Trend Micro Inc.

Weichao Dai

Xiaodong Huang

Hua Ye

Zhentao Huang

Chao Fang

Chuan Jiang

Zhifeng Du

Yuncao Tian

Sen Jiang

Interprocess communication between processes that run on a host operating system of a computer is performed by way of a protected temporary file. File access operation on the temporary file is hooked to detect writing to the temporary file. When a process writes a message to the temporary file, a verification is performed to determine whether or not the process is authorized to access the temporary file. When the process is authorized to access the temporary file, the process is allowed to write the message to the temporary file. This allows another process that is intended to receive the message to read the message from the temporary file and act on the message. Otherwise, when the process is not authorized to access the temporary file, the process is blocked from writing the message to the temporary file.

Protection of interprocess communications in a computer

Operating system events are monitored and a file change request of a process is detected. If the process is suspicious, then the file to be changed is backed up and then the process is allowed to change the file as requested. If it is later determined that the process is ransomware, the process is blocked and further file backups are halted. The original file is recovered and the encrypted file is discarded. If it is later determined that the process is not malicious, then further file backups are halted. Any backup files are discarded. Ransomware may be detected by comparing a file extension of the process with file extensions of any files requested to be changed, by comparing file extensions of any files requested to be changed, or by an analysis of behavior of the process itself.

File backup to combat ransomware

A method for encrypting a file using a combination of an electronic device and a protection communication-enabled (PCE) wireless device is provided. The method includes using an encryption/decryption engine executing on the electronic device to encrypt a first flag string, which is a binary string stored in a header of the file, with a digest value to create an encrypted flag string. The digest value is associated with the PCE wireless device, which is a device having a transmission application program installed thereon for enabling interaction between the PCE wireless device and the encryption/decryption engine. The method also includes encrypting at least a portion of the file using the digest value and a first password provided by a user, thereby generating an encrypted file that includes an encrypted version of at least a portion of the file, the encrypted flag string, and the first flag string.

Dynamic encryption arrangement with a wireless device and methods therefor

Growing community of inventors

Nanjing, China

Weichao Dai