Method and system for handling keystroke commands

• US 20080301816A1
• Filed: 06/01/2007
• Published: 12/04/2008
• Est. Priority Date: 06/01/2007
• Status: Abandoned Application

• Current Assignee: Imprivata Incorporated
• Original Assignee: Imprivata Incorporated
• Inventors: Ting, David M. T., Eskenazi, Daniel V.
• Application Number:
  US11/809,791
• Publication Number:
  US 20080301816A1
• Time in Patent Office: Days
• US Class Current: 726/26
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

Keystroke commands are safeguarded from keyboard logging malware based on a destination application'"'"'s memory address.

Claims

1. A method for handling keystroke commands, the method comprising:

monitoring keystroke commands being presented to a computer system; and

handling keystroke commands based on a memory address attributed to an application to which the keystroke commands are being directed.

2. The method of claim 1, wherein the keystroke commands comprise logon credentials.

3. The method of claim 2, wherein the logon credentials facilitate automation of a logon procedure.

4. The method of claim 3, wherein the automation of the logon procedure comprises injecting user credentials into a form.

5. The method of claim 1, wherein the monitoring of the keystroke commands further comprises intercepting messages in a message queue.

6. The method of claim 5, further comprising the step of providing a client agent for intercepting the messages.

7. The method of claim 6, wherein the client agent intercepts the messages by hooking into the message queue.

8. The method of claim 7, wherein the client agent hooks into the message queue by substituting a wrapper function in the place of a callback function.

9. The method of claim 6, wherein the client agent processes the keystroke commands based at least in part on how they are handled.

10. The method of claim 9, wherein the client agent calls the callback function based at least in part on how the keystroke commands are handled.

11. The method of claim 9, wherein the client agent bypasses the callback function based at least in part on how the keystroke commands are handled.

12. The method of claim 11, wherein bypassing the callback function results in blocking an operating system from processing the keystroke commands.

13. The method of claim 1, wherein handling keystroke commands results in safeguarding keystroke commands from malware.

14. The method of claim 1, further comprising determining if the application to which the keystroke commands are being directed is an authorized application.

15. A client-resident agent for handling keystroke commands entered via an input device and directed to a running application associated with a memory having a plurality of addresses, the agent comprising functionality for:

monitoring the keystroke commands; and

handling the keystroke commands based on a memory address associated with the application.

16. The client-resident agent of claim 15, wherein the keystroke commands comprise logon credentials.

17. The client-resident agent of claim 16, wherein the client-resident agent further comprises functionality for automating a logon procedure.

18. The client-resident agent of claim 17, wherein the client-resident agent automates the logon procedure by injecting user credentials into a form.

19. The client-resident agent of claim 15, wherein the client-resident agent monitors the keystroke commands by intercepting messages in a message queue.

20. The client-resident agent of claim 19, wherein the client-resident agent intercepts the messages by hooking into the message queue.

21. The client-resident agent of claim 20, wherein the client-resident agent hooks into the message queue by substituting a wrapper function for a callback function.

22. The client-resident agent of claim 21, wherein the client-resident agent calls the callback function based at least in part on how the keystroke commands are handled.

23. The client-resident agent of claim 21, wherein the client-resident agent bypasses the callback function based at least in part on how the keystroke commands are handled.

24. The client-resident agent of claim 23, wherein the client-resident agent bypasses the callback function, resulting in blocking an operating system from processing the keystroke commands.

25. The client-resident agent of claim 15, wherein the client-resident agent'"'"'s handling of keystroke commands results in safeguarding keystroke commands from malware.

26. A system for handling keystroke commands entered via an input device and directed to a running application associated with a memory having a plurality of addresses, the system comprising:

a client-resident agent for;

monitoring the keystroke commands; and

handling the keystroke commands based on a memory address associated with the application; and

a data storage module for storing a list of authorized applications.

27. The system of claim 26, wherein the data storage module further stores a list of the memory addresses allocated to the authorized applications.

28. An article of manufacture having computer-readable program portions embodied thereon for handling keystroke commands, the article comprising computer-readable instructions for:

monitoring keystroke commands being presented to a computer system; and

handling keystroke commands based on a memory address attributed to an application to which the keystroke commands are being directed.