Electronic Device Encryption Key Recovery via Non-Volatile Memory
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Ransomware and other malicious programs encrypt user files without permission, making it difficult to restore data to its original state, leading to significant user inconvenience and financial loss.
Innovation Solution
An electronic device and method to identify and store encryption keys used by malicious programs, allowing for decryption of user files by obtaining and storing encryption keys and metadata in non-volatile memory, using techniques such as trap handlers and hardware acceleration instructions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If ransomware encrypts user files without permission, then data security is improved (protection against unauthorized access), but data accessibility deteriorates (cannot restore original data)
Solution Approach 1:
The system performs preliminary actions by capturing encryption keys and metadata at the time of encryption operation, storing them in non-volatile memory before the ransomware can prevent access. This advance preparation enables later decryption without requiring interaction with the malicious program during the encryption phase.
Solution Approach 2:
The patent introduces an intermediary mechanism (the processing system with non-volatile memory) that independently captures and stores encryption information without being controlled by the ransomware. This intermediary allows the system to maintain data accessibility through stored keys while respecting the security measures implemented by the malicious program.
2Ease of operation
If encryption keys are stored in volatile memory, then data accessibility is improved (quick access during operation), but reliability deteriorates (data lost when power is disconnected)
Solution Approach 1:
The system segments the memory storage into two parts: volatile memory for temporary processing during operation and non-volatile memory for persistent storage. Encryption keys and metadata are written to non-volatile memory to ensure persistence across power cycles, while the system maintains efficient access mechanisms through the volatile memory buffer during active operations.
3Measurement precision
If the system monitors all encryption operations, then identification accuracy is improved (can identify malicious encryption), but device complexity increases (requires extensive monitoring infrastructure)
Solution Approach 1:
Instead of monitoring all encryption operations uniformly, the system applies local quality by specifically monitoring for characteristics of malicious encryption operations. The processing system identifies and captures encryption keys and metadata only when specific criteria are met, reducing the monitoring scope to high-probability malicious operations while maintaining high identification accuracy.
Data Source
AI summary
A method of controlling an electronic device is provided. The method includes: identifying a first instruction for an encryption operation on a file using an encryption key; based on the first instruction being identified, obtaining the encryption key and metadata for the encryption operation and storing the obtained encryption key and the metadata in a non-volatile memory; and based on a user command for an access operation to the file being obtained, identifying the encryption key used for the encryption operation based on the metadata.