File-Type Whitelisting for Ransomware Defense
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Ransomware attacks pose a significant threat to computer systems as existing application whitelisting methods are limited in effectiveness, as ransomware can infiltrate by masquerading as legitimate applications, allowing infected applications to execute and expose the system to threats.
Innovation Solution
Implementing file-type based whitelisting, where a list of approved applications is specified based on file types, with a ransomware blocker intercepting file-access requests and verifying permissions using a whitelist, which is protected from tampering and located in a secure area, and employing cryptographic methods to ensure only authorized processes access protected files, with user confirmation and crowd-sourced recommendations for unknown processes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If application whitelisting is implemented to prevent ransomware, then system security is improved, but ransomware can still infiltrate by masquerading as legitimate applications
Solution Approach 1:
The patent segments the whitelisting mechanism from application-level to file-type-level. Instead of whitelisting entire applications, the system creates separate whitelist entries for specific file types (e.g., .doc, .xls, .pdf). This segmentation allows the system to permit only legitimate file types while blocking ransomware-encrypted files, even when they masquerade as legitimate applications.
Solution Approach 2:
The patent applies local quality by making the whitelist protection scope specific to particular file types rather than applying a uniform application-wide whitelist. Each file type can have its own access permissions and encryption detection rules, allowing granular control over what is permitted and what is blocked at the file-type level.
2Reliability
If file-type based whitelisting is implemented to enhance ransomware defense, then security against ransomware is improved, but system complexity increases due to cryptographic methods and secure whitelist management
Solution Approach 1:
The patent introduces an intermediary component - the ransomware blocker - that sits between the application and the file system. This blocker intercepts file-access requests, checks them against the whitelist, and applies cryptographic verification. By concentrating the complex cryptographic and verification logic in this intermediary layer, the rest of the system remains relatively simple while still achieving robust ransomware defense.
Solution Approach 2:
The patent implements preliminary action by establishing the whitelist and cryptographic verification mechanisms before ransomware attacks occur. The system proactively defines which file types are permitted and sets up encryption detection rules in advance, so that when file-access requests occur, the verification process is already in place and does not add significant overhead during normal operations.
3Reliability
If cryptographic methods are used to verify authorized processes, then access control reliability is improved, but processing time increases due to verification overhead
Solution Approach 1:
The patent applies partial action by performing cryptographic verification selectively rather than for every file-access request. The ransomware blocker checks the whitelist entry for the requested file type and applies cryptographic verification only when necessary - such as when there is uncertainty about the legitimacy of the process or when the file type requires enhanced protection. This selective approach maintains high security while minimizing verification overhead.
Data Source
AI summary
In one embodiment, a method for protecting a file is implemented on a computing device and includes: intercepting a file-access request from an application-process for the file; searching a whitelist for a whitelist entry associated with the application-process and a file-type for the file, where the whitelist entry indicates that the application-process is allowed to access files of the file-type, and upon determining according to the searching that the application-process is allowed to perform the file-access request, allowing the application-process to access the file according to the file-access request.