Systems and methods for key logger prevention security techniques

• US 10,785,256 B1
• Filed: 06/07/2018
• Issued: 09/22/2020
• Est. Priority Date: 06/04/2008
• Status: Active Grant

• Current Assignee: United Services Automobile Association
• Original Assignee: United Services Automobile Association
• Inventors: Voutour, Teddy Joseph Edmond, Morris, Michael Frank
• Primary Examiner(s): Shehni, Ghazal B
• Application Number:
  US16/002,571
• Time in Patent Office: 838 Days
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/82 Protecting input, output or interconnection devices
• CPC Class Codes: G06F 2221/031 Protect user input by software means
• CPC Class Codes: G06F 3/048 Interaction techniques based on graphical user interfaces [GUI]
• CPC Class Codes: G06F 3/0638 Organizing or formatting or addressing of data
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

An applet may be downloaded or provided to a web browser when a user visits a site in order to protect data input by the user from being captured by malicious software, such as key loggers. The applet may present a user input field in the web browser and may generate a random sequence of low-level key stroke or mouse click events within the input field when the user enters information, such as a username and/or password. A listening key logger will receive a large amount of random data, whereas the applet will receive and buffer the actual user data that may be communicated to a remote site access by the user.

Claims

1. A method of obfuscating input data received from a user in a user interface on a computer by loading an applet within the user interface, the method performed by the applet and comprising:

receiving user input data in an input field from a user;

generating additional obfuscatory data in the input field combined with the user input data while the user input data is being input in the input field, the obfuscatory data representing one or more keystroke events;

retrieving, from the input field that stores the user input data combined with the generated additional obfuscatory data, at least the user input data; and

presenting only the retrieved user input data to a remote server for processing a user transaction.

2. The method according to claim 1, said generating step further comprises the step of generating the additional obfuscatory data in accordance with a type of the input field.

3. The method according to claim 2, said generating step further comprises the steps of:

generating numeric additional obfuscatory data in response to determining that the input field is adapted to receive numeric input data; and

generating alphanumeric additional obfuscatory data in response to determining that the input field is adapted to receive alphanumeric input data.

4. The method according to claim 1, said generating step further comprises the step of generating the additional obfuscatory data at a frequency similar to that of a user entering data.

5. The method according to claim 1, wherein the additional obfuscatory data comprises randomly generated data.

6. The method according to claim 1, said generating step comprises generating one or more random sequences of keystroke events in the input field.

7. The method according to claim 1, said user input data comprises data representing at least one keystroke event.

8. A non-transitory computer-readable medium encoded with computer-readable instructions for obfuscating input data received from a user in a user interface on a computer by loading an applet within the user interface, said computer-readable instructions comprising instructions that:

receive user input data in an input field from a user;

generate additional obfuscatory data in the input field combined with the user input data while the first input data is being input in the input field, the obfuscatory data representing one or more keystroke events;

retrieve, from the input field that stores the user input data combined with the generated additional obfuscatory data, at least the user input data; and

present only the retrieved user input data to a remote server for processing a user transaction.

9. The non-transitory computer-readable medium according to claim 8, further comprising computer-readable instructions that generate the additional obfuscatory data in accordance with a type of the input field.

10. The non-transitory computer-readable medium according to claim 9, further comprising computer-readable instructions that:

generate numeric additional obfuscatory data in response to a determination that the input field is adapted to receive numeric input data; and

generate alphanumeric additional obfuscatory data in response to a determination that the input field is adapted to receive alphanumeric input data.

11. The non-transitory computer-readable medium according to claim 8, further comprising computer-readable instructions that generate the additional obfuscatory data at a frequency similar to that of a user entering data.

12. The non-transitory computer-readable medium according to claim 8, wherein the additional obfuscatory data comprises randomly generated data.

13. A system for obfuscating input data received from a user in a user interface on a computer by loading an applet within the user interface, comprising:

a user computer accessible by a user, said user computer having a user interface;

an applet loaded within said user interface, said user interface including an input field adapted to receive user input data from the user, said applet;

generating additional obfuscatory data in said input field combined with the user input data while the user input data is being input in the input field, the obfuscatory data representing one or more keystroke events; and

retrieving, from the input field that stores the user input data combined with the generated additional obfuscatory data, at least the user input data; and

a remote server, in communication with said applet, said applet presenting only the retrieved user input data to said remote server for processing a user transaction.

14. The system according to claim 13, wherein said applet generates said additional obfuscatory data in accordance with a type of said input field.

15. The system according to claim 14, wherein said additional obfuscatory data generated by said applet comprises numeric additional obfuscatory data in response to determining that said input field is adapted to receive numeric input data, and wherein said additional obfuscatory data generated by said applet comprises alphanumeric additional obfuscatory data in response to determining that said input field is adapted to receive alphanumeric input data.

16. The system according to claim 13, wherein said applet generates said additional obfuscatory data at a frequency similar to that of a user entering data.

17. The system according to claim 13, wherein said additional obfuscatory data comprises randomly generated data.