Password-Protected Data Inspection via Brute Force and User Request
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anti-virus and data loss prevention software are unable to detect malware and data exfiltration when the malware or exfiltrated data is protected using password-protected archive files, as they cannot inspect the encrypted and compressed contents.
Innovation Solution
A system and method that detects password-protected data items, applies a set of rules and policies to attempt access, and requests the assigned password from the user if brute force attempts fail, allowing analysis for potential threats and restricted information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If password-protected archive files are used to protect data, then data security is improved, but the ability to detect malware and data breaches is worsened
Solution Approach 1:
The system performs preliminary actions by attempting to crack passwords using brute force methods and dictionary attacks before the user accesses the file. This allows the security system to inspect the decrypted contents for malware and restricted information in advance, resolving the contradiction by maintaining password protection while enabling prior security detection
Solution Approach 2:
The invention introduces an intermediary security system that sits between the password-protected file and the user's access. This intermediary layer attempts to decrypt and analyze the file contents without the user knowing, acting as a mediator that preserves the encrypted state for security while enabling inspection capabilities
2Difficulty of detecting and measuring
If brute force password attempts are made, then the ability to access and analyze password-protected data is improved, but the time required for analysis is worsened
Solution Approach 1:
The system applies partial brute force action by attempting a limited number of password guesses using dictionary attacks and common password patterns before giving up and requesting the password from the user. This partial action is sufficient to crack weak passwords while avoiding excessive time consumption on strong passwords, resolving the time contradiction
Solution Approach 2:
The system performs preliminary password cracking attempts using pre-computed dictionary attacks and common password patterns before user interaction is required. This preliminary action quickly resolves cases with weak passwords while preparing the system to request passwords only when necessary, reducing overall analysis time
3Difficulty of detecting and measuring
If the system requests passwords from users, then the ability to detect threats in password-protected files is improved, but the complexity of the system is worsened
Solution Approach 1:
The system primarily serves itself by automatically attempting to crack passwords and analyze file contents without user intervention. Only when automatic cracking fails does the system request the password from the user, making the user service a fallback option rather than the primary mechanism. This self-service approach maintains threat detection capability while minimizing the complexity of user interaction
Data Source
AI summary
Computerized methods and systems receive password-protected data from a network at an entity coupled to the network. The password-protected data is intended for receipt by a user of an endpoint coupled to the network, and a password is assigned to the password-protected data which allows access to the password-protected data. The entity attempts to access the password-protected data by applying a set of rules and policies to the password-protected data. The entity requests the assigned password from a user of the endpoint, based on the outcome of the rules and policies, to determine whether the password-protected data includes potentially malicious components.