Proactive ransomware defense

Patent metadata

Field	Value
Publication number	US-10956569-B2
Application number	US-201816124140-A
Country	US
Kind code	B2
Filing date	Sep 6, 2018
Priority date	Sep 6, 2018
Publication date	Mar 23, 2021
Grant date	Mar 23, 2021

Abstract

A method for defending a computing system against ransomware attacks is disclosed. In one embodiment, such a method includes identifying, on a computing system, files to be protected against ransomware attacks. The method appends a public key to each of the files. Upon receiving a request to modify a specific file, the method reads the public key appended to the file, requests an authentication token from a user, and computes a private key associated with the files. The method combines the public key, authentication token, and private key to generate an unlock key. This unlock key is compared to a validation key. The method authorizes modification of the file in the event the unlock key matches the validation key. A corresponding system and computer program product are also disclosed.

First claim

The invention claimed is:

1. A method for defending a computing system against ransomware attacks, the method comprising:
identifying, on a computing system, a plurality of files to be protected against ransomware attacks;
appending a public key to each of the plurality of files;
upon receiving a request to modify a specific file of the plurality of files, reading the public key appended to the specific file, requesting an authentication token from a user, and computing a private key associated with the plurality of files;
combining the public key, authentication token, and private key to generate an unlock key;
comparing the unlock key to a validation key; and
authorizing modification of the specific file in the event the unlock key matches the validation key.

2. The method of claim 1 , wherein the validation key is stored in a protected memory space.

3. The method of claim 1 , wherein the validation key is decrypted prior to being compared to the unlock key.

4. The method of claim 1 , wherein computing the private key comprises retrieving the private key from an encrypted vault.

5. The method of claim 1 , wherein authorizing modification comprises authorizing deletion of the specific file.

6. The method of claim 1 , wherein authorizing modification comprises authorizing encryption of the specific file.

7. The method of claim 1 , further comprising disallowing modification of the specific file in the event the unlock key does not match the validation key.

8. A computer program product for defending a computing system against ransomware attacks, the computer program product comprising a computer-readable storage medium having computer-usable program code embodied therein, the computer-usable program code configured to perform the following when executed by at least one processor:
identify, on a computing system, a plurality of files to be protected against ransomware attacks;
append a public key to each of the plurality of files;
upon receiving a request to modify a specific file of the plurality of files, read the public key appended to the specific file, request an authentication token from a user, and compute a private key associated with the plurality of files;
combine the public key, authentication token, and private key to generate an unlock key;
compare the unlock key to a validation key; and
authorize modification of the specific file in the event the unlock key matches the validation key.

9. The computer program product of claim 8 , wherein the validation key is stored in a protected memory space.

10. The computer program product of claim 8 , wherein the validation key is decrypted prior to being compared to the unlock key.

11. The computer program product of claim 8 , wherein computing the private key comprises retrieving the private key from an encrypted vault.

12. The computer program product of claim 8 , wherein authorizing modification comprises authorizing deletion of the specific file.

13. The computer program product of claim 8 , wherein authorizing modification comprises authorizing encryption of the specific file.

14. The computer program product of claim 8 , wherein the computer-usable program code is further configured to disallow modification of the specific file in the event the unlock key does not match the validation key.

15. A system for defending against ransomware attacks, the system comprising:
at least one processor;
at least one memory device operably coupled to the at least one processor and storing instructions for execution on the at least one processor, the instructions causing the at least one processor to:
identify, on a computing system, a plurality of files to be protected against ransomware attacks;
append a public key to each of the plurality of files;
upon receiving a request to modify a specific file of the plurality of files, read the public key appended to the specific file, request an authentication token from a user, and compute a private key associated with the plurality of files;
combine the public key, authentication token, and private key to generate an unlock key;
compare the unlock key to a validation key; and
authorize modification of the specific file in the event the unlock key matches the validation key.

16. The system of claim 15 , wherein the validation key is stored in a protected memory space.

17. The system of claim 15 , wherein the validation key is decrypted prior to being compared to the unlock key.

18. The system of claim 15 , wherein computing the private key comprises retrieving the private key from an encrypted vault.

19. The system of claim 15 , wherein authorizing modification comprises authorizing deletion of the specific file.

20. The system of claim 15 , wherein authorizing modification comprises authorizing encryption of the specific file.

Assignees

• IBM
• Int Business Machiness Corporation

Inventors

• Mcgregor Harry R
• Moore Christopher B
• Margalit Oded
• Goldberg Itzhack

Classifications

• G06F21/56 Primary

  Computer malware detection or handling, e.g. anti-virus arrangements · CPC title

• G06F21/6218

  to a system of files or objects, e.g. local or distributed file system or database · CPC title

• G06F2221/034

  Test or assess a computer or a system · CPC title

• G06F21/6209

  to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself · CPC title

• H04L9/14

  using a plurality of keys or algorithms · CPC title