Virtualized Keyboard Path Obfuscation Against Keylogging
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional anti-keylogging techniques require privileged access to the hardware and operating system, disrupt the user experience, and are ineffective against malicious processes intercepting keystrokes without administrative level access.
Innovation Solution
The system dynamically virtualizes a protected application in user space using micro-containers, injecting keystrokes with timestamps and random tags to create an isolated keyboard path, obfuscating user input, and separating obfuscated keystrokes to prevent keylogging without privileged access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional anti-keylogging techniques are used, then keylogging protection is provided, but privileged access to hardware and operating system is required
Solution Approach 1:
The patent introduces an intermediary virtualized keyboard path between the physical keyboard and the target application. This virtualized path receives keystrokes, obfuscates them by mixing with random injected keystrokes, and forwards the obfuscated sequence to the application. This intermediary layer prevents direct access to the keyboard hardware while maintaining protection functionality.
Solution Approach 2:
The patent creates a virtual copy of the keyboard input path that operates independently from the physical keyboard. The virtualized keyboard path generates synthetic keystroke sequences that replicate the appearance of real user input to malicious processes, while the actual user input is preserved through the obfuscation mechanism.
2Reliability
If traditional anti-keylogging techniques are used, then keylogging protection is provided, but user experience is disrupted
Solution Approach 1:
The virtualized keyboard path operates transparently in the background, automatically obfuscating keystrokes without requiring user intervention. The system self-manages the obfuscation process by injecting random keystrokes and separating them from user input, maintaining normal user interaction while providing protection.
Solution Approach 2:
The patent changes the temporal parameters of keystroke delivery by introducing random time intervals and timestamps between keystrokes. This temporal obfuscation makes it difficult for malicious processes to detect and intercept actual user input, while the user experiences no disruption as the timing variations are imperceptible.
3Reliability
If traditional anti-keylogging techniques are used, then keylogging protection is provided, but effectiveness against malicious processes without administrative access is reduced
Solution Approach 1:
The patent segments the keyboard input path into distinct isolated components: the physical keyboard input, the virtualized keyboard path, the obfuscation mechanism, and the target application. This segmentation creates an isolated execution environment where keystrokes are processed through multiple independent stages, making it difficult for malicious processes to intercept at any single point.
Solution Approach 2:
The patent adds a temporal dimension to keystroke obfuscation by associating each keystroke with a timestamp and introducing random time intervals. This temporal layer makes it impossible for malicious processes to distinguish between actual user input and injected keystrokes based on timing patterns, thereby protecting against unprivileged malicious processes.
Data Source
AI summary
Systems and methods for obfuscating keyboard keys against interception are provided. In an example, a protected application is dynamically virtualized in user space, wherein the virtualization comprises an isolated keyboard path. Keystrokes are injected to the isolated keyboard path, wherein the injected keystrokes are associated with a respective timestamp, and user input keystrokes are obfuscated with the injected keystrokes and the obfuscated keystrokes are passed to a low level hook. The obfuscated keystrokes passed to the low level hook are separated according to tags associated with the obfuscated keystrokes to obtain the user input keystrokes. The user input keystrokes are transmitted to a target window of the protected application.