Filter Driver Encryption for Keylogger-Resistant Keyboard Input
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security systems are vulnerable to keyloggers that illicitly obtain sensitive information prior to encryption, compromising user passwords and allowing unauthorized access to secure systems.
Innovation Solution
A filter driver and injectable software instructions secure keystroke data by encrypting it within the memory space of applications, using an atypical data path and encryption keys specific to each application, without requiring cooperation from the application developers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If a keylogger is installed on the computing device, then sensitive information can be obtained prior to encryption, but security against keylogging attacks deteriorates
Solution Approach 1:
The patent encrypts keystroke data before it is delivered to the application by injecting encryption code into the application's memory space. This preliminary encryption action prevents keyloggers from capturing plaintext sensitive information, as the data is already encrypted when it reaches the application layer where keyloggers typically operate.
Solution Approach 2:
The patent introduces an intermediary encryption layer between the keyboard input and the application. A filter driver captures keystrokes, encrypts them using injected code within the application's memory space, and delivers the encrypted data to the application. This intermediary process ensures that keyloggers cannot access the plaintext data.
2Reliability
If encryption is implemented in applications, then keystroke data security is improved, but device complexity increases
Solution Approach 1:
The patent creates a universal encryption mechanism that works across multiple applications simultaneously. By injecting a single body of encryption code into the memory space of any target application, the system provides encryption capabilities to applications regardless of whether they were originally designed with security features. This multi-functional approach allows one encryption module to serve numerous different applications.
Solution Approach 2:
The patent enables applications to self-encrypt their own keystroke data without requiring modifications to the application code or cooperation from application developers. The encryption code is injected into the application's memory space and operates autonomously, using the application's own memory resources and execution environment to perform encryption, thus the application essentially serves its own security needs.
3Reliability
If applications are modified to support encryption, then security is improved, but ease of operation deteriorates
Solution Approach 1:
The patent performs preliminary modification of the application's memory space by injecting encryption code before the application processes keystrokes. This preliminary action occurs transparently without requiring the application to be recompiled or modified by developers, maintaining ease of operation while enabling security.
Solution Approach 2:
The patent introduces an intermediary encryption layer that operates between the keyboard input and the application without requiring changes to the application itself. The injected code acts as a mediator that handles encryption transparently, allowing the application to continue operating as originally designed while gaining security capabilities.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
In illustrative embodiments, systems and methods are disclosed by which keystroke data may be securely delivered to an application executing on a computer. The keystroke data may traverse an atypical data path to the memory space of the application, and may be encrypted along its traversal of such data path, and my further be encrypted when it is delivered into the memory space of the application. The system may include a filter driver that is arranged in a driver stack with a keyboard device driver that ordinarily interacts with the keyboard, and the filter driver may receive keystroke data from the keyboard device driver, encrypt such data, and provide such encrypted data to a body of software instruction that it injected into the memory space of the application. The body of software instructions may, in turn, decrypt the encrypted data and provide the decrypted data to the application.