Secure quarantine of potentially malicious content
Secure Quarantine of Potentially Malicious Content. In one embodiment, a method for secure quarantine of potentially malicious content may include receiving a computer file from a third party, preventing the computer file from initially being accessed by a user associated with the computing device, collecting metadata from the computer file, encrypting the file and the collected metadata using a first encryption key, creating an encrypted computer file, encrypting the first encryption key using an asymmetric key, embedding the encrypted computer file into a new computer file, wherein at least one file object that is in the encrypted computer file is removed from the new computer file, enabling user access to the new computer file and the embedded encrypted computer file.
1. A computer-implemented method for quarantining a malicious computer file, at least a portion of the method being performed by a computing device comprising one or more processors, the method comprising:
receiving a computer file;
preventing the computer file from initially being accessed by a user associated with the computing device;
collecting metadata from the computer file;
encrypting the computer file and the collected metadata using a first encryption key to create an encrypted quarantined computer file;
encrypting the first encryption key using an asymmetric key;
wherein the first encryption key is a symmetric encryption key;
embedding the quarantined encrypted computer file into a sanitized new computer file,
wherein at least one file object that is in the encrypted quarantined computer file is removed from the sanitized new computer file; and
enabling user access to the sanitized new computer file and the embedded quarantined encrypted computer file.
2. The method of claim 1 , encrypting the quarantined computer file and the collected metadata further comprises:
using an Advanced Encryption Standard (AES) algorithm.
3. The method of claim 1 , wherein using the symmetric encryption key further comprises: generating the symmetric encryption key in real-time.
4. The method of claim 1 , further comprising
removing an unencrypted copy of the encrypted symmetric key from memory after the first encryption key is encrypted with the preconfigured asymmetric key.
5. The method of claim 1 , wherein encrypting the first encryption key using the asymmetric key further comprises:
preconfiguring the asymmetric key by an administrator.
6. The method of claim 1 , wherein the preconfigured asymmetric key is stored in memory on the computing device.
7. The method of claim 1 , wherein encrypting the first encryption key using the asymmetric key further comprises:
encrypting the first encrypting the first encryption key using a Rivest-Sharmir-Adleman (RSA) algorithm.
8. The method of claim 1 , further comprising:
determining the computer file contains a malicious object.
9. The method of claim 1 , wherein collecting metadata further comprises:
collecting a name of the computer file, a size of the computer file, a hash of the computer file, a detection name, a detection time, a computer file creation time, or a combination thereof.
10. One or more non-transitory computer-readable media comprising one or more computer readable instructions that, when executed by one or more processors of a computing device, cause the computing device to perform a method for quarantining a malicious computer file, the method comprising: receiving a computer file;
preventing the computer file from initially being accessed by a user associated with the computing device;
collecting metadata from the computer file;
encrypting the computer file and the collected metadata using a first encryption key to create an encrypted quarantined computer file;
encrypting the first encryption key using an asymmetric key;
wherein the first encryption key is a symmetric key;
embedding the quarantined encrypted computer file into a sanitized new computer file,
wherein at least one file object that is in the quarantined encrypted computer file is removed from the sanitized new computer file; and
enabling user access to the sanitized new computer file and the embedded quarantined encrypted computer file.
11. The computer-readable media of claim 10 , the method further comprising: determining the computer file contains a malicious object.
12. The computer-readable media of claim 10 , wherein collecting metadata further comprises:
collecting a name of the computer file, a size of the computer file, a hash of the computer file, a detection name, a detection time, a computer file creation time, or a combination thereof.
13. The computer-readable media of claim 10 , wherein the symmetric encryption key is generated in real-time; and
wherein an unencrypted version of the encrypted symmetric key is erased after the symmetric key is encrypted with the asymmetric key.
14. The computer-readable media of claim 10 , wherein the asymmetric key is preconfigured by an administrator and is stored in memory on the computing device.