Screen Capture Prevention via Windowless Process Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security measures to prevent malware from acquiring private user data through screen capture techniques often result in 'false positive' identifications, frustrating users by preventing legitimate screen captures.
Innovation Solution
A method and software agent that differentiate between legitimate and malicious processes by allowing only processes that open a window or are on a dynamic white list to perform screen captures, preventing unidentified windowless processes from capturing data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security software prevents all screen capture operations under suspicious conditions, then security against malware is improved, but user convenience deteriorates due to false positives
Solution Approach 1:
The patent applies local quality by differentiating the treatment of screen capture operations based on the specific characteristics of the process. Instead of applying a uniform prevention rule to all screen captures, the system analyzes individual process properties (window ownership, white list status) and applies prevention only to malicious cases while allowing legitimate ones. This resolves the contradiction by making security measures targeted rather than blanket, thus maintaining security while reducing false positives that harm user convenience.
2Loss of information
If screen capture is completely blocked to prevent data theft, then data security is improved, but legitimate functionality deteriorates
Solution Approach 1:
The patent implements dynamics by making the screen capture permission system adaptive rather than static. The system dynamically evaluates each screen capture request based on current process state (whether it owns a window, whether it's on the white list) and makes real-time decisions. This allows the system to adapt to different legitimate scenarios (screenshot tools, screen readers, etc.) while blocking malicious ones, thus preserving legitimate functionality while maintaining data security.
Solution Approach 2:
The patent introduces an intermediary mechanism (the security software agent) that mediates between the desire to block screen captures for security and the need to allow them for legitimate functionality. This intermediary analyzes process characteristics and acts as a gatekeeper, allowing legitimate screen captures while blocking malicious ones. This resolves the contradiction by providing a nuanced middle ground rather than complete blocking or complete allowance.
3Device complexity
If simple prevention rules are applied to block screen captures, then implementation complexity is reduced, but false positive rate increases
Solution Approach 1:
The patent applies preliminary action by establishing a white list of legitimate processes before screen capture operations occur. Processes are pre-approved based on their identity and behavior patterns, so when screen capture is attempted, the system can quickly check against this pre-established list. This resolves the contradiction by doing the complex analysis work in advance, making the actual screen capture decision simple and fast, thus reducing both implementation complexity and false positives.
Data Source
AI summary
A method for preventing the acquisition of data by a screen capturing malware, comprises preventing an unidentified process that does not open a window from performing screen capture.