# US 12,008,102 B2 · Encryption key seed determination

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,008,102 B2
- Document ID: US12008102B2
- Status: Granted
- Kind: B2
- Application number: 17/250,833
- Filed: 2019-09-11
- Published: 2022-02-03
- Granted: 2024-06-11
- Earliest claimed: 2018-09-12
- Assignees: British Telecommunications public limited company
- Applicants: British Telecommunications Public Limited Company
- Inventors: Fadi El-Moussa; George Kallos
- Web page: https://patentgrep.com/patent/US12008102B2

## CPC

- G06F 21/561: {Virus type analysis}
- G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities}
- H04L 9/08: Key distribution {or management, e.g. generation, sharing or updating, of cryptographic keys or passwords (network architectures or network communication protocols for supporting key management in a packet data network H04L63/06)}
- H04L 9/0869: {involving random numbers or seeds}
- G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine
- G06F 2221/033: Test or assess software
- G06F 2221/2107: File encryption
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A computer implemented method for determining a plurality of data sources providing seed parameters for generation of an encryption key by a ransomware algorithm, the method including exposing a target computer system to the ransomware algorithm; monitoring application programming interface (API) calls made to an operating system of the target computer system to identify a set of API calls for retrieving data about one or more hardware components of the target computer system, the data about the hardware components being determined to constitute the seed parameters.

## Claims

### Claim 1

A computer implemented method for determining a plurality of data sources providing seed parameters for generation of an encryption key by a ransomware algorithm, the method comprising:
introducing the ransomware algorithm into a target computer system; and
as the ransomware algorithm is introduced into the target computer system, monitoring application programming interface (API) calls made to an operating system of the target computer system to identify a set of API calls for retrieving data about one or more hardware components of the target computer system, the data about the one or more hardware components being determined to constitute the seed parameters.

### Claim 2 (depends on 1)

The method of claim 1, wherein each of the one or more hardware components includes one or more of: a central processing unit; a memory; a storage device; a peripheral device; a basic input/output subsystem; an output device; an input device; or a network device of the target computer system.

### Claim 3 (depends on 1)

The method of claim 1 wherein the data about the one or more hardware components includes one or more of: a reference number; an identifier; a version; a date; a time; an address; a serial number; or unique information about the hardware component.

### Claim 4 (depends on 1)

The method of claim 1 wherein the monitoring includes using a process monitor to determine operating system API calls are made.

### Claim 5

A computer system comprising:
a processor and memory storing computer program code for determining a plurality of data sources providing seed parameters for generation of an encryption key by a ransomware algorithm, by:
introducing the ransomware algorithm into a target computer system; and
as the ransomware algorithm is introduced into the target computer system, monitoring application programming interface (API) calls made to an operating system of the target computer system to identify a set of API calls for retrieving data about one or more hardware components of the target computer system, the data about the one or more hardware components being determined to constitute the seed parameters.

### Claim 6

A non-transitory computer-readable storage medium storing a computer program element comprising computer program code to, when loaded into a computer system and executed thereon, cause the computer system to determine a plurality of data sources providing seed parameters for generation of an encryption key by a ransomware algorithm, by:
introducing the ransomware algorithm into a target computer system; and
as the ransomware algorithm is introduced into the target computer system, monitoring application programming interface (API) calls made to an operating system of the target computer system to identify a set of API calls for retrieving data about one or more hardware components of the target computer system, the data about the one or more hardware components being determined to constitute the seed parameters.

### Claim 7 (depends on 1)

The method of claim 1, wherein monitoring the API calls is performed before the encryption key is generated by the ransomware algorithm.

### Claim 8 (depends on 7)

The method of claim 7, further comprising detecting commencement of the generation of the encryption key by ransomware algorithm by detecting an increase in storage activity in the target computer system.