Ransomware prevention method, device, terminal and computer readable storage medium

Abstract

Embodiments of the present application provide a ransomware prevention method and device, a terminal and a computer readable storage medium. The method generates a first pseudo-random number based on a pseudo-random number generation module in response to the target software obtaining a random number, so that the target software encrypts the target file based on a key generated by the first pseudo-random number. Then, the second pseudo-random number identical to the first pseudo-random number is generated again based on the pseudo-random number generation module, and the target file is decrypted by using the second pseudo-random number. Embodiments of the present application change the way of obtaining the random number by the target software, and generate the first pseudo-random number and the second pseudo-random number based on the pseudo-random number generation module, which are both generated within a preset range. Therefore, the target file encrypted based on the key generated by the first pseudo-random number can be easily cracked, thereby solving the technical problem that the ransomware encrypts the file of the user, so that the encrypted file cannot be technically cracked.

Description

Technical Field

[0001] This application relates to the field of cybersecurity technology, and in particular to a ransomware prevention method, apparatus, terminal, and computer-readable storage medium. Background Technology

[0002] In recent years, with the rapid popularization of the Internet, various cyberattacks have occurred frequently. Using ransomware to attack users has become the most common and far-reaching cyberattack method. Ransomware encrypts users' files, and the encrypted files cannot be technically cracked, thereby coercing users to pay ransom, which poses a great challenge to network security. Summary of the Invention

[0003] This application provides a ransomware prevention method, apparatus, terminal, and computer-readable storage medium, which can solve the current technical problem of difficulty in preventing ransomware attacks.

[0004] In a first aspect, embodiments of this application provide a ransomware prevention method, the method comprising:

[0005] In response to the target software's operation of obtaining a random number, a first pseudo-random number is generated based on the pseudo-random number generation module, so that the target software generates a key based on the first pseudo-random number and encrypts the target file based on the key;

[0006] The pseudo-random number generation module generates a second pseudo-random number, and the target file is decrypted based on the second pseudo-random number. The second pseudo-random number is the same as the first pseudo-random number.

[0007] Optionally, the generation of the first pseudo-random number based on the pseudo-random number generation module includes:

[0008] The pseudo-random number generation module generates a first pseudo-random number using at least one of the machine code information and time information of the target software's running terminal.

[0009] Optionally, the step of generating a first pseudo-random number based on the pseudo-random number generation module using at least one of the machine code information and time information of the target software's running terminal includes:

[0010] The target number of times the target software obtains the random number is recorded. Based on the pseudo-random number generation module, at least one of the machine code information and time information of the target software's running terminal, as well as the target number of times, is encrypted to generate a first pseudo-random number.

[0011] Optionally, the step of causing the target software to generate a key based on the first pseudo-random number and encrypt the target file based on the key includes:

[0012] The target software generates an encryption public key and a decryption private key corresponding to the encryption public key based on the first pseudo-random number, and encrypts the target file based on the encryption public key; wherein, the decryption private key is used to decrypt the encrypted target file.

[0013] Optionally, the decryption of the target file based on the second pseudo-random number includes:

[0014] The decryption private key is generated based on the second target pseudo-random number, and the target file is decrypted based on the decryption private key.

[0015] Optionally, prior to the operation of obtaining a random number in response to the target software, the method further includes:

[0016] Establish a software blacklist;

[0017] The operation in response to the target software obtaining a random number includes:

[0018] If an operation to obtain a random number is detected, and it is determined that the software corresponding to the operation to obtain a random number belongs to the software blacklist, then the software corresponding to the operation to obtain a random number is determined to be the target software, and the operation to obtain a random number is responded to by the target software.

[0019] Optionally, after establishing the software blacklist, the following steps are also included:

[0020] Create a software whitelist;

[0021] The method further includes:

[0022] In response to the operation of obtaining a random number by whitelisted software in the software whitelist, a target true random number is generated based on the target true random number, so that the whitelisted software performs a target operation based on the target true random number.

[0023] Secondly, embodiments of this application also provide a ransomware prevention device, the device comprising:

[0024] The response module is adapted to respond to the target software's operation of obtaining a random number, and generates a first pseudo-random number based on the pseudo-random number generation module, so that the target software generates a key based on the first pseudo-random number and encrypts the target file based on the key;

[0025] The decryption module is adapted to generate a second pseudo-random number based on the pseudo-random number generation module, and to decrypt the target file based on the second pseudo-random number, wherein the second pseudo-random number is the same as the first pseudo-random number.

[0026] Optionally, the response module is further adapted to generate a first pseudo-random number based on the pseudo-random number generation module using at least one of the machine code information and time information of the target software's running terminal.

[0027] Optionally, the response module is further adapted to record the target number of times the target software obtains the random number, and to encrypt at least one of the machine code information and time information of the target software's running terminal and the target number of times based on the pseudo-random number generation module to generate a first pseudo-random number.

[0028] Optionally, the response module is further adapted to cause the target software to generate an encryption public key and a decryption private key corresponding to the encryption public key based on the first pseudo-random number, and to encrypt the target file based on the encryption public key; wherein the decryption private key is used to decrypt the encrypted target file.

[0029] Optionally, the decryption module is adapted to generate the decryption private key based on the second target pseudo-random number, and to decrypt the target file based on the decryption private key.

[0030] Optionally, the ransomware prevention device includes a software blacklist creation module, which is adapted to create a software blacklist; the response module is adapted to determine the software corresponding to the random number acquisition operation as the target software and to respond to the target software's random number acquisition operation if it detects an operation to acquire random numbers and determines that the software corresponding to the random number acquisition operation belongs to the software blacklist.

[0031] Optionally, the ransomware prevention device includes a software whitelist creation module, which is adapted to create a software whitelist; the ransomware prevention device also includes a whitelist response module, which is adapted to respond to the operation of whitelisted software in the software whitelist to obtain a random number, and to enable the whitelisted software to perform a target operation based on the target true random number generated by the random number generation module.

[0032] Thirdly, embodiments of this application also provide a terminal, the terminal comprising:

[0033] Processor; and

[0034] A memory configured to store computer-executable instructions, which, when executed, cause the processor to perform any of the methods described above.

[0035] Fourthly, embodiments of this application also provide a computer-readable storage medium that stores one or more programs that, when executed by a processor, implement the method described in any one of the above-described embodiments.

[0036] The beneficial effects of the technical solutions provided in some embodiments of this application include at least the following:

[0037] By changing the way the target software obtains random numbers, a pseudo-random number generation module is used to generate the first pseudo-random number. Here, the first pseudo-random number can be generated again by the pseudo-random number generation module, making it easier to crack the target file encrypted with the key generated based on the first pseudo-random number. This solves the technical problem of ransomware encrypting user files, making the encrypted files impossible to crack technically. Attached Figure Description

[0038] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0039] Figure 1 An exemplary system architecture diagram of a ransomware prevention method provided in this application embodiment;

[0040] Figure 2 A schematic flowchart illustrating a ransomware prevention method provided in an embodiment of this application;

[0041] Figure 3 A schematic diagram illustrating how software obtains a target true random number based on a whitelist within a software whitelist, as provided in this application embodiment;

[0042] Figure 4 A schematic diagram illustrating the acquisition of a first pseudo-random number based on target software in a software blacklist, provided as an embodiment of this application;

[0043] Figure 5 A schematic diagram of a ransomware prevention device provided in an embodiment of this application;

[0044] Figure 6 This is a schematic diagram of the structure of a ransomware prevention terminal provided in an embodiment of this application. Detailed Implementation

[0045] To make the features and advantages of the embodiments of this application more apparent and understandable, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the protection scope of the embodiments of this application.

[0046] With the rapid popularization of the Internet, various cyberattacks occur frequently. Ransomware threats are currently one of the most prevalent cybersecurity issues, posing a significant challenge to the stable operation of enterprises and government agencies, and becoming a major risk challenge facing the world today.

[0047] In the field of ransomware prevention, security vendors focus more on intercepting and eliminating the software, with relatively little research on ransomware decryption and remediation. It is generally believed that after a terminal is attacked by ransomware, without the attacker providing the key, the encrypted files are unpredictable due to the randomness of the encryption key. Furthermore, the security of the file encryption algorithms, such as the frequently used AES (Advanced Encryption Standard), Salsa20 (stream cipher), and RC4 (Rivest Cipher 4), makes the encryption keys virtually unbreakable in the current environment.

[0048] To overcome the aforementioned technical problems, this application provides a ransomware prevention method. In response to the target software's operation of obtaining random numbers, the method generates a first pseudo-random number based on a pseudo-random number generation module. The target software then generates a key based on this first pseudo-random number and encrypts the target file using that key. Subsequently, a second pseudo-random number, identical to the first pseudo-random number, is generated again using the pseudo-random number generation module, and the target file is decrypted using the second pseudo-random number. This application changes the way the target software obtains random numbers, utilizing a pseudo-random number generation module to generate the first pseudo-random number. Here, the first pseudo-random number can be generated again by the pseudo-random number generation module, making it easier to crack the target file encrypted with the key generated from the first pseudo-random number. This solves the technical problem of ransomware encrypting user files, making the encrypted files technically unbreakable.

[0049] Please see Figure 1 , Figure 1 An exemplary system architecture diagram of a ransomware prevention method provided in this application embodiment.

[0050] like Figure 1As shown, the system architecture may include a terminal 101, a network 102, and a server 103. The network 102 serves as the medium for providing a communication link between the terminal 101 and the server 103. The network 102 may include various types of wired or wireless communication links, such as wired communication links including fiber optic cables, twisted-pair cables, or coaxial cables, and wireless communication links including Bluetooth communication links, Wireless-Fidelity (Wi-Fi) communication links, or microwave communication links, etc.

[0051] Terminal 101 can interact with server 103 via network 102 to receive messages from or send messages to server 103. Alternatively, terminal 101 can interact with server 103 via network 102 to receive messages or data sent to server 103 by other users. Terminal 101 can be hardware or software. When terminal 101 is hardware, it can be various terminals, including but not limited to smartwatches, smartphones, tablets, laptops, and desktop computers. When terminal 101 is software, it can be installed in the terminals listed above, and it can be implemented as multiple software programs or software modules (e.g., to provide distributed services) or as a single software program or software module; no specific limitation is made here.

[0052] In this embodiment, terminal 101 can respond to the target software's operation of obtaining a random number by generating a first pseudo-random number based on the pseudo-random number generation module, so that the target software generates a key based on the first pseudo-random number and encrypts the target file based on the key; then, it generates a second pseudo-random number again based on the pseudo-random number generation module, and decrypts the target file based on the second pseudo-random number, wherein the second pseudo-random number is the same as the first pseudo-random number.

[0053] Server 103 can be a business server providing various services. It should be noted that server 103 can be either hardware or software. When server 103 is hardware, it can be implemented as a distributed server cluster consisting of multiple servers, or as a single server. When server 103 is software, it can be implemented as multiple software programs or software modules (e.g., used to provide distributed services), or as a single software program or software module; no specific limitations are made here.

[0054] Alternatively, the system architecture may not include server 103. In other words, server 103 may be an optional device in the embodiments of this specification. That is, the method provided in the embodiments of this specification can be applied to a system structure that only includes terminal 101. The embodiments of this application do not limit this.

[0055] It should be understood that Figure 1The number of terminals, networks, and servers shown is only illustrative; the number can be any number of terminals, networks, and servers depending on the implementation requirements.

[0056] Please see Figure 2 , Figure 2 This is a flowchart illustrating a ransomware prevention method provided in an embodiment of this application. The executing entity in this embodiment can be a terminal executing the ransomware prevention method, a processor within the terminal executing the ransomware prevention method, or a ransomware prevention service within the terminal executing the ransomware prevention method. For ease of description, the following uses the processor within the terminal as an example to describe the specific execution process of the ransomware prevention method.

[0057] S202: In response to the target software's operation of obtaining a random number, a first pseudo-random number is generated based on the pseudo-random number generation module, so that the target software generates a key based on the first pseudo-random number and encrypts the target file based on the key.

[0058] The target software includes, but is not limited to, ransomware, and may also include software without permission to obtain random numbers. The pseudo-random number generation module can generate a predetermined number of first pseudo-random numbers within a defined range. However, in response to the target software's operation to obtain random numbers, the pseudo-random number generation module can generate one or more of the predetermined number of first pseudo-random numbers for the target software to obtain. After obtaining the first pseudo-random numbers, the target software processes them to generate a key, and then encrypts the target file based on the key.

[0059] In one feasible implementation, when the target software's operation to obtain random numbers is detected, calls to the following random number generation functions or instructions by the target program are intercepted, including the following CPU instructions for generating random numbers: rdrand, rdseed, rdtsc; the following API interfaces for random number generation functions: CryptGenRandom, CryptGenKey, GenerateKey, GenerateIV, Crypto / rand / read, TickCount, UuidCreate; and the API (Application Programming Interface) interfaces for random number generation functions in the cryptographic library: RandomNumber Generator, BCryptGenRandom, etc. Simultaneously, the interface of the random number generation module interfacing with the target software is replaced with the interface of the pseudo-random number generation module, so that the target software can obtain the first pseudo-random number from the pseudo-random number generation module.

[0060] S204: Generate a second pseudo-random number based on the pseudo-random number generation module, and decrypt the target file based on the second pseudo-random number. The second pseudo-random number is the same as the first pseudo-random number.

[0061] Since the pseudo-random number generation module can generate a preset number of first pseudo-random numbers within a defined range, the second pseudo-random number generated afterward also falls within this range. In other words, both the first and second pseudo-random numbers generated by the pseudo-random number generation module are within the preset range.

[0062] The target file is decrypted by generating a second pseudo-random number in sequence. If the decryption fails, the next second pseudo-random number is generated again to decrypt the target file until the decryption is successful. At this time, the second pseudo-random number is the same as the first pseudo-random number.

[0063] In one feasible implementation, when the target file is decrypted based on the second pseudo-random number generated by the pseudo-random number generation module, the pseudo-random number generation module may generate the second pseudo-random number capable of decrypting the target file once or multiple times. Generally, when the key of the target file is generated based on a single first pseudo-random number, the pseudo-random number generation module can generate the second pseudo-random number capable of decrypting the target file in the first to the preset number of times. Of course, when the preset number is Y, when the key of the target file is generated based on N first pseudo-random numbers, the pseudo-random number generation module can generate the second pseudo-random number capable of decrypting the target file in the nth time, where n is less than or equal to A. n Y And positive integers greater than 0.

[0064] This application provides a ransomware prevention method. In response to the target software's operation of obtaining random numbers, the method generates a first pseudo-random number based on a pseudo-random number generation module. The target software then generates a key based on this first pseudo-random number and encrypts the target file using that key. Subsequently, a second pseudo-random number, identical to the first pseudo-random number, is generated again using the same pseudo-random number generation module, and the target file is decrypted using this second pseudo-random number. This application changes the way the target software obtains random numbers, utilizing a pseudo-random number generation module to generate the first pseudo-random number. Here, the first pseudo-random number can be generated again by the pseudo-random number generation module; that is, both the first and second pseudo-random numbers are generated within a preset range. This makes it easier to crack the target file encrypted with the key generated from the first pseudo-random number, thereby solving the technical problem of ransomware encrypting user files, making the encrypted files technically unbreakable.

[0065] In one embodiment provided in this application, step S202, which generates a first pseudo-random number based on the pseudo-random number generation module, includes:

[0066] The pseudo-random number generation module generates a first pseudo-random number using at least one of the machine code information and time information of the target software's running terminal.

[0067] The machine code information of the target software's running terminal includes an identification code corresponding to that terminal, which can include at least one of letters and numbers. The machine code information is generally derived from the serial number of the hardware corresponding to the target software's running terminal, such as a hard drive, motherboard, or CPU (central processing unit). Since the machine code information is usually only known to the user of the terminal, ransomware attackers have difficulty obtaining it. Therefore, ransomware attackers will not obtain the first pseudo-random number, preventing them from launching further attacks.

[0068] Furthermore, since the time information of the target software's running terminal changes in real time, the first pseudo-random number generated at different times can be different based on the real-time changing time information, and the time information is within a certain range.

[0069] If the current time is converted to hours, the time information will vary between integers 0 and 24; if the current time is converted to minutes, the time information will vary between integers 0 and 1440; if the current time is converted to seconds, there are 86,400 seconds in a day, and the time information will vary between integers 0 and 86,400.

[0070] Since the range of machine code information and the range of time information of the target software's operating terminal are both defined, the range of the first pseudo-random number generated by the pseudo-random number generation module using at least one of the machine code information and time information of the target software's operating terminal is also defined. It should be noted that the first pseudo-random number can be generated based solely on machine code information or time information; preferably, it can also be generated simultaneously based on both machine code information and time information.

[0071] In this embodiment, the first pseudo-random number generated can also be regenerated based on the pseudo-random number generation module using at least one of the machine code information and time information of the target software's running terminal, so as to decrypt the target file using the second pseudo-random number.

[0072] In one embodiment provided in this application, a pseudo-random number generation module generates a first pseudo-random number using at least one of the machine code information and time information of the target software's running terminal, including:

[0073] Record the target number of times the target software obtains random numbers. Based on the pseudo-random number generation module, encrypt at least one of the machine code information and time information of the target software's running terminal, as well as the target number of times, to generate the first pseudo-random number.

[0074] The target software can obtain random numbers multiple times to generate keys. Since the terminal processor has a fast processing speed, the random numbers obtained by the target software multiple times may be generated at the same time point, such as within the same second, the same minute, or the same hour. This may result in the first pseudo-random number generated based on time information or simultaneously based on machine code information and time information being the same. This will produce multiple identical first pseudo-random numbers, which reduces the security of the key generated based on multiple identical first pseudo-random numbers.

[0075] Therefore, by making the random number obtained each time different through a target number of times, the security level of the first pseudo-random number generated based on time information or simultaneously based on machine code information and time information is improved, thereby improving the security level of the key generated based on multiple first pseudo-random numbers.

[0076] The method of encrypting at least one of the machine code information and time information of the target software's running terminal and the target number of times based on the pseudo-random number generation module includes, but is not limited to, encryption using hash algorithms. Due to the characteristics of hash algorithms, if a remote attacker intercepts one or more sets of first pseudo-random numbers, it is difficult to deduce the machine code information from the first pseudo-random numbers or to know that the first pseudo-random numbers are obtained based on time information, and therefore it is difficult to predict the results of subsequent first pseudo-random numbers.

[0077] In this embodiment, the first pseudo-random number generated can also be regenerated by encrypting at least one of the machine code information and time information of the target software's running terminal and the target number of times based on the pseudo-random number generation module, so as to realize the decryption of the target file using the second pseudo-random number.

[0078] In one feasible implementation, the first pseudo-random number can be the hash value corresponding to (machine code information + time information (second level) + target number of times).

[0079] Another feasible implementation is that the first pseudo-random number can be [time information (seconds level) + hash(machine code information + time information (seconds level) + target number of times) % maximum span] · adjustment ratio. Here, hash(machine code + time (seconds level) + target number of times) represents the hash value of (machine code + time (seconds level) + target number of times). The maximum span is a preset adjustment parameter, which can be 100 or 1000, etc., and is not limited here. The adjustment ratio can include, but is not limited to, the terminal's performance parameters, such as CPU clock speed.

[0080] In one embodiment provided in this application, step S202, which involves causing the target software to generate a key based on a first pseudo-random number and encrypting the target file based on the key, includes:

[0081] The target software generates an encryption public key and a corresponding decryption private key based on a first pseudo-random number, and encrypts the target file based on the encryption public key; wherein, the decryption private key is used to decrypt the encrypted target file.

[0082] The target software generates a matching public key and a private key for decryption based on a first pseudo-random number. Files encrypted with the public key can generally only be decrypted using the private key.

[0083] Generally, when the target software is ransomware, after generating a decryption private key corresponding to the encryption public key, the ransomware will use the encryption public key to encrypt the decryption private key again, and then destroy the encrypted file to prevent users from technically cracking the decryption private key.

[0084] In one embodiment provided in this application, step S204, which involves decrypting the target file based on a second pseudo-random number, includes:

[0085] A decryption private key is generated based on the second target pseudo-random number, and the target file is decrypted based on the decryption private key.

[0086] Here, the second target pseudo-random number can be obtained by generating random numbers once or multiple times through the pseudo-random number generation module; that is, the second target pseudo-random number can be obtained by the pseudo-random number generation module using an exhaustive method. The second target pseudo-random number is then converted into a decryption private key, which is used to decrypt the target file. This achieves the cracking of the ransomware-encrypted target file.

[0087] In one embodiment provided in this application, step S202, prior to the operation of the target software obtaining a random number, further includes:

[0088] Establish a software blacklist;

[0089] In response to the target software's operation of obtaining random numbers, including:

[0090] If an operation to obtain random numbers is detected, and it is determined that the software corresponding to the operation to obtain random numbers belongs to the software blacklist, then the software corresponding to the operation to obtain random numbers is identified as the target software, and the operation to obtain random numbers is initiated in response to the target software.

[0091] Specifically, a software blacklist is established based on ransomware and software that does not have permission to obtain random numbers. When software that obtains random numbers is on the software blacklist, the software corresponding to the operation of obtaining random numbers is designated as the target software.

[0092] Here, the software blacklist can be updated. When the software corresponding to the operation of obtaining random numbers is unknown software—that is, the unknown software is neither on the software blacklist nor on any other pre-established list, such as the software whitelist—if the terminal running the unknown software is in a remote desktop environment (i.e., being remotely controlled), and the unknown software has been installed on that terminal for less than a preset time period, then the unknown software is added to the software blacklist to update the blacklist. For example, if the unknown software was first installed on that terminal less than 2 days ago, then the unknown software is added to the software blacklist to update the blacklist.

[0093] For example, if the software used to generate random numbers is unknown software—meaning it's neither on the software blacklist nor any other pre-established list—and this unknown software is downloaded from the network or copied to a removable storage medium, entering its running terminal, and the installation time on that terminal is less than a preset time period, then the unknown software is added to the software blacklist for updating the blacklist. For instance, if the unknown software's first installation on that terminal is less than 3 days ago, then the unknown software is added to the software blacklist for updating the blacklist.

[0094] Alternatively, if the software corresponding to the operation of obtaining random numbers is unknown software, that is, the unknown software is not on the software blacklist or on other pre-established lists, and the unknown software is located on removable storage media, then the unknown software is added to the software blacklist to update the software blacklist.

[0095] In one embodiment provided in this application, after establishing the software blacklist, the method further includes:

[0096] Create a software whitelist;

[0097] The method also includes:

[0098] In response to the whitelist software's operation of obtaining a random number, a target true random number is generated based on the random number generation module, so that the whitelist software performs the target operation based on the target true random number.

[0099] Among them, whitelisted software located in the software whitelist can normally obtain the target true random number and execute the target operation corresponding to the whitelisted software based on the target true random number. Common examples include dice-rolling software and random name-calling software.

[0100] Here, the software whitelist can be updated. When the software corresponding to the operation of obtaining random numbers is unknown software (meaning it's neither on the blacklist nor the whitelist), and the terminal running this unknown software is in a remote desktop environment (i.e., being remotely controlled), and the unknown software's installation time on that terminal is greater than or equal to a preset time period, then this unknown software is added to the software whitelist for updating the whitelist. For example, if the unknown software's first installation time on that terminal is greater than or equal to 2 days, then this unknown software is added to the software whitelist for updating the whitelist.

[0101] For example, if the software used to generate random numbers is unknown software (neither on the software blacklist nor the software whitelist), and this unknown software is downloaded from the network or copied to a removable storage medium, and its installation time on that terminal is greater than or equal to a preset time period, then the unknown software will be added to the software whitelist for updating the whitelist. For instance, if the unknown software's first installation time on that terminal is greater than or equal to 3 days, then the unknown software will be added to the software whitelist for updating the whitelist.

[0102] Figure 3 This is a schematic diagram illustrating how software in a whitelist of software obtains a target true random number, as provided in an embodiment of this application. Figure 4 This is a schematic diagram illustrating how to obtain a first pseudo-random number based on a target software in a software blacklist, as provided in an embodiment of this application.

[0103] like Figure 3 and Figure 4 As shown, by changing the API interfaces called by the whitelist software and the target software, the whitelist software calls the random number generation module based on the first API interface, and the target software calls the pseudo-random number generation module based on the second API interface.

[0104] This application also provides a computer storage medium that can store multiple instructions adapted for loading by a processor and executing the steps of any of the methods described in the above embodiments.

[0105] Figure 5 This is a schematic diagram of a ransomware prevention device provided in an embodiment of this application. Figure 5 As shown.

[0106] Ransomware prevention device 500 includes:

[0107] The response module 510 is adapted to respond to the target software's operation of obtaining a random number, and generates a first pseudo-random number based on the pseudo-random number generation module, so that the target software generates a key based on the first pseudo-random number and encrypts the target file based on the key;

[0108] The decryption module 520 is suitable for generating a second pseudo-random number based on the pseudo-random number generation module, and decrypting the target file based on the second pseudo-random number. The second pseudo-random number is the same as the first pseudo-random number.

[0109] In one embodiment provided in this application, the response module 510 is further adapted to generate a first pseudo-random number based on the pseudo-random number generation module using at least one of the machine code information and time information of the target software's running terminal.

[0110] In one embodiment provided in this application, the response module 510 is further adapted to record the target number of times the target software obtains the random number, and to encrypt at least one of the machine code information and time information of the running terminal of the target software and the target number of times based on the pseudo-random number generation module to generate a first pseudo-random number.

[0111] In one embodiment provided in this application, the response module 510 is further adapted to cause the target software to generate an encryption public key and a decryption private key corresponding to the encryption public key based on the first pseudo-random number, and to encrypt the target file based on the encryption public key; wherein, the decryption private key is used to decrypt the encrypted target file.

[0112] In one embodiment provided in this application, the decryption module 520 is adapted to generate the decryption private key based on the second target pseudo-random number, and to decrypt the target file based on the decryption private key.

[0113] In one embodiment provided in this application, the ransomware prevention device 500 includes a software blacklist establishment module, which is adapted to establish a software blacklist; and a response module 510, which is adapted to determine that the software corresponding to the random number acquisition operation is the target software and respond to the target software's random number acquisition operation if an operation to acquire random numbers is detected and it is determined that the software corresponding to the random number acquisition operation belongs to the software blacklist.

[0114] In one embodiment provided in this application, the ransomware prevention device 500 includes a software whitelist establishment module, which is adapted to establish a software whitelist; the ransomware prevention device 500 also includes a whitelist response module, which is adapted to respond to the operation of whitelisted software in the software whitelist to obtain a random number, and based on the target true random number generated by the random number generation module, so that the whitelisted software performs a target operation based on the target true random number.

[0115] Please see Figure 6 , Figure 6 This is a schematic diagram of the structure of a ransomware prevention terminal provided in an embodiment of this application. Figure 6As shown, the data retrieval terminal 600 may include: at least one processor 601, at least one network interface 604, user interface 603, memory 605, and at least one communication bus 602.

[0116] The communication bus 602 is used to enable communication between these components.

[0117] The user interface 603 may include a display screen and a camera. Optionally, the user interface 603 may also include a standard wired interface and a wireless interface.

[0118] The network interface 604 may optionally include a standard wired interface or a wireless interface (such as a Wi-Fi interface).

[0119] The processor 601 may include one or more processing cores. The processor 601 connects to various parts within the experimental operation terminal 600 via various interfaces and lines. It executes various functions and processes data of the sample data management terminal 600 by running or executing instructions, programs, code sets, or instruction sets stored in the memory 605, and by calling data stored in the memory 605. Optionally, the processor 601 may be implemented using at least one hardware form of Digital Signal Processing (DSP), Field-Programmable Gate Array (FPGA), or Programmable Logic Array (PLA). The processor 601 may integrate one or more of the following: a Central Processing Unit (CPU), a Graphics Processing Unit (GPU), and a modem. The CPU primarily handles the operating system, user interface, and applications; the GPU is responsible for rendering and drawing the content to be displayed on the screen; and the modem handles wireless communication. It is understood that the modem may also be implemented as a separate chip without being integrated into the processor 601.

[0120] The memory 605 may include random access memory (RAM) or read-only memory (ROM). Optionally, the memory 605 may include a non-transitory computer-readable storage medium. The memory 605 can be used to store instructions, programs, code, code sets, or instruction sets. The memory 605 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function (such as touch function, sound playback function, image playback function, etc.), instructions for implementing the above-described method embodiments, etc.; the data storage area may store data involved in the above-described method embodiments, etc. Optionally, the memory 605 may also be at least one storage device located remotely from the aforementioned processor 601. Figure 6 As shown, the memory 605, which serves as a computer storage medium, may include an operating system, a network communication module, a user interface module, and a ransomware prevention program.

[0121] exist Figure 6 In the data retrieval terminal 600 shown, the user interface 603 is mainly used to provide an input interface for the user and obtain the user's input data; while the processor 601 can be used to call the ransomware prevention program stored in the memory 605 and specifically perform the following operations:

[0122] In response to the target software's operation of obtaining a random number, a first pseudo-random number is generated based on the pseudo-random number generation module, so that the target software generates a key based on the first pseudo-random number and encrypts the target file based on the key;

[0123] A second pseudo-random number is generated based on the pseudo-random number generation module. The target file is then decrypted based on the second pseudo-random number, which is the same as the first pseudo-random number.

[0124] In some embodiments, when the processor 601 generates a first pseudo-random number based on the pseudo-random number generation module, the following steps are included:

[0125] The pseudo-random number generation module generates a first pseudo-random number using at least one of the machine code information and time information of the target software's running terminal.

[0126] In some embodiments, when the processor 601 executes the pseudo-random number generation module to generate a first pseudo-random number using at least one of the machine code information and time information of the target software's running terminal, the process includes the following steps:

[0127] Record the target number of times the target software obtains random numbers. Based on the pseudo-random number generation module, encrypt at least one of the machine code information and time information of the target software's running terminal, as well as the target number of times, to generate the first pseudo-random number.

[0128] In some embodiments, when the processor 601 executes actions to cause the target software to generate a key based on a first pseudo-random number and encrypt a target file based on the key, the following steps are included:

[0129] The target software generates an encryption public key and a corresponding decryption private key based on a first pseudo-random number, and encrypts the target file based on the encryption public key; wherein, the decryption private key is used to decrypt the encrypted target file.

[0130] In some embodiments, the processor 601 performs decryption of the target file based on a second pseudo-random number, including the following steps:

[0131] A decryption private key is generated based on the second target pseudo-random number, and the target file is decrypted based on the decryption private key.

[0132] In some embodiments, the processor 601 performs the following before the target software performs an operation to obtain a random number:

[0133] Establish a software blacklist;

[0134] In response to the target software's operation of obtaining random numbers, including:

[0135] If an operation to obtain random numbers is detected, and it is determined that the software corresponding to the operation to obtain random numbers belongs to the software blacklist, then the software corresponding to the operation to obtain random numbers is identified as the target software, and the operation to obtain random numbers is initiated in response to the target software.

[0136] In some embodiments, after establishing the software blacklist, the processor 601 also performs the following:

[0137] Create a software whitelist;

[0138] The method also includes:

[0139] In response to the whitelist software's operation of obtaining a random number, a target true random number is generated based on the random number generation module, so that the whitelist software performs the target operation based on the target true random number.

[0140] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative. For instance, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or modules may be electrical, mechanical, or other forms.

[0141] The modules described as separate components may or may not be physically separate. The components shown as modules may or may not be physical modules; that is, they may be located in one place or distributed across multiple network modules. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0142] Furthermore, the functional modules in the various embodiments of this application can be integrated into one processing module, or each module can exist physically separately, or two or more modules can be integrated into one module. The integrated module can be implemented in hardware or as a software functional module.

[0143] If the integrated module is implemented as a software functional module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application embodiment, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0144] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that the embodiments of this application are not limited to the described order of actions, because according to the embodiments of this application, some steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also understand that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily essential to the embodiments of this application.

[0145] In the above embodiments, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0146] The above is a description of a ransomware prevention method, apparatus, terminal, and computer-readable storage medium provided in the embodiments of this application. For those skilled in the art, based on the ideas of the embodiments of this application, there will be changes in the specific implementation methods and application scope. Therefore, the content of this specification should not be construed as a limitation on the embodiments of this application.

[0147] Embodiments of the present invention disclose A1, a ransomware prevention method, wherein the method includes:

[0148] In response to the target software's operation of obtaining a random number, a first pseudo-random number is generated based on the pseudo-random number generation module, so that the target software generates a key based on the first pseudo-random number and encrypts the target file based on the key;

[0149] A second pseudo-random number is generated based on the pseudo-random number generation module. The target file is then decrypted based on the second pseudo-random number, which is the same as the first pseudo-random number.

[0150] A2. The ransomware prevention method as described in A1, wherein generating a first pseudo-random number based on a pseudo-random number generation module includes:

[0151] The pseudo-random number generation module generates a first pseudo-random number using at least one of the machine code information and time information of the target software's running terminal.

[0152] A3. The ransomware prevention method as described in A2, wherein the pseudo-random number generation module generates a first pseudo-random number using at least one of the machine code information and time information of the target software's running terminal, including:

[0153] Record the target number of times the target software obtains random numbers. Based on the pseudo-random number generation module, encrypt at least one of the machine code information and time information of the target software's running terminal, as well as the target number of times, to generate the first pseudo-random number.

[0154] A4. The ransomware prevention method as described in any one of A2 to A3, wherein the method of causing the target software to generate a key based on a first pseudo-random number and encrypt the target file based on the key includes:

[0155] The target software generates an encryption public key and a corresponding decryption private key based on a first pseudo-random number, and encrypts the target file based on the encryption public key; wherein, the decryption private key is used to decrypt the encrypted target file.

[0156] A5. The ransomware prevention method as described in A4, wherein decrypting the target file based on a second pseudo-random number includes:

[0157] A decryption private key is generated based on the second target pseudo-random number, and the target file is decrypted based on the decryption private key.

[0158] A6. The ransomware prevention method as described in A1, wherein, prior to the operation of obtaining a random number in response to the target software, it further includes:

[0159] Establish a software blacklist;

[0160] In response to the target software's operation of obtaining random numbers, including:

[0161] If an operation to obtain random numbers is detected, and it is determined that the software corresponding to the operation to obtain random numbers belongs to the software blacklist, then the software corresponding to the operation to obtain random numbers is identified as the target software, and the operation to obtain random numbers is initiated in response to the target software.

[0162] A7. The ransomware prevention method described in A6, after establishing a software blacklist, also includes:

[0163] Create a software whitelist;

[0164] The method also includes:

[0165] In response to the whitelist software's operation of obtaining a random number, a target true random number is generated based on the random number generation module, so that the whitelist software performs the target operation based on the target true random number.

[0166] Embodiments of the present invention also disclose B8, a ransomware prevention device, wherein the device includes:

[0167] The response module is adapted to respond to the target software's operation of obtaining random numbers, and generates a first pseudo-random number based on the pseudo-random number generation module, so that the target software generates a key based on the first pseudo-random number and encrypts the target file based on the key;

[0168] The decryption module is suitable for generating a second pseudo-random number based on the pseudo-random number generation module, and decrypting the target file based on the second pseudo-random number. The second pseudo-random number is the same as the first pseudo-random number.

[0169] B9. The ransomware prevention device as described in B8, wherein the response module is further adapted to generate a first pseudo-random number based on at least one of the machine code information and time information of the target software's running terminal using the pseudo-random number generation module.

[0170] B10. The ransomware prevention device as described in B9, wherein the response module is further adapted to record the target number of times the target software obtains random numbers, and to encrypt at least one of the machine code information and time information of the target software's running terminal and the target number of times based on the pseudo-random number generation module to generate a first pseudo-random number.

[0171] B11. The ransomware prevention device as described in B8 or B9, wherein the response module is further adapted to cause the target software to generate an encryption public key and a decryption private key corresponding to the encryption public key based on a first pseudo-random number, and to encrypt the target file based on the encryption public key; wherein the decryption private key is used to decrypt the encrypted target file.

[0172] B12. The ransomware prevention device as described in B11, wherein the decryption module is adapted to generate a decryption private key based on a second target pseudo-random number, and to decrypt the target file based on the decryption private key.

[0173] B13. The ransomware prevention device as described in B8, wherein the ransomware prevention device includes a software blacklist establishment module, which is adapted to establish a software blacklist; and a response module adapted to determine that the software corresponding to the random number acquisition operation is the target software and to respond to the target software's random number acquisition operation if an operation to acquire random numbers is detected and it is determined that the software corresponding to the random number acquisition operation belongs to the software blacklist.

[0174] B14. The ransomware prevention device as described in B13, wherein the ransomware prevention device includes a software whitelist establishment module, which is adapted to establish a software whitelist; the ransomware prevention device also includes a whitelist response module, which is adapted to respond to the operation of whitelisted software in the software whitelist to obtain a random number, and based on the target true random number generated by the random number generation module, so that the whitelisted software performs a target operation based on the target true random number.

[0175] C15. A terminal, wherein the terminal includes:

[0176] Processor; and

[0177] The memory is configured to store computer-executable instructions, which, when executed, cause the processor to perform a method according to any one of A1 to A7.

[0178] D16. A computer-readable storage medium storing one or more programs that, when executed by a processor, implement the method of any one of A1 to A7.

Claims

1. A ransomware prevention method, wherein, The method includes: Establish a software blacklist; Create a software whitelist; In response to the target software's operation of obtaining a random number, a first pseudo-random number is generated based on the pseudo-random number generation module, so that the target software generates a key based on the first pseudo-random number and encrypts the target file based on the key; The pseudo-random number generation module generates a second pseudo-random number, and the target file is decrypted based on the second pseudo-random number. The second pseudo-random number is the same as the first pseudo-random number. The operation in response to the target software obtaining a random number includes: If an operation to obtain a random number is detected, and it is determined that the software corresponding to the operation to obtain a random number belongs to the software blacklist, then the software corresponding to the operation to obtain a random number is determined to be the target software and the operation to obtain a random number is responded to by the target software. In response to the operation of obtaining a random number by whitelisted software in the software whitelist, a target true random number is generated based on the target true random number, so that the whitelisted software performs a target operation based on the target true random number.

2. The ransomware prevention method as described in claim 1, wherein, The generation of the first pseudo-random number based on the pseudo-random number generation module includes: The pseudo-random number generation module generates a first pseudo-random number using at least one of the machine code information and time information of the target software's running terminal.

3. The ransomware prevention method as described in claim 2, wherein, The generation of a first pseudo-random number based on the pseudo-random number generation module utilizes at least one of the machine code information and time information of the target software's running terminal to generate a first pseudo-random number, including: The target number of times the target software obtains the random number is recorded. Based on the pseudo-random number generation module, at least one of the machine code information and time information of the target software's running terminal, as well as the target number of times, is encrypted to generate a first pseudo-random number.

4. The ransomware prevention method as described in any one of claims 2 to 3, wherein, The step of enabling the target software to generate a key based on the first pseudo-random number and encrypt the target file based on the key includes: The target software generates an encryption public key and a decryption private key corresponding to the encryption public key based on the first pseudo-random number, and encrypts the target file based on the encryption public key; wherein, the decryption private key is used to decrypt the encrypted target file.

5. The ransomware prevention method as described in claim 4, wherein, The decryption of the target file based on the second pseudo-random number includes: The decryption private key is generated based on the second pseudo-random number, and the target file is decrypted based on the decryption private key.

6. A ransomware prevention device, wherein, The device includes: The software blacklist creation module is suitable for creating software blacklists. The software whitelist creation module is suitable for creating software whitelists. The response module is adapted to respond to the target software's operation of obtaining a random number, and generates a first pseudo-random number based on the pseudo-random number generation module, so that the target software generates a key based on the first pseudo-random number and encrypts the target file based on the key; The decryption module is adapted to generate a second pseudo-random number based on the pseudo-random number generation module, and to decrypt the target file based on the second pseudo-random number, wherein the second pseudo-random number is the same as the first pseudo-random number; The response module is specifically adapted to determine the software corresponding to the random number acquisition operation as the target software and to respond to the target software's random number acquisition operation if it detects an operation to acquire random numbers and determines that the software corresponding to the random number acquisition operation belongs to the software blacklist. The whitelist response module is adapted to respond to the operation of whitelisted software in the software whitelist to obtain a random number, and to generate a target true random number based on the target true random number, so that the whitelisted software performs a target operation based on the target true random number.

7. The ransomware prevention device as described in claim 6, wherein, The response module is also adapted to generate a first pseudo-random number based on the pseudo-random number generation module using at least one of the machine code information and time information of the target software's running terminal.

8. The ransomware prevention device as described in claim 7, wherein, The response module is also adapted to record the target number of times the target software obtains the random number, and to encrypt at least one of the machine code information and time information of the target software's running terminal and the target number of times based on the pseudo-random number generation module to generate a first pseudo-random number.

9. The ransomware prevention device as described in claim 6 or 7, wherein, The response module is further adapted to enable the target software to generate an encryption public key and a decryption private key corresponding to the encryption public key based on the first pseudo-random number, and to encrypt the target file based on the encryption public key; wherein the decryption private key is used to decrypt the encrypted target file.

10. The ransomware prevention device as described in claim 9, wherein, The decryption module is adapted to generate the decryption private key based on the second pseudo-random number, and to decrypt the target file based on the decryption private key.

11. A terminal, wherein, The terminal includes: Processor; and A memory configured to store computer-executable instructions, which, when executed, cause the processor to perform the method according to any one of claims 1 to 5.

12. A computer-readable storage medium, wherein, The computer-readable storage medium stores one or more programs that, when executed by a processor, implement the method of any one of claims 1 to 5.

Images