键盘输入安全研究

Research of Keyboard Input Security

键盘记录器是网络用户面临的主要安全威胁之一。以保障敏感信息的安全输入为出发点,分析了按键信息传输流程,系统总结了键盘输入信息所面临的来自物理层、内核层、应用层的截获、查询、旁路等类型的安全威胁以及现有研究和应用的相应防御措施;介绍了软键盘所面临的偷窥、消息截获、截屏等威胁及其防御措施,提出鼠标记录攻击、控件分析攻击等新的威胁以及相应的对策;然后对现有研究和应用的敏感信息输入进行了安全性测试;最后介绍了现有研究中基于行为的键盘记录器检测方法。

Keylogger is one of the most serious threats to the Internet users. In order to protect sensitive information in-put, the study summarized the threats along the process of information inputting using a keyboard and corresponding preventive measures. These threats work at different levels（physical/ring 0/ring 3）and use different attack approach （Query/Hook/Bypass）. We summarized the threats faced by soft keyboard such as peep, screenshots, or information in- tercepted. We also proposed new attacks based on mouse behavior record, element analysis and measures to defense these attacks. We then tested the performance of security measures which are employed by existing research and appli-cations. At last, the existing research in behavior-based keyloggers detection was summarized.