Systems and methods for providing real time security and access monitoring of a removable media device

• US 10,417,400 B2
• Filed: 07/21/2014
• Issued: 09/17/2019
• Est. Priority Date: 11/19/2008
• Status: Active Grant

• Current Assignee: CUPP Computing AS
• Original Assignee: CUPP Computing AS
• Inventors: Touboul, Shlomo, Ferdman, Sela, Yusim, Yonathan
• Primary Examiner(s): Wright, Bryan F
• Application Number:
  US14/337,101
• Publication Number:
  US 20150047021A1
• Time in Patent Office: 1,884 Days
• Field of Search: 726 19
• CPC Class Codes: G06F 11/1446 Point-in-time backing up or restoration of persistent data
• CPC Class Codes: G06F 11/1456 Hardware arrangements for backup
• CPC Class Codes: G06F 11/3034 where the computing system component is a storage system, e.g. DASD based or network based digital input from or digital output to record carriers G06F3/06; digital recording or reproducing G11B20/18; for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS], H04L67/1097
• CPC Class Codes: G06F 11/3438 monitoring of user actions tracking the activity of the user H04L67/535
• CPC Class Codes: G06F 11/3476 Data logging G06F11/14, G06F11/2205 take precedence
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/85 interconnection devices, e.g. bus-connected or in-line devices
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

In various embodiments, a method comprises detecting a removable media device coupled to a digital device, authenticating a password to access the removable media device, injecting redirection code into the digital device, intercepting, with the redirection code, a request for data, determining to allow the request for data based on a security policy, and providing the data based on the determination. The method may further comprise selecting the security policy from a plurality of security policies based, at least in part, on the password and/or filtering the content of the requested data. Filtering the content may comprise scanning the data for malware. Filtering the content may also comprise scanning the data for confidential information.

Claims

1. A method comprising:

detecting a removable media device being coupled to an external device port of a digital device, the digital device having an operating system and a file system, the removable media device having a login module;

causing, after detecting the removable media device being coupled to the external device port of the digital device, at least a portion of redirection code to be generated on the digital device by the login module of the removable media device, the redirection code including an interceptor, a data security policy, and a data security process;

intercepting, using the interceptor, a first function call to the operating system or the file system of the digital device before the first function call is executed by the operating system or the file system, the first function call including a request of the operating system or the file system to retrieve data from or write data to the removable media device, the first function call being initiated by a particular user or a particular application; and

performing a set of one or more second function calls in response to intercepting the first function call, the set of one or more second function calls not including the first function call, the set of one or more second function calls including a data-security-based second function call, the data-security-based second function call causing the steps of;

executing the data security process, the data security process determining whether the particular user or the particular application is authorized to retrieve the data from or write the data to the removable media device, and thus whether to allow the first function call based at least on results of the data security process; and

allowing the operating system or the file system to execute the first function call in response to a determination to allow the first function call.

2. The method of claim 1, further comprising selecting the data security policy from a plurality of data security policies based, at least in part, on a password, wherein different passwords are associated with different access rights defined by different data security policies.

3. The method of claim 1, wherein the data security process filters content of the data.

4. The method of claim 3, wherein the data security process filters the content by scanning the data for confidential information.

5. The method of claim 1, wherein causing the at least a portion of the redirection code to be generated comprises injecting the at least a portion of the redirection code into the digital device by temporarily replacing one or more dynamic-link libraries (dlls) within the digital device.

6. The method of claim 1, wherein causing the at least a portion of the redirection code to be generated comprises injecting the at least a portion of the redirection code into the digital device by enumerating user processes of the digital device and injecting dlls into the enumerated user processes.

7. The method of claim 1, further comprising receiving a shut down command and removing the at least a portion of the redirection code in response to the shut down command.

8. The method of claim 1, further comprising removing the at least a portion of the redirection code in response to a detection that the removable media device is no longer coupled to the digital device.

18. The method of claim 1, wherein the data security process includes an authentication process.

19. The method of claim 1, wherein the data security process includes a malware detection process.

9. A system comprising:

an operating system of a digital device configured to detect a removable media device being coupled to an external device port of the digital device;

one or more processors;

memory coupled to the one or more processors, the memory storing instructions to instruct the one or more processors to implement;

a login module configured to cause, after detecting the removable media device being coupled to the external device port of the digital device, at least a portion of redirection code to be generated on the digital device, the redirection code including an interceptor, a data security policy, and a data security process, the interceptor configured to intercept a first function call to the operating system of the digital device before the first function call is executed by the operating system, the first function call including a request of the operating system to retrieve data from or write data to the removable media device, the first function call being initiated by a particular user or a particular application, the data security process configured to perform a set of one or more second function calls in response to intercepting the first function call, the set of one or more second function calls not including the first function call, the data security policy configured to evaluate data on the removable security device for malware, and the data security policy configured to determine whether to allow the first function call based at least on results of the data security process.

10. The system of claim 9, wherein the login module is further configured to select the data security policy from a plurality of data security policies based, at least in part, on a password, wherein different passwords are associated with different access rights defined by different data security policies.

11. The system of claim 9, wherein the login module is further configured to filter content of the data.

12. The system of claim 11, wherein filtering the content comprises scanning the data for confidential information.

13. The system of claim 9, wherein the login module configured to cause the at least a portion of the redirection code to be generated comprises the login module configured to inject the at least a portion of the redirection code into the digital device by temporarily replacing one or more dynamic-link libraries (dlls) within the digital device.

14. The system of claim 9, wherein the login module configured to cause the at least a portion of the redirection code to be generated comprises the login module configured to inject the at least a portion of the redirection code into the digital device by enumerating user processes of the digital device and injecting dlls into the enumerated user processes.

15. The system of claim 9, wherein the digital device is configured to receive a shut down command and remove the at least a portion of the redirection code in response to the shut down command.

16. The system of claim 9, wherein the digital device is configured to remove the at least a portion of the redirection code in response to a detection that the removable media device is no longer coupled to the digital device.

20. The system of claim 9, wherein the data security process includes an authentication process.

21. The system of claim 9, wherein the data security process includes a malware detection process.

17. A non-transitory computer readable media comprising instructions, the instructions executable by a processor to perform a method, the method comprising:

detecting a removable media device being coupled to an external device port of a digital device, the digital device having an operating system and a file system, the removable media device having a login module;

causing, after detecting the removable media device being coupled to the external device port of the digital device, at least a portion of redirection code to be generated on the digital device by the login module of the removable media device, the redirection code including an interceptor, a data security policy, and a data security process;

intercepting, using the interceptor, a first function call to the operating system or the file system of the digital device before the first function call is executed by the operating system or the file system, the first function call including a request of the operating system or the file system to retrieve data from or write data to the removable media device, the first function call being initiated by a particular user or a particular application; and

performing a set of one or more second function calls in response to intercepting the first function call, the set of one or more second function calls not including the first function call, the set of one or more second function calls including a data-security-based second function call, the data-security-based second function call causing the steps of;

executing the data security process, the data security process determining whether the particular user or the particular application is authorized to retrieve the data from or write the data to the removable media device, and thus whether to allow the first function call based at least on results of the data security process; and

allowing the operating system or the file system to execute the first function call in response to a determination to allow the first function call.