US 12,219,048 B1
Techniques for encrypted disk cybersecurity inspection utilizing disk cloning
Daniel Hershko Shemesh, Givat-Shmuel (IL); Yarin Miran, Rishon Lezion (IL); Roy Reznik, Tel Aviv (IL); Ami Luttwak, Binyamina (IL); Yinon Costica, Tel Aviv (IL); Yaniv Shaked, Tel Aviv (IL); and Eyal Moscovici, Tel Aviv (IL)
Assigned to Wiz, Inc., New York, NY (US)
Filed by Wiz, Inc., New York, NY (US)
Filed on Oct. 4, 2023, as Appl. No. 18/481,091.
Application 18/481,091 is a continuation in part of application No. 18/146,074, filed on Dec. 23, 2022.
Application 18/481,091 is a continuation in part of application No. 18/146,076, filed on Dec. 23, 2022.
Application 18/481,091 is a continuation in part of application No. 17/664,508, filed on May 23, 2022.
Claims priority of provisional application 63/266,031, filed on Dec. 27, 2021.
This patent is subject to a terminal disclaimer.
Int. Cl. H04L 9/08 (2006.01); H04L 9/40 (2022.01)
CPC H04L 9/0822 (2013.01) [H04L 9/0861 (2013.01); H04L 9/0891 (2013.01); H04L 63/1416 (2013.01)] 19 Claims
OG exemplary drawing
 
1. A method for inspecting encrypted disks using a default key for detecting a cybersecurity object, comprising:
detecting a first encrypted disk on a workload in a cloud computing environment, the first encrypted disk having an address in a cloud storage system;
generating a key for an inspector account that is distinct from any information of any account of any of one or more users that have access to the first encrypted disk;
generating a second encrypted disk with a reencrypt command utilizing the generated key for the inspector account such that the second encrypted disk is a clone of the first encrypted disk, the second encrypted disk including a cloned disk descriptor having a data field including an address of the first encrypted disk, and wherein the second encrypted disk becomes available for inspection substantially immediately upon creation and is not accessible at any time by any of the one or more users that have access to the first encrypted disk;
inspecting the second encrypted disk for a cybersecurity threat, wherein the first encrypted disk remains accessible to the one or more users that have access to the first encrypted disk while the inspecting is performed; and
releasing a resource allocated to the second encrypted disk in response to completing the inspection.