Keyboard Driver Obfuscation for Keystroke Logging Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods to prevent keystroke logging software from accessing user input data are inadequate, as they rely on signature detection, onscreen simulated keypads, and kernel-level monitoring, which can be circumvented and are user-unfriendly, and hardware solutions are expensive and difficult to deploy.
Innovation Solution
A computer program that masks user input data by generating random pseudo-entry data, encrypts stored user entry data, and operates as a keyboard driver with highest priority to prevent keystroke loggers from intercepting input, using unique tokens to authenticate valid applications and disabling hooks to protect sensitive fields.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional anti-spyware software uses signature detection to identify keystroke loggers, then known spyware can be detected, but new spyware cannot be detected and requires frequent database updates
Solution Approach 1:
Instead of trying to detect keystroke loggers by identifying their signatures, the patent inverts the approach by making the keyboard driver itself unrecognizable to potential loggers. The driver uses randomization techniques and obfuscation to prevent spyware from reliably identifying and targeting it, thereby protecting against both known and unknown loggers without requiring signature databases.
Solution Approach 2:
The patent applies preliminary protection by implementing security measures directly in the keyboard driver before any keystroke logging can occur. The driver randomizes its behavior and obfuscates its code structure in advance, creating a moving target that prevents keystroke loggers from successfully intercepting and recording keystrokes.
2Object-affected harmful factors
If onscreen simulated keypads are used to prevent keystroke logging, then some protection is provided, but spyware can still detect mouse clicks and compare positions to identify entered characters
Solution Approach 1:
The patent extracts the security function from the application layer and implements it directly in the keyboard driver. This removes the vulnerability of onscreen keypads where spyware could monitor mouse clicks, by instead protecting at the level where actual keystroke data is captured, making it impossible for application-level spyware to intercept the data.
3Object-affected harmful factors
If kernel-level monitoring is used to deactivate suspected keystroke loggers, then keystroke logging can be prevented, but there is risk of permanently damaging files required for the operating system
Solution Approach 1:
Instead of actively monitoring and deactivating suspected keystroke loggers (which risks system stability), the patent inverts the approach by making the keyboard driver itself resistant to logging attempts. This passive defense mechanism protects the system without requiring active intervention that could destabilize the operating system.
4Object-affected harmful factors
If hardware devices such as smart cards are used for identity confirmation, then security is enhanced, but the devices are expensive and difficult to deploy
Solution Approach 1:
The patent replaces the mechanical hardware solution (smart cards) with a software-based security mechanism implemented in the keyboard driver. This substitution maintains security protection while eliminating the cost and deployment complexity associated with physical hardware devices, as the protection is embedded in the software layer.
Data Source
AI summary
A method and system is provided for securing user entry data against keyboard login attempts. The method/system masks user input data, either insulating the data from vulnerable parts of the operating system or application, or contaminating user data that is supplied to those vulnerable parts of the operating system or application. The method/system securely stores data, either intercepted prior to reaching the vulnerable parts of the operating system or extracted from the contaminated data, and securely provides the data directly to a verified application.