Keyboard-input information-security apparatus and method

1. A keyboard-input information-security apparatus comprising:

an interrupt-descriptor table for storing a list of addresses of functions for handling interrupts, and storing an address of a secure input-interrupt service routine at a specific location in an address area for an operating-system input interrupt-service routine supported by an operating system;

a secure input-device driver for changing keyboard-interrupt-vector information to invoke the address of the secure input interrupt-service routine when a keyboard interrupt is generated by a keyboard-input device, and receiving and encoding data input via the keyboard-input device based on the address of the secure input interrupt-service routine; and

a secure input unit for delivering the encoded data from the secure input-device driver to an application program,

wherein the secure input-device driver sets a GD (thirteenth) bit of a debug register DR 7 among debug registers DR 0 to DR 7 to a specific value and sets a keyboard input/output port in at least one of registers DR 0 to DR 3 in order to defend against a port-polling attack, and wherein when a security-exception handler is registered in a vector number of the interrupt-descriptor table corresponding to the specific value and the debug register is accessed, an exception occurs and the registered security-exception handler is invoked, and

wherein the security-exception handler analyzes the debug register DR 6 among the debug registers, determines whether an accessing program is an authorized program or an unauthorized program depending on association with the GD bit, and controls to permit or block the access depending on the determination result.

2. The apparatus of claim 1 , wherein the secure input-device driver comprises:

a data receiver for receiving the data input from the keyboard-input device when the keyboard interrupt is generated by the keyboard-input device;

an encoder for encoding the data received by the data receiver;

a monitor for monitoring a change in the address of the secure input interrupt-service routine that is registered in the interrupt-descriptor table; and

a controller for changing the keyboard-interrupt-vector information to invoke the address of the secure input interrupt-service routine when the keyboard interrupt is generated by the keyboard-input device, and controlling operation of the secure input-device driver.

3. The apparatus of claim 2 , wherein the address of the secure input interrupt-service routine is an address of the data receiver.

4. The apparatus of claim 2 , wherein the monitor monitors a change in the keyboard-interrupt-vector information and access to a keyboard input/output port.

5. The apparatus of claim 1 , wherein when bit BD (the thirteenth bit) of the debug register DR 6 among the debug registers has been set to the specific value as a result of analyzing the register DR 6 , the security-exception handler traces a program accessing the debug register back to determine whether the accessing program is an authorized program or an unauthorized program, and blocks the access to the debug register when the accessing program is an unauthorized program, and

when at least one of bits B 0 to B 3 (bit zero to bit three) of the debug register DR 6 has been set to the specific value, the security-exception handler traces a program accessing a keyboard input/output port back to determine whether the accessing program is an authorized program or an unauthorized program, and controls to change a port-access value into another value when the accessing program is an unauthorized program.

6. The apparatus of claim 1 , wherein the specific value is “1” and the security-exception handler is set in vector 1 of the interrupt-descriptor table.

7. A keyboard-input information-security method comprising:

storing an address of a secure input interrupt-service routine at a specific location in an address area for an operating-system input interrupt-service routine supported by an operating system in an interrupt-descriptor table that stores a list of addresses of functions for handling interrupts;

changing keyboard-interrupt-vector information to invoke the address of the secure input interrupt-service routine when a keyboard interrupt is generated by a keyboard-input device, and executing the secure input interrupt-service routine based on the address of the secure input interrupt-service routine previously registered in the interrupt-descriptor table, wherein the secure input interrupt-service routine comprises fetching and encoding data input by the keyboard-input device;

setting a GD (thirteenth) bit of a debug register DR 7 among debug registers DR 0 to DR 7 to a specific value, setting a keyboard input/output port in at least one of registers DR 0 to DR 3 , and registering a security-exception handler in a vector number of the interrupt-descriptor table corresponding to the specific value, in order to defend against a port-polling attack, wherein an exception occurs and the registered security-exception handler is invoked when the debug register is accessed; and

analyzing, using the security-exception handler, the debug register DR 6 among the debug registers, to determine whether an accessing program is an authorized program or an unauthorized program depending on association with the GD bit, and permitting or blocking the access depending on the determination result.

8. The method of claim 7 , further comprising monitoring a change in the address of the secure input interrupt-service routine registered previously in the interrupt-descriptor table.

9. The method of claim 7 , further comprising decoding the encoded data and transmitting the decoded data to an application program.

10. The method of claim 7 , further comprising monitoring a change in the keyboard-interrupt-vector information and access to a keyboard input/output port.

11. The method of claim 7 , wherein:

when bit BD (the thirteenth bit) of the debug register DR 6 among the debug registers has been set to the specific value as a result of analyzing the register DR 6 , tracing, using the security-exception handler, a program accessing the debug register back to determine whether the accessing program is an authorized program or an unauthorized program, and blocking the access to the debug register when the accessing program is an unauthorized program, and

when at least one of bits B 0 to B 3 (bit zero to bit three) of the debug register DR 6 has been set to the specific value, tracing, using the security-exception handler, a program accessing a keyboard input/output port back to determine whether the accessing program is an authorized program or an unauthorized program, and changing a port-access value into another value when the accessing program is an unauthorized program.

12. The method of claim 7 , wherein the specific value is “1” and the security-exception handler is set in vector 1 of the interrupt-descriptor table.

13. A non-transitory computer-readable recording medium having a program recorded thereon for causing a suitably programmed computer to perform a method comprising:

storing an address of a secure input interrupt-service routine at a specific location in an address area for an operating-system input interrupt-service routine supported by an operating system in an interrupt-descriptor table that stores a list of addresses of functions for handling interrupts;

changing keyboard-interrupt-vector information to invoke the address of the secure input interrupt-service routine when a keyboard interrupt is generated by a keyboard-input device, and executing the secure input interrupt-service routine based on the address of the secure input interrupt-service routine previously registered in the interrupt-descriptor table, wherein the secure input interrupt-service routine comprises fetching and encoding data input by the keyboard-input device;

setting a GD (thirteenth) bit of a debug register DR 7 among debug registers DR 0 to DR 7 to a specific value, setting a keyboard input/output port in at least one of registers DR 0 to DR 3 , and registering a security-exception handler in a vector number of the interrupt-descriptor table corresponding to the specific value, in order to defend against a port-polling attack, wherein an exception occurs and the registered security-exception handler is invoked when the debug register is accessed, and

analyzing, in the security-exception handler, the debug register DR 6 among the debug registers to determine whether an accessing program is an authorized program or an unauthorized program depending on association with the GD bit, and permitting or blocking the access depending on the determination result.

14. The computer-readable recording medium of claim 13 , further comprising instructions stored thereon that cause the method to further include:

monitoring a change in the address of the secure input interrupt-service routine registered previously in the interrupt-descriptor table; and

decoding the encoded data and transmitting the decoded data to an application program.

15. The computer-readable recording medium of claim 13 , further comprising instructions stored thereon that cause the method to further include:

monitoring a change in the keyboard-interrupt-vector information and access to a keyboard input/output port.

16. The computer-readable recording medium of claim 13 , further comprising instructions stored thereon that cause the method to further include:

when bit BD (the thirteenth bit) of the debug register DR 6 among the debug registers has been set to the specific value as a result of analyzing the register DR 6 :

tracing, using the security-exception handler, a program accessing the debug register back to determine whether the accessing program is an authorized program or an unauthorized program, and blocking the access to the debug register when the accessing program is an unauthorized program, and

when at least one of bits B 0 to B 3 (bit zero to bit three) of the debug register DR 6 has been set to the specific value:

tracing, using the security-exception handler, a program accessing a keyboard input/output port back to determine whether the accessing program is an authorized program or an unauthorized program, and changing a port-access value into another value when the accessing program is an unauthorized program.

17. The computer-readable recording medium of claim 13 , wherein the specific value is “1” and the security-exception handler is set in vector 1 of the interrupt-descriptor table.