Macro Keystroke Simulation Blocking for Document Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Malicious macro viruses embedded in document files, such as those used in Microsoft Word or Excel, simulate physical keystrokes to bypass security protections and execute malicious commands, posing a threat to computing devices.
Innovation Solution
A security application detects function calls in macros that simulate keystrokes, modifies dynamic library code to execute security checks, and prevents the satisfaction of such requests, optionally terminating the macro or displaying warnings based on policy and fingerprint matching.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If macro viruses simulate physical keystrokes to bypass security, then the macro can execute malicious commands undetected, but security protections fail to prevent the attack
Solution Approach 1:
The patent introduces an intermediary security mechanism that sits between the macro execution environment and the keystroke synthesis function. By modifying the dynamic library code and inserting security checks, the system creates a mediating layer that intercepts and validates keystroke simulation requests, allowing legitimate macros to function while blocking malicious ones based on policy evaluation
Solution Approach 2:
The patent implements preliminary action by performing security validation before allowing keystroke simulation to occur. The system proactively modifies the dynamic library to include security checks that evaluate the legitimacy of each keystroke request in advance, preventing malicious macros from executing harmful commands rather than detecting them after execution
2Reliability
If the system blocks all keystroke simulation requests from macros, then security is enhanced, but legitimate macro functionality is disrupted
Solution Approach 1:
The patent applies local quality by implementing differentiated security treatment for different macro requests. Instead of uniformly blocking all keystroke simulations, the system evaluates each request individually and applies security policies locally to determine whether to allow or block specific macros based on their legitimacy, thus preserving legitimate functionality while blocking attacks
Solution Approach 2:
The patent utilizes parameter changes by dynamically evaluating macro requests against security policies that can change based on the request characteristics. The system modifies the behavior of the keystroke synthesis function based on parameters such as the macro's origin, the nature of the keystroke request, and policy rules, allowing legitimate operations while blocking malicious ones
Data Source
AI summary
A computer-implemented method includes detecting, by a computing device, a request from a macro included in a document file that is open in a software application executing on the computing device, where the macro comprises executable code and where the document file further includes non-executable document content. The method further includes determining if the request includes simulation of a physical keystroke based on detecting that the request includes a function call to a function that synthesizes keystrokes. The method further includes responsive to determining that the request includes simulation of the physical keystroke, preventing the request from being satisfied.