Password Entry Obfuscation Against Keylogging Attacks

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Keylogging attacks pose a significant threat to cybersecurity by capturing and transmitting sensitive information, such as usernames and passwords, to hackers, often evading detection due to their transient nature.

Innovation Solution

A system and method that generates a fake or obfuscated password by injecting random keystrokes using a virtual human interface driver, storing it in a secure database, and deleting the real password from memory, triggering security actions when the fake password is used for login attempts.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If the password is stored in memory for authentication, then the authentication function works normally, but the password becomes vulnerable to keylogging attacks

Engineering Contradiction:

Improveauthentication reliabilityVSAvoidkeylogging attack vulnerability

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The patent introduces a virtual keyboard as an intermediary layer between the user input and the authentication system. This virtual keyboard captures keystrokes and transforms them into a different format before passing to the application, preventing keyloggers from capturing the actual password while maintaining authentication functionality

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent creates a fake password by injecting random characters into the original password. This copied version with added noise is what gets transmitted to the keylogger, while the real password remains protected in memory. The authentication system can still verify credentials without exposing the actual password

Inventive Principle:

Principle #26Copying

2Productivity

If the malicious software deletes itself after recording keystrokes, then the attacker can avoid detection, but the keylogging attack becomes harder to detect

Engineering Contradiction:

Improveattack efficiencyVSAvoiddetection difficulty

Core Design Contradiction:

ProductivityVSDifficulty of detecting and measuring

Solution Approach 1:

The patent implements preliminary protective actions by setting up the virtual keyboard and fake password generation mechanism before the keylogger can execute. This preemptive measure ensures that even if the keylogger runs temporarily, it only captures fraudulent data rather than the real password

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent converts the harmful keylogging activity into a beneficial detection opportunity. By having the system compare virtual keyboard input against actual password entry, any discrepancy (indicating keylogger presence) triggers an alert, turning the attacker's action into a security detection mechanism

Inventive Principle:

Principle #22Blessing in disguise (Convert harm into benefit)

3Object-affected harmful factors

If the system generates a fake password with injected characters, then keylogging attacks are thwarted, but the authentication process becomes more complex

Engineering Contradiction:

Improvekeylogging attack preventionVSAvoidauthentication process complexity

Core Design Contradiction:

Object-affected harmful factorsVSDevice complexity

Solution Approach 1:

The virtual keyboard component serves multiple functions: it captures user input, generates fake passwords with injected characters, detects keylogger presence through comparison, and triggers security alerts. This multi-functionality reduces the need for separate security mechanisms, managing complexity through consolidation

Inventive Principle:

Principle #6Universality (Multi-functionality)

Data Source

PatentUS12556532B2System and method to detect and prevent keylogging attacks

Publication Date: 2026.02.17 KYNDRYL INC

AI summary

In an first aspect of the disclosure, there is a computer-implemented method which includes: obtaining, by a computing device, a password entered by an account user, placing, by the computing device, the password in memory of a device; generating, by the computing device, a fake password by randomly injecting characters into the password; storing, by the computing device, the fake password in a secure database; and deleting the password from the memory.