Protected File Disarming Using Recipient Credentials Against Malware

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing malware detection techniques are ineffective against new or disguised malicious content, especially in protected content, and current content disarm and reconstruction (CDR) methods fail to access and modify encrypted or obscured content without risking system harm.

Innovation Solution

A method for disarming malicious code in protected content by determining the recipient's credential, accessing the protected content, modifying digital values to disable malicious code, and creating a modified input file or content, which is then forwarded to the intended recipient, while maintaining protection.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If signature-based malware detection techniques are used, then known malicious content can be identified, but new or disguised malicious content cannot be detected

Engineering Contradiction:

Improvemalware detection accuracyVSAvoidcapability to detect new malicious content

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The system performs preliminary disarming actions on protected content before it can execute malicious code. By accessing the encrypted content, disarming it of malicious elements, and reconstructing it, the system prevents malware infection in advance while maintaining the ability to handle both known and unknown threats

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system extracts and removes malicious content from protected files during the disarming process. The CDR technique separates harmful code from legitimate content, allowing the system to block malware while preserving useful content for the recipient

Inventive Principle:

Principle #2Taking out (Extraction)

2Reliability

If conventional sandbox techniques are used to execute and monitor files, then suspicious behavior can be detected, but zero-day exploits and sophisticated malware can evade detection

Engineering Contradiction:

Improvebehavior-based detection capabilityVSAvoidundetectable malware attacks

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

Instead of allowing execution and then monitoring for suspicious behavior, the system performs preliminary disarming on the protected content before it can be executed. This prevents zero-day exploits and sophisticated malware from evading detection by acting before the malicious code can run or adapt to the sandbox environment

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system introduces an intermediary disarming process between receiving protected content and allowing its execution. This intermediary step processes the encrypted content to remove malicious elements before the legitimate content is accessed, preventing both known and unknown malware from executing

Inventive Principle:

Principle #24Intermediary (Mediator)

3Object-affected harmful factors

If CDR techniques are applied to protected content, then malicious content can be removed, but the content cannot be accessed without credentials

Engineering Contradiction:

Improvemalicious content in protected filesVSAvoidaccess to protected content

Core Design Contradiction:

Object-affected harmful factorsVSEase of operation

Solution Approach 1:

The system uses credentials as an intermediary mechanism to enable access to protected content for disarming purposes. The credentials authenticate the recipient's right to access the content, allowing the system to safely process the encrypted file, disarm it of malicious elements, and then provide access to the cleaned content

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The system performs preliminary authentication using credentials before attempting to access or disarm the protected content. This ensures that only authorized users can trigger the disarming process, maintaining security while enabling legitimate access to both protected and disarmed content

Inventive Principle:

Principle #10Preliminary action

4Reliability

If all received content is processed through CDR, then malware protection is improved, but processing time and computational resources increase

Engineering Contradiction:

Improvemalware protection coverageVSAvoidcontent processing speed

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The system applies CDR processing selectively rather than universally. By focusing disarming efforts on protected content that requires credential authentication, the system achieves comprehensive malware protection for high-risk files without unnecessarily processing all received content, thus maintaining productivity while ensuring security

Inventive Principle:

Principle #16Partial or excessive action

Data Source

PatentUS20260093813A1Disarming Malware in Protected Content

Publication Date: 2026.04.02 VOTIRO CYBERSEC LTD

AI summary

Systems and methods of disarming malicious code in protected content in a computer system having a processor are provided. The method includes determining that a received input file intended for a recipient is protected, the recipient may be connected to a network; accessing a credential associated with the intended recipient for accessing the protected input file; accessing the content of the protected input file based on the credential; modifying at least a portion of digital values of the content of the input file configuring to disable any malicious code included in the input file, thereby creating a modified input file; and protecting the modified input file based on the credential associated with the intended recipient. The method also includes forwarding the protected modified input file to the intended recipient in the network.