# US 2018/0025155 A1 · Toggle key blocking method for data security and apparatus using the same

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2018/0025155 A1
- Document ID: US20180025155A1
- Status: Published application
- Kind: A1
- Application number: 15/389,645
- Filed: 2016-12-23
- Published: 2018-01-25
- Earliest claimed: 2016-07-25
- Assignees: Electronics and Telecommunications Research Institute
- Applicants: Electronics and Telecommunications Research Institute
- Inventors: YoungJae MAENG; Sang Hun LEE; In Jung KIM
- Web page: https://patentgrep.com/patent/US20180025155A1

## CPC

- G06F 21/554: {involving event detection and direct action}
- G06F 21/556: {involving covert channels, i.e. data leakage between processes (inhibiting the analysis of circuitry or operation with measures against power attack G06F21/755)}
- G06F 21/83: input devices, e.g. keyboards, mice or controllers thereof
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A toggle key blocking method for data security and an apparatus using the same. The toggle key blocking method for data security includes monitoring use of a toggle key on a host with which a keyboard is used, when use of a toggle key on the host is detected, generating details of occurrence of a toggle key event based on a time at which the toggle key event occurred; and blocking use of the toggle key on the host if the host satisfies a toggle key blocking condition based on the details of occurrence of the toggle key event.

## Claims

### Claim 1

A toggle key blocking method for data security, comprising:
monitoring use of a toggle key on a host with which a keyboard is used;
when use of a toggle key on the host is detected, generating details of occurrence of a toggle key event based on a time at which the toggle key event occurred; and
blocking use of the toggle key on the host if the host satisfies a toggle key blocking condition based on the details of occurrence of the toggle key event.

### Claim 2 (depends on 1)

The toggle key blocking method of claim 1, wherein blocking the use of the toggle key is configured to set a current time to a time at which the toggle key event first occurred, and to determine that the host satisfies the toggle key blocking condition when a number of occurrences of the toggle key event during a preset detection period from the current time is greater than a preset number of occurrences.

### Claim 3 (depends on 2)

The toggle key blocking method of claim 2, wherein blocking the use of the toggle key is configured to, when a subsequent toggle key event occurs after the preset detection period from the current time has passed, reset the current time to a time at which the subsequent toggle key event occurs after the preset detection period has passed.

### Claim 4 (depends on 3)

The toggle key blocking method of claim 3, wherein blocking the use of the toggle key is configured to initialize the number of occurrences of the toggle key event to ‘0’ when the current time is reset.

### Claim 5 (depends on 1)

The toggle key blocking method of claim 1, wherein monitoring the use of the toggle key is configured to monitor toggle key data transmitted from the host at a level of a keyboard driver to the keyboard.

### Claim 6 (depends on 5)

The toggle key blocking method of claim 5, wherein monitoring the use of the toggle key is configured to monitor the use of the toggle key by utilizing a function for checking a state of the toggle key at preset periods.

### Claim 7 (depends on 5)

The toggle key blocking method of claim 5, wherein monitoring the use of the toggle key is configured to monitor a keyboard event occurring on the host based on Dynamic Link Library (DLL) hooking.

### Claim 8 (depends on 1)

The toggle key blocking method of claim 1, wherein monitoring the use of the toggle key is configured to monitor toggle key data transmitted from the host at a level of a keyboard controller provided in the host to the keyboard.

### Claim 9 (depends on 2)

The toggle key blocking method of claim 2, wherein blocking the use of the toggle key is configured to block the use of the toggle key by dropping the toggle key event.

### Claim 10 (depends on 9)

The toggle key blocking method of claim 9, wherein blocking the use of the toggle key is configured to, when it is impossible to drop the toggle key event, create noise for the toggle key event by generating an arbitrary toggle key event.

### Claim 11

A toggle key blocking apparatus for data security, comprising:
a monitoring unit for monitoring use of a toggle key on a host with which a keyboard is used;
a detection unit for, when use of a toggle key on the host is detected, generating details of occurrence of a toggle key event based on a time at which the toggle key event occurred; and
a blocking unit for blocking the use of the toggle key on the host if the host satisfies a toggle key blocking condition based on the details of occurrence of the toggle key event.

### Claim 12 (depends on 11)

The toggle key blocking apparatus of claim 11, wherein the blocking unit is configured to set a current time to a time at which the toggle key event first occurred, and to determine that the host satisfies the toggle key blocking condition when a number of occurrences of the toggle key event during a preset detection period from the current time is greater than a preset number of occurrences.

### Claim 13 (depends on 12)

The toggle key blocking apparatus of claim 12, wherein the blocking unit is configured to, when a subsequent toggle key event occurs after the preset detection period from the current time has passed, reset the current time to a time at which the subsequent toggle key event occurs after the preset detection period has passed.

### Claim 14 (depends on 13)

The toggle key blocking apparatus of claim 13, wherein the blocking unit is configured to initialize the number of occurrences of the toggle key event to ‘0’ when the current time is reset.

### Claim 15 (depends on 11)

The toggle key blocking apparatus of claim 11, wherein the monitoring unit is configured to monitor toggle key data transmitted from the host at a level of a keyboard driver to the keyboard.

### Claim 16 (depends on 15)

The toggle key blocking apparatus of claim 15, wherein the monitoring unit is configured to monitor the use of the toggle key by utilizing a function for checking a state of the toggle key at preset periods.

### Claim 17 (depends on 15)

The toggle key blocking apparatus of claim 15, wherein the monitoring unit is configured to monitor a keyboard event occurring on the host based on Dynamic Link Library (DLL) hooking.

### Claim 18 (depends on 11)

The toggle key blocking apparatus of claim 11, wherein the monitoring unit is configured to monitor toggle key data transmitted from the host at a level of a keyboard controller provided in the host to the keyboard.

### Claim 19 (depends on 12)

The toggle key blocking apparatus of claim 12, wherein the blocking unit is configured to block the use of the toggle key by dropping the toggle key event.

### Claim 20 (depends on 19)

The toggle key blocking apparatus of claim 19, wherein the blocking unit is configured to, when it is impossible to drop the toggle key event, create noise for the toggle key event by generating an arbitrary toggle key event.