit checks the focus on the IE text box 420 and there is no focus, the security input filter driver 200

It will not work securely. In contrast, the security input filter driver 200 operates with focus. (201) The keyboard input security BHO 300 communicates with the security input filter driver 200 through the DeviceIoControl API supplied from Microsoft Corporation. Will be At this stage, however, hackers can make API hooks to monitor intermediate data. In order to prevent this, the management unit 310 operates the API hook monitoring unit 320.

Since the DeviceIoControl API is extracted from kernel32.dll, we first obtain the DeviceIoControl API address (321) and check if it is part of the kernel32.dll address space (322). If not, notify the management server 700 (312) and then manage it. The result is received from the server 700 and the operation is performed according to the result. (313) This operation will be described with reference to FIG.

If the DeviceIoControl API address is part of the kernel32.dll address space, it checks again whether the extracted part of kernel32.dll has changed and notifies the management server 700 if it has changed. (312) If the change has not been made, call DeviceIoControl API ( 324 Informs the security input filter driver 200 to protect the keyboard input information. (314) When the notification is received, the security input filter driver 200 operates. (201) A flowchart of this operation is shown. 6.

The secure input filter driver 200 continuously receives a keyboard input value from the keyboard driver 120. At this time, if the keyboard input security BHO (300) checks whether or not received a security notification, and passes the input value to the upper driver (205)

Upon receiving notification 314, the keyboard input value is transmitted to the keyboard input security BHO 200. The keyboard input security BHO 300 that receives the transmission should call the window procedure of the IE text box 420, before operating the subclassing monitoring unit 330. The operation of the subclassing monitoring unit 330 first obtains the address of the IE text box 420 and checks whether the imported address is part of the IE main executable address space (332). If not, the management server 700 is notified (312), and if it is part of the call, the window procedure of the IE text box 420 is passed to the keyboard input value. (334) The IE text box 420 is checked for focus. If the focus is lost, the security input filter driver 200 notifies the security release (208) to disable the security operation.

The security input filter driver 200 having received the security release notification transmits the keyboard input value to the upper driver as described in FIG. 6.

Subsequently, if the IE text box 420 has focus, the keyboard input value is continuously received from the security input filter driver 200 (331), and the same operation is repeated until the focus is lost.

7 is a flowchart between the management server 700 and the keyboard input security BHO 300. The two communicate over the Internet 600. The management server 700 receives information about all kinds of hacking attempts occurring within the user's computer, such as API hooks, subclassing, and a bottom filter driver using its own ISR, from the keyboard input security BHO 300. (701)

Such technologies are used by hackers, not technologies intended for hacking. In other words, many other normal softwares can take advantage of these techniques in the user's computer.

Information about a series of actions detected by the security program and suspected of being hacked is sent to the management server 700 to be hacked 703, unknown 704, safety 705 via the DB of the management server 700. And the result is sent back to the keyboard input security BHO 300 (702).

When the result is found to be a hack 703, the security program according to the present invention deletes the part corresponding to the hack and notifies the user through the display unit 350 (711). The result is unknown (704). Or if the safety (705) is notified to the user through the display unit 350 and whether the processing proceeds or not. (706) If the user wants to delete or no, delete the processing and then the user to the result (711)

On the contrary, if the user wants to execute a part that is unknown (704) or determined to be safe (705), the security program according to the present invention continues to operate while simultaneously monitoring. (707) Illegal operation such as hacking result of monitoring If not, the management server 700 notifies and registers the processing as safety 705, and then proceeds with the security program operation according to the present invention. If the monitoring detects an operation such as API hook, subclassing or abnormal operation of its own ISR, it notifies the management server 700 of this fact and registers the processing as hack 703 and then deletes the processing. . After that, the user is notified again through the display unit 350 (711).

This behavior is different from the basic principle of the existing spyware detection and removal program that relies on a list of known hacking tools to search for and remove the hacking tools, and is a technology that can provide users with more fundamental and continuous security.

The secure input filter driver 200 includes a filter driver monitor 210 and an interrupt service routine (ISR) monitor 230.

8 is a flowchart of the filter driver monitor 210.

First, the number of top filter drivers that may be installed on the top of the keyboard driver 120 is checked. (211) If the number of filter drivers is not two or more, that is, only the security input filter driver 200 is installed, the display unit ( In step 350, the user is notified that the system is safe.

In addition, even if the number of filter drivers is two or more, the user is notified that the user is safe even when the load order of the secure input filter driver 200 is the lowest. (351) However, the number of filter drivers is two or more and secure. If installed below the input filter driver 200, the load order is changed through the load order converter 340 of the keyboard input security BHO 300. (214).

Unless a malicious technique is used, the load order is changed, and after the change, the display unit 350 notifies the user and requests to restart the system. (352) However, if the load order is not changed. In this case, the management server 700 and the user are notified to prevent further operations.

Hacking may be performed using an interrupt service routine (ISR) instead of an interrupt service routine (ISR) provided by the keyboard driver 120. Hackers can create their own interrupt service routines (ISRs) and register them in the interrupt descriptor table (IDT). In this case, the normal program should register the interrupt service routine (ISR) supplied by the operating system to the interrupt descriptor table (IDT) again after completing the desired operation. However, the interrupt service routine (ISR) created by the hacker should take the keyboard input information. For this purpose, it will continue to maintain its interrupt service routine (ISR).

The interrupt service routine (ISR) monitoring unit 230 detects and removes such a method.

9 is a flowchart of an interrupt service routine (ISR) monitoring unit 230.

First get the address of the keyboard interrupt service routine (ISR) from the Interrupt Descriptor Table (IDT). (231) Then get the base address of the keyboard driver 120. (232) When the system starts up, the system loads the drivers ( loading). Each driver takes up a certain amount of computer RAM. For example, if the driver occupies 1MB, the address at the beginning of the space is called the base address.

After obtaining the base address (232), the file size value of the keyboard driver 120 is obtained. (233) Then, the address of the keyboard interrupt service routine (ISR) obtained from the interrupt descriptor table (IDT) is obtained from the keyboard driver 120. It is checked whether the base address is larger than the base address and at the same time, the base address of the keyboard driver 120 is smaller than the sum of the file size values of the keyboard driver 120. (234)

The Interrupt Service Routine (ISR) supplied by the operating system is, precisely, supplied by the keyboard driver 120.

That is, an interrupt service routine (ISR) is present in the keyboard driver 120. The address is registered in the Interrupt Descriptor Table (IDT). If you create your own Interrupt Service Routine (ISR), it also resides in some part of your computer's RAM, which can be installed before or after the keyboard driver 120.

Eventually, its Interrupt Service Routine (ISR) is somewhere in RAM and only registers its address in the Interrupt Descriptor Table (IDT). One thing is certain, but it can take up space in the front or back of the keyboard driver 120, but the installation inside the keyboard driver 120 is not possible.

For example, if the base address of the keyboard driver 120 is 100 and the file size of the keyboard driver 120 is 200, it means that the keyboard driver 120 occupies 100 to 300 space in RAM of the computer. The Interrupt Service Routine (ISR) is stored in any space between 100 and 300.

In other words, their interrupt service routines (ISRs), created by hackers or other programs, are stored somewhere in the computer's RAM somewhere before 100 or after 300. By using the above information, it is possible to check whether the currently used keyboard interrupt service routine (ISR) is supplied from the keyboard driver 120. (234) If the check result is NO, the management server 700 The controller performs notification as described in FIG. 7. If the check result is an example, the keyboard security program according to the present invention operates normally. (235)

The security program of the present invention includes a system for checking the operation itself rather than a list-dependent method of hacking that may occur in kernel mode (Ring 0) and user mode (Ring 3). Security of application technology is very high. This plays a very important role at the present time when the Internet environment is rapidly developing and its use ranges from simple work to financial transactions. Increasing security will allow users to use more of the Internet's work and ultimately advance the Internet experience.

Claims (3)

API hook monitoring unit 320, subclassing monitoring unit 330, load order converter 340, display unit 35, the management unit 310 for managing the security input filter driver 200 and the management server 700 Keyboard input security BHO (300), which directly transmits and receives with a secure input filter driver, including Secure input filter driver 200 that includes a filter driver monitoring unit 210, interrupt service routine (ISR) monitoring unit 230 and directly transmits and receives with the keyboard input security BHO (300) The management server 700 receives, judges, transmits a result, and automatically updates a database of a series of suspected hacking information received from the management unit 310 of the keyboard input security BHO 300.

Images