Ransomware Decryption via Random Data Interception
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for protecting computer systems against ransomware and malware are resource-intensive, requiring significant disk space and processing power, leading to decreased productivity and inefficiency.
Innovation Solution
A system and method that intercepts requests for random data to determine encryption keys used by ransomware, allowing for crypto-attacks to decrypt maliciously encrypted files, using periodic backup of initial file blocks and monitoring of system information to perform crypto-analysis and key recovery.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If periodic data archiving and backup of entire hard drive is used to protect against ransomware, then data security is improved, but resource consumption (disk space, processor power, RAM) increases significantly
Solution Approach 1:
The patent extracts only the essential elements needed for decryption (initial file blocks and random data used as seeds) from the complete file backup process. Instead of backing up entire files or hard drives, the system selectively captures specific data portions that are sufficient for cryptographic recovery, dramatically reducing resource consumption while maintaining decryption capability.
Solution Approach 2:
The protection approach is segmented into discrete, minimal components: (1) backup of only the first block of each file, and (2) interception of random data requests. This segmentation allows the system to achieve security through selective data preservation rather than comprehensive backup, reducing the burden on disk space and processing resources.
2Reliability
If comprehensive data backup is performed to protect against ransomware, then data recovery capability is improved, but productivity decreases due to time and resource overhead
Solution Approach 1:
The system extracts only the cryptographic essentials (initial blocks and random seeds) from complete file backup operations. This extraction approach maintains full data recovery capability through cryptographic means while eliminating the time-consuming overhead of copying and storing entire files, thereby preserving system productivity.
Solution Approach 2:
The system performs preliminary interception of random data requests before ransomware encryption occurs. By capturing the seeds used for key generation in advance, the system prepares decryption capabilities proactively without requiring resource-intensive backup operations during normal system operation, thus maintaining productivity.
3Reliability
If full hard drive backup is used to protect against ransomware, then protection coverage is improved, but disk space requirements increase significantly
Solution Approach 1:
The patent extracts only the minimal necessary data for decryption: the first block of each file and the random data used as cryptographic seeds. This extraction replaces comprehensive hard drive backup, providing equivalent protection coverage while occupying negligible disk space compared to full backup solutions.
Solution Approach 2:
Instead of copying entire files or hard drives, the system creates minimal copies of only the essential cryptographic components (initial blocks and random seeds). These small copies are sufficient for decryption purposes and consume minimal storage resources while maintaining comprehensive protection coverage.
Data Source
AI summary
A technique is described for protecting file data from malicious programs, in particularly, by decrypting data that has been maliciously encrypted by software such as ransomware. The described technique generates a copy of a first block of a plurality of files stored on a computing device, and also intercepts request(s) from a process executing on the computing device to obtain certain types of random data and system entropy, which are recorded. When the system detects that the plurality of files have been encrypted by a malicious program, the described system determines a cryptographic key determined based on the generated copies of the first blocks of the plurality of files and on the recorded random data, and uses that key to decrypt the plurality of files.