KR20040066237A - Method for protecting from keystroke logging - Google Patents

Abstract

A method of preventing key input theft is disclosed. The present invention provides a method of manufacturing a computer, comprising: a) a user computer connected to a predetermined server through a communication network, the server transmitting a page including at least one personal information input window to the user computer; b) when the keyboard security program is installed in the user computer, the key logger determination module of the keyboard security program determines whether the key logger exists at the keyboard driver level of the user computer; c) If the key logger does not exist at the keyboard driver level and the key signal input is ready in a predetermined input window among the personal information input windows, the keyboard driver module may input the personal information into the personal information input window through the keyboard. Operating step; And d) operating the keyboard generation module to display a virtual keyboard on a screen of the user terminal when the key logger is present at the keyboard driver level and is ready for inputting a key signal in a predetermined input window among personal information input windows. When the personal information is transmitted to a predetermined server connected to a communication network, the personal information may be protected using a keyboard driver or a virtual keyboard in which a keyboard security program is installed.

Description

How to prevent keystroke theft {METHOD FOR PROTECTING FROM KEYSTROKE LOGGING}

The present invention relates to a key input theft prevention method, and more particularly, to a key input theft prevention method for protecting key input data from a key logger intercepting important personal information input by the keyboard.

As the Internet develops, it provides high speed and stable access environment, and is being used in various fields such as online shopping and online banking, beyond the level of knowledge sharing through simple web browsing in the past. As more and more services provide convenience in life, on the other hand, the use of their vulnerabilities to leak other people's personal information and increase their malicious use. Such illegal acts are at the very least invading the privacy of individuals and, moreover, threatening the property rights of individuals as well as degrading the trust of companies providing Internet services.

In general, hackers use a program called Key Logger to leak personal information, which receives keystrokes every time the user presses the keyboard and saves them in a file for hackers to view later. Release. 1 and 2, a personal computer 30 connects to the service server 10 through a communication network such as the Internet (S100). When the user who uses the personal computer 30 wishes to purchase goods in the Internet banking or shopping mall, SSL for maintaining the security of the user's personal information between the personal computer 30 and the service server 10 Network communication security such as (Secure Socket Layer) is set (S110). At this time, personal information, for example, a personal ID, a password, an account number, an account password, a credit card password, a social security number, etc. are input by the keyboard 40 (S120). The personal information input by the keyboard 40 is input to the window operating system of the personal computer 30, and the data input to the window operating system is transmitted to a keyboard driver in which a program called a key logger is stored, and thus a predetermined memory or buffer. (Buffer) (S130, S140, S150). The stored personal information is transmitted to the service server 10 through a communication network (S160). At this time, a network communication security 20 such as SSL is set between the personal computer 30 and the service server 10 to prevent leakage of personal information to a third party.

However, since there is no security device between the personal computer 30 and the keyboard 40 connected to the personal computer, it is exposed to a hacking tool such as a key logger. Thus, hackers receive personal information stored in files. The user who does not know the above process will tell the hacker the username and password. However, the key logger program may be legal or illegal depending on the intended use, and there is a tendency that hacking using the key logger is increasing because there is no difficulty for the general public and easy to use.

In order to prevent this, conventional keyboard security products try to preempt the value input from the keyboard using the secure keyboard driver at the driver stage, which is the front of the system, but fail to preempt the driver in the loading order. The disadvantage is that the driver must be loaded at the lowest level and the system restarted to preempt the problem. Also, in order to prevent the preemptive competition from being loaded on top of other competing drivers, it is necessary to remove the competing drivers and restart the system. At this time, there is no way to fully determine whether the driver to be removed is a keylogger or normal software. Therefore, when the driver to be removed is a driver of normal software, there has been a fatal problem such that the software does not operate normally or the system crashes due to the absence of the driver.

The present invention has been invented to solve the above problems, an object of the present invention when the user wants to enter information that requires security, such as ID or password, input directly from the keyboard to the web page without going through Active X (Active X) It is intended to provide a method for preventing key input theft by allowing a key logger to intercept data input from a keyboard.

In addition, an object of the present invention is to provide a key input theft prevention method designed to be used immediately without rebooting after installing the program of the present invention on-line (or off-line) to the user's computer. .

According to a first aspect of the present invention, there is provided a method for preventing key input theft, comprising: a) a user computer is connected to a predetermined server through a communication network, and the server includes at least one personal information input window. Transmitting the page to a user computer;

b) when a keyboard security program is installed in the user computer, the key logger determination module of the keyboard security program determines whether a key logger exists at a keyboard driver level of the user computer;

c) As a result of the determination of step b), if the key logger does not exist at the keyboard driver level and the preparation of the key signal input to a predetermined input window among the personal information input windows is completed, Operating a keyboard driver module to input personal information; And

d) If the key logger is present at the keyboard driver level and ready to input the key signal in a predetermined input window among the personal information input windows, the virtual keyboard is displayed on the screen of the user terminal. Characterized in that it comprises a step of operating the keyboard generation module.

Preferably, the key signal input from the keyboard or the virtual keyboard connected to the user computer is transmitted to the page using a dynamic hypertext modeling language object.

In addition, if the keyboard security program is not installed on the user's computer, the keyboard security program is downloaded and installed from the server to the user's computer further comprises the step of installing, the computer of the user where the keyboard security program is installed Characterized in that the step b) is performed without rebooting, the keyboard security program is distributed and installed through the form of ActiveX or plug-in.

More preferably, if the keyboard security program does not exist in the user's computer, the keyboard security program may be installed from the computer-readable recording medium, and the computer may be read by the user's computer. The recording medium is characterized in that the compact disk or diskette.

Preferably, the virtual keyboard is displayed on a predetermined area of the display unit, and a key input operation is performed using the virtual keyboard, and the key input operation on the virtual keyboard is performed by i-1) of the mouse. Selecting a corresponding region of the virtual keyboard by clicking or touching the touch screen; i-2) processing the key value assigned to the selected area in response to step i-1) as an input of the corresponding key; And i-3) transmitting the key input value processed in step i-2) to the page using the Dynamic Hyper Text Modeling Language (DHTML) object of Internet Explorer.

The server may selectively recognize a password input window among at least one personal information input window included in a page transmitted to the user computer, thereby securing data input to the password input window.

Therefore, according to the present invention, when transmitting personal information to a predetermined server connected to a communication network, personal information can be protected by using a keyboard driver or a virtual keyboard having a keyboard security program installed thereon.

1 shows a schematic system for describing the prior art.

2 is a flowchart illustrating a process in which data input by a keyboard conventionally reaches a service server.

3 is a flowchart illustrating an operation of a keyboard security program for explaining a method according to an embodiment of the present invention.

4 is a diagram illustrating a module of a keyboard security program according to an embodiment of the present invention.

5 to 7 illustrate examples of driving a keyboard security program according to an embodiment of the present invention.

<Explanation of symbols for the main parts of the drawings>

10: service server

20: Secure network communication such as SSL

30: personal computer

40: keyboard

300: keyboard security program

310: installation module

320: keylogger judgment module

330: virtual keyboard module

340: Secure Keyboard Driver Module

350: data input / output module

Hereinafter, with reference to the accompanying drawings will be described a preferred embodiment of the present invention.

3 is a flowchart illustrating a process of operating a keyboard security program according to an embodiment of the present invention, and FIG. 4 is a diagram illustrating the keyboard security program for each module.

Referring to FIG. 4, the keyboard security program 300 may include an installation module 310, a key logger determination module 320, a virtual keyboard module 330, a secure keyboard driver module 340, and a data input / output module 350. Include.

3 and 4, when the keyboard security program of the present invention does not exist in a personal computer connected to a communication network, the installation module 310 of the keyboard security program is activated. Or the Plug In program to install the keyboard security program on the personal computer (S200). In this case, the keyboard security program may be stored in a storage medium such as a diskette or a compact disc (CD). Therefore, the personal computer can be installed on the personal computer through a diskette or a compact disk in which the keyboard security program is stored even when the personal computer is not connected to the communication network, that is, off-line.

The personal computer on which the keyboard security program is installed connects to the service server through a communication network such as the Internet (S205).

When a user using the personal computer wants to purchase an item in an internet banking or shopping mall, a network communication such as SSL (Secure Socket Layer) for maintaining the security of the user's personal information between the personal computer and the service server Security is set (S210).

In order to extend and secure the network communication security between the personal computer and the keyboard connected to the personal computer, the key logger determination module 320 of the keyboard security program installed in the personal computer searches for a keyboard driver, that is, a device driver level, to search for a key logger. It is determined whether a predetermined program such as (Key Logger) exists (S220).

The keyboard security program of the present invention uses a Dynamic Hyper Text Modeling Language (DHTML) object of Internet Explorer of the Internet to directly access a web browser or a predetermined program without going through ActiveX. It is possible to maintain the security of the data entered when entering with.

In the key logger determination method, the key logger determination module 320 searches for a device driver level and determines that a program such as a key logger exists if a driver other than the system default driver exists.

Another key logger determination method includes a method in which the key logger determination module 320 searches a device driver level and checks and determines a start address of a driver.

Another key logger determination method is a method in which the key logger determination module 320 searches for a device driver level and determines that a program such as a key logger exists if the address table of the driver is changed.

Another key logger determination method is a method in which the key logger determination module 320 searches a device driver level and checks and determines a human interface device class used by a USB keyboard or the like. The human interface device (HID) refers to an input device such as a keyboard and a mouse, and the present invention provides a key input value that a key logger accesses the input device through the human interface device class and is input from an input device such as a keyboard or a mouse. Can be prevented.

As a result of the determination of the keylogger determination module 320, when the program determined to be the keylogger does not exist at the device driver level, the keylogger determination module 320 activates the security keyboard driver module 340 to secure the security keyboard driver mode. Switch to (S230). When the security keyboard driver mode is switched, when a web page for inputting personal information is transmitted from the service server to the personal computer and the cursor is placed on the password input window of the web page, the keyboard security program 300 operates. Personal information that is input from the keyboard to the data input / output module 350 of the keyboard security program 300 is securely delivered directly to the web page by using a dynamic hypertext modeling language (DHTML) object of Internet Explorer. (S250).

Referring to FIG. 5 as another application example, when the cursor is placed on the account password input window to input the account password of the web page transmitted from the service server, the secure keyboard driver module of the secure keyboard program operates. The security keyboard driver module operates and is protected by the keyboard security program as shown in FIG. 5. Guide texts such as [Enter by keyboard] may be displayed to indicate that the program is secured by the security program.

However, as a result of the determination of the key logger determination module 320 of the keyboard security program 300, when a program determined as a key logger preempts a key input value in the keyboard driver, the key logger determination module 320 Activates the virtual keyboard module 330 to switch to the virtual keyboard mode (S240).

When the web page for inputting personal information is transmitted to the personal computer by the service server and the cursor is placed on the password input window of the web page, the virtual keyboard module is activated and the personal server is switched to the virtual keyboard mode. Display the virtual keyboard on the screen of your computer. In this case, the letters or numbers of the virtual keyboard displayed on the screen are selected by the mouse instead of the keyboard (S250). The virtual keyboard module operates and is protected by the keyboard security program as shown in FIGS. 6 and 7. Guidance text such as [input using virtual keyboard] may be displayed to indicate that the program is secured by a security program.

In another application example, when the corresponding area of the virtual keyboard is selected by the touch of the touch screen, a key value assigned to the corresponding area is processed as an input of the corresponding key. For example, when a password "1234" is to be selected on a screen of a user computer on which a virtual keyboard is displayed, when the 1,2,3,4 are sequentially selected on the virtual keyboard, the password 1, 2 or 3 may be entered into the keyboard security program 300. , 3,4 are entered in order.

The personal information input through the keyboard secured in step S250 or the personal information input through the virtual keyboard is securely input to the protected web browser or program through the data input / output module 350 of the keyboard security program 300 (S260). ).

5 to 7 illustrate examples of driving a keyboard security program according to an embodiment of the present invention.

FIG. 5 illustrates a case in which a program determined as a key logger does not exist at a device driver level, the personal computer may input personal information transmitted from a service server connected to a communication network through a keyboard on a web page or a web browser. When entering a password, etc. of personal information, a keyboard security program operates to input personal information securely through a web browser or a program through security. In other words, the time point at which the keyboard security program operates is when the cursor blinks so that the user can input data into a predetermined input window, for example, a password input window, among personal information on the web page or the web browser.

In addition, as shown in Figure 6, when there is a program that is determined to be a key logger at the device driver level, when you want to enter a password on a web page, the keyboard security program of the present invention automatically detects the virtual keyboard screen of the personal computer Is displayed. In this case, when the user clicks a mouse or selects a key of the virtual keyboard by touch, a key input value assigned to the selected area is used by using a dynamic hypertext modeling language (DHTML) object of Internet Explorer. To the page.

In addition, as shown in FIG. 7, when there is a program that is determined to be a keylogger at the device driver level, the keyboard security program of the present invention operates even when a key is input in a certificate program or the like so that a virtual keyboard is displayed on a screen of a personal computer. Is displayed.

As described in detail above, according to the method for preventing key input theft of the present invention, it is developed as an ASP (Application Service Provider) product and can be downloaded and installed immediately using any computer anytime, anywhere through the Internet, and the Internet is connected. If not, you can install a keyboard security program stored on a diskette or compact disc. In addition, it supports security keyboard driver mode and virtual keyboard mode, so it can be used immediately after installation without rebooting the system in any situation, so users can be convenient by eliminating the inconvenience of rebooting. In addition, due to the characteristics of existing products using a keyboard driver, when used with other key loggers (Key Loggers) using the keyboard driver, the vulnerability that can intercept the keyboard information in the order in which the driver is loaded can be overcome. There is no pressure on keyloggers to compete with other security programs to preempt keystrokes and restart. In addition, the keyboard security program of the present invention can be applied not only to a web page but also to any other application, and thus can be extended by adding a list of applications to which the application is widely applied. In addition, in the past, by installing ActiveX on a web page and receiving a key input value from a device driver and inputting the web page, by using the Internet Explorer's DHTML object, the web page is directly transmitted to the web page without going through ActiveX. Since there is no need to insert ActiveX into the web page, no modification is required on the web page, and all password input windows can be applied comprehensively without modification.

Embodiment of the present invention is only one embodiment, of course, many modifications and variations of the components of the present invention without departing from the gist of the present invention, of course, the present invention is not limited to the embodiment. .

Claims (14)

a) a user computer is connected to a predetermined server via a communication network, and the server transmits a page including at least one personal information input window to the user computer; b) when a keyboard security program is installed in the user computer, the key logger determination module of the keyboard security program determines whether a key logger exists at a keyboard driver level of the user computer; c) As a result of the determination of step b), if the key logger does not exist at the keyboard driver level and the preparation of the key signal input to a predetermined input window among the personal information input windows is completed, Operating a keyboard driver module to input personal information; And d) If the key logger is present at the keyboard driver level and ready to input the key signal in a predetermined input window among the personal information input windows, the virtual keyboard is displayed on the screen of the user terminal. And operating the keyboard generation module. The method of claim 1, The key signal input from the keyboard or the virtual keyboard connected to the user computer is transmitted to the page using a dynamic hypertext modeling language object. The method of claim 1, further comprising the step of downloading and installing the keyboard security program from the server to the user's computer when the keyboard security program is not installed on the user's computer. And performing step b) without rebooting the user's computer on which the keyboard security program is installed. 4. The method of claim 3, wherein the keyboard security program is distributed and installed through ActiveX or plug-in. 2. The method of claim 1, further comprising installing the keyboard security program from a computer-readable recording medium if the keyboard security program does not exist in the user's computer. Prevention method. 6. The method of claim 5, wherein the computer-readable recording medium of the user is a compact disk or diskette. The method of claim 1, wherein the virtual keyboard is displayed in a predetermined area of a display unit, and a key input operation is performed using the virtual keyboard. The method of claim 7, wherein performing a key input operation on the virtual keyboard i-1) selecting a corresponding region of the virtual keyboard by clicking a mouse or touching a touch screen; i-2) processing the key value assigned to the selected area in response to step i-1) as an input of the corresponding key; And i-3) transmitting the key input value processed in step i-2) to the page using a dynamic hyper text modeling language (DHTML) object of Internet Explorer. Way. The method of claim 1, wherein the server selectively recognizes a password input window among at least one personal information input window included in a page transmitted to the user computer to secure data input to the password input window. How to prevent keystroke theft. The method of claim 1, wherein in step c), whether a key logger exists at the keyboard driver level is determined based on whether a driver other than a system default driver exists at the keyboard driver level. Prevention method. 2. The method of claim 1, wherein in step c), whether a key logger exists at the keyboard driver level is determined by checking a driver start address of the keyboard driver level. 2. The method of claim 1, wherein in the step c), whether a key logger exists at the keyboard driver level is determined according to whether the address table of the driver is changed at the keyboard driver level. . 2. The method of claim 1, wherein in step c), a key logger exists at the keyboard driver level to determine a human interface device (HID) class. The method of claim 1, wherein the personal information includes at least one of an ID, a password, a passbook number, a password, and an authentication number.