Detecting synthetic keystrokes

Patent metadata

Field	Value
Publication number	US-9342687-B2
Application number	US-201414453946-A
Country	US
Kind code	B2
Filing date	Aug 7, 2014
Priority date	Aug 7, 2014
Publication date	May 17, 2016
Grant date	May 17, 2016

Abstract

Detecting synthetic keystrokes by maintaining a record of one or more keystrokes of physical keyboard input detected by an operating system of a computer, detecting a keystroke received at a computer application process that is executed by the computer, determining that the keystroke received at the computer application process is absent from the record of keystrokes of physical keyboard input, and identifying the keystroke received by the computer application process as being a synthetic keystroke.

First claim

What is claimed is:

1. A method for detecting synthetic keystrokes, the method comprising:
maintaining a record of one or more physical keystrokes of physical keyboard input detected by an operating system of a computer from a program routine in a kernel space of a computer memory of the computer that directly contacts keyboard input/output ports of the computer;
detecting, by a synthetic keystroke detector in a user space of the computer memory, a keystroke received at a computer application process that is executed by the computer;
comparing the record of one or more physical keystrokes of the physical keyboard input to the keystroke received at the computer application process;
based on the comparison, determining that the keystroke received at the computer application process is absent from the record of physical keystrokes of the physical keyboard input;
identifying the keystroke received by the computer application process as being a synthetic keystroke; and
performing a predefined security-related action, wherein the predefined security-related action includes at (i) notifying a user of the synthetic keystroke and (ii) withholding the synthetic keystroke from the computer application process.

2. The method of claim 1 , further comprising detecting the physical keyboard input substantially when the physical keyboard input is detected by the operating system of the computer.

3. The method of claim 1 , further comprising detecting the physical keyboard input using a kernel filter driver.

4. The method of claim 1 , further comprising detecting the physical keyboard input using an interrupt service routine in the kernel space of the computer memory that is managed by the operating system.

5. The method of claim 1 , wherein detecting the keystroke received at the computer application process comprises detecting the keystroke received at the computer application process using a keystroke interception library in the user space of the computer memory that is managed by the operating system.

6. The method of claim 1 , wherein detecting the keystroke received at the computer application process comprises detecting the keystroke received at the computer application process using a patch on a message loop of the computer application process.

7. The method of claim 1 , wherein detecting the keystroke received at the computer application process comprises detecting the keystroke received at the computer application process by subclassing a keystroke-receiving class of the computer application process.

8. The method of claim 1 , wherein detecting the keystroke received at the computer application process comprises intercepting the keystroke received at the computer application process; and
further comprising withholding the intercepted keystroke from the computer application process.

9. A system for detecting synthetic keystrokes, the system comprising:
one or more computer processors operatively coupled with one or more memory devices including non-transitory computer readable storage media;
program instructions stored on the one or more non-transitory computer readable storage media being executed by at least one of the one or more processors, the program instructions comprising:
a physical keystroke recorder configured to maintain a record of one or more keystrokes of physical keyboard input detected by an operating system of a computer from a program routine in a kernel space of a computer memory of the computer that directly contacts keyboard input/output ports of the computer; and
a synthetic keystroke detector configured to:
detect, by the synthetic keystroke detector in a user space of the computer memory, a keystroke received at a computer application process that is executed by the computer,
compare the record of one or more physical keystrokes of the physical keyboard input to the keystroke received at the computer application process,
based on the comparison, determine that the keystroke received at the computer application process is absent from the record of physical keystrokes of the physical keyboard input,
identify the keystroke received by the computer application process as being a synthetic keystroke, and

perform a predefined security-related action, wherein the predefined security-related action includes (i) notifying a user of the synthetic keystroke and (ii) withholding the synthetic keystroke from the computer application process.

10. The system of claim 9 , wherein the physical keystroke recorder is configured to detect the physical keyboard input substantially when the physical keyboard input is detected by the operating system of the computer.

11. The system of claim 9 , wherein the physical keystroke recorder is configured to detect the physical keyboard input using a kernel filter driver.

12. The system of claim 9 , wherein the physical keystroke recorder is configured to detect the physical keyboard input using an interrupt service routine in the kernel space of the computer memory that is managed by the operating system.

13. The system of claim 9 , wherein the synthetic keystroke detector is configured to detect the keystroke received at the computer application process using a keystroke interception library in the user space of the computer memory that is managed by the operating system.

14. The system of claim 9 , wherein the synthetic keystroke detector is configured to detect the keystroke received at the computer application process using a patch on a message loop of the computer application process.

15. The system of claim 9 , wherein the synthetic keystroke detector is configured to detect the keystroke received at the computer application process by subclassing a keystroke-receiving class of the computer application process.

16. The system of claim 9 , wherein the synthetic keystroke detector is configured to intercept the keystroke received at the computer application process, and withhold the intercepted keystroke from the computer application process.

17. The system of claim 9 , wherein the physical keystroke recorder and the synthetic keystroke detector are implemented in any of a) computer hardware, and b) computer software embodied in the non-transitory computer readable storage media.

18. A computer program product for detecting synthetic keystrokes, the computer program product comprising:
one or more non-transitory computer readable storage media; and
program instructions, stored on the one or more non-transitory computer readable storage media, when executed by a hardware processor, causing the program instructions to:
maintain a record of one or more physical keystrokes of physical keyboard input detected by an operating system of a computer from a program routine in a kernel space of a computer memory of the computer that directly contacts keyboard input/output ports of the computer,
detect, by a synthetic keystroke detector in a user space of the computer memory, a keystroke received at a computer application process that is executed by the computer,
compare the record of one or more physical keystrokes of the physical keyboard input to the keystroke received at the computer application process,
based on the comparison, determine that the keystroke received at the computer application process is absent from the record of physical keystrokes of the physical keyboard input;
to identify the keystroke received by the computer application process as being a synthetic keystroke, and
to perform a predefined security-related action, wherein the predefined security-related action includes (i) notifying

Assignees

• IBM

Inventors

• Boodaei Mickey

Classifications

• G06F21/50 Primary

  Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems · CPC title

• G06F21/83 Primary

  input devices, e.g. keyboards, mice or controllers thereof · CPC title

• G06F3/023

  Arrangements for converting discrete items of information into a coded form, e.g. arrangements for interpreting keyboard generated codes as alphanumeric codes, operand codes or instruction codes · CPC title

• H04L63/0428

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title

• G06F21/31

  User authentication · CPC title