# US 12,003,630 B1 · Techniques for circumventing provider-imposed limitations in snapshot inspection of disks for cybersecurity > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,003,630 B1 - Document ID: US12003630B1 - Status: Granted - Kind: B1 - Application number: 18/359,493 - Filed: 2023-07-26 - Granted: 2024-06-04 - Earliest claimed: 2021-12-27 - Assignees: Wiz, Inc. - Applicants: Wiz, Inc. - Inventors: Shahar Rand; Eric Abramov; Yaniv Shaked; Elad Gabay - Web page: https://patentgrep.com/patent/US12003630B1 ## CPC - H04L 9/0861: {Generation of secret information including derivation or calculation of cryptographic keys or passwords} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A system and method reduces use of restricted operations in a cloud computing environment during cybersecurity threat inspection. The method includes: detecting an encrypted disk in a cloud computing environment, the encrypted disk encrypted utilizing a first key in a key management system (KMS); generating a second key in the KMS, the second key providing access for a principal of an inspection environment; generating a snapshot of the encrypted disk; generating a volume based on the snapshot, wherein the volume is re-encrypted with the second key; generating a snapshot of the re-encrypted volume; generating an inspectable disk from the snapshot of the re-encrypted volume; and initiating inspection for a cybersecurity object on the inspectable disk. ## Claims ### Claim 1 A method for reducing use of restricted operations in a cloud computing environment during cybersecurity threat inspection, comprising: detecting an encrypted disk in a cloud computing environment, the encrypted disk encrypted utilizing a first key in a key management system (KMS); generating a second key in the KMS, the second key providing access for a principal of an inspection environment; generating a snapshot of the encrypted disk; generating a volume based on the snapshot of the encrypted disk, wherein the volume is re-encrypted with the second key; generating a snapshot of the re-encrypted volume; generating an inspectable disk from the snapshot of the re-encrypted volume; and initiating inspection for a cybersecurity object on the inspectable disk. ### Claim 2 (depends on 1) The method of claim 1, further comprising: determining that the encrypted disk is encrypted based on metadata associated with the encrypted disk. ### Claim 3 (depends on 1) The method of claim 1, further comprising: associating the second key with a principal of an inspection environment. ### Claim 4 (depends on 1) The method of claim 1, further comprising: inspecting the inspectable disk for any one of: a file, a text, a regular expression (regex), a secret, a key, a certificate, a virtual workload, and any combination thereof. ### Claim 5 (depends on 1) The method of claim 1, further comprising: generating the second key utilizing any instruction of: kms:CreateGrant, kms:CreateKey, kms:PutKeyPolicy, and any combination thereof. ### Claim 6 (depends on 1) The method of claim 1, further comprising: generating volume utilizing any instruction of: kms:ReEncryptFrom, kms:ReEncryptTo, and any combination thereof. ### Claim 7 (depends on 1) The method of claim 1, further comprising: generating a decrypted inspectable disk, based on the second key. ### Claim 8 (depends on 1) The method of claim 1, wherein the generated snapshot is encrypted with the first key. ### Claim 9 A non-transitory computer-readable medium storing a set of instructions for reducing use of restricted operations in a cloud computing environment during cybersecurity threat inspection, the set of instructions comprising: one or more instructions that, when executed by one or more processors of a device, cause the device to: detect an encrypted disk in a cloud computing environment, the encrypted disk encrypted utilizing a first key in a key management system (KMS); generate a second key in the KMS, the second key providing access for a principal of an inspection environment; generate a snapshot of the encrypted disk; generate a volume based on the snapshot of the encrypted disk, wherein the volume is re-encrypted with the second key; generate a snapshot of the re-encrypted volume; generate an inspectable disk from the snapshot of the re-encrypted volume; and initiate inspection for a cybersecurity object on the inspectable disk. ### Claim 10 A system for reducing use of restricted operations in a cloud computing environment during cybersecurity threat inspection comprising: a processing circuitry; and a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to: detect an encrypted disk in a cloud computing environment, the encrypted disk encrypted utilizing a first key in a key management system (KMS); generate a second key in the KMS, the second key providing access for a principal of an inspection environment; generate a snapshot of the encrypted disk; generate a volume based on the snapshot of the encrypted disk, wherein the volume is re-encrypted with the second key; generate a snapshot of the re-encrypted volume; generate an inspectable disk from the snapshot of the re-encrypted volume; and initiate inspection for a cybersecurity object on the inspectable disk. ### Claim 11 (depends on 10) The system of claim 10, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to: determine that the encrypted disk is encrypted based on metadata associated with the encrypted disk. ### Claim 12 (depends on 10) The system of claim 10, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to: associate the second key with a principal of an inspection environment. ### Claim 13 (depends on 10) The system of claim 10, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to: inspect the inspectable disk for any one of: a file, a text, a regular expression (regex), a secret, a key, a certificate, a virtual workload, and any combination thereof. ### Claim 14 (depends on 10) The system of claim 10, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to: generate the second key utilizing any instruction of: kms:CreateGrant, kms:CreateKey, kms:PutKeyPolicy, and any combination thereof. ### Claim 15 (depends on 10) The system of claim 10, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to: generate the volume utilizing any instruction of: kms:ReEncryptFrom, kms:ReEncryptTo, and any combination thereof. ### Claim 16 (depends on 10) The system of claim 10, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to: generate a decrypted inspectable disk, based on the second key. ### Claim 17 (depends on 10) The system of claim 10, wherein the generated snapshot is encrypted with the first key.