System and method for providing data and device security between external and host devices

• US 10,419,459 B2
• Filed: 06/28/2017
• Issued: 09/17/2019
• Est. Priority Date: 03/05/2007
• Status: Active Grant

• Current Assignee: CUPP Computing AS
• Original Assignee: CUPP Computing AS
• Inventors: Touboul, Shlomo
• Primary Examiner(s): King, John B
• Application Number:
  US15/636,536
• Publication Number:
  US 20170293760A1
• Time in Patent Office: 811 Days
• CPC Class Codes: G06F 13/385 for adaptation of a particular data processing system to different peripheral devices
• CPC Class Codes: G06F 13/4282 on a serial bus, e.g. I2C bus, SPI bus on daisy chain buses G06F13/4247
• CPC Class Codes: G06F 21/562 Static detection
• CPC Class Codes: G06F 21/71 to assure secure computing or processing of information
• CPC Class Codes: G06F 21/85 interconnection devices, e.g. bus-connected or in-line devices
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

A secure data exchange system comprising a security device including a first external device plug, and a security engine operative to enforce a security policy on data transfer requests received from the host; an external device including a second external device plug; and a host including a first external device port operative to communicatively couple with the first external device plug, a second external device port operative to communicatively couple with the second external device plug, and a driver, e.g., a redirect driver, operative to transfer a data transfer request to the security device before executing the data transfer request.

Claims

1. A security device, comprising:

a host plug configured to physically interface with a device port of a host, to receive power from the host, and to support data transfer with the host;

an external device port configured to communicatively couple with an external device and to support data transfer with the external device, the external device including a storage device configured to store data;

at least one hardware processor; and

memory storing;

an operating system executable by the at least one hardware processor,

one or more device drivers executable by the at least one hardware processor and configured to receive a data transfer request for transferring data between the host and the external device, and to control data transfer between the host and the external device upon receiving a data transfer instruction, and

a security system configured to receive the data transfer request, the security system including a security engine and a security policy, the security engine configured to evaluate the data transfer request based on the security policy to determine whether the data transfer request satisfies the security policy, the security policy including a data privacy policy, and to authorize the data transfer instruction when the security policy is satisfied.

2. The security device of claim 1, wherein the security device is operative with a driver on the host.

3. The security device of claim 1, wherein at least one of the host plug and the external device port follows a USB standard.

4. The security device of claim 1, wherein the security engine protects against transfer of at least one of viruses, spyware and adware, and unauthorized transfer of private data.

5. The security device of claim 1, wherein the external device port includes a wireless connection.

6. The security device of claim 1, wherein the data transfer request includes a request to transfer data from the host to the external device.

7. The security device of claim 1, wherein the data transfer request includes a request to transfer data from the external device to the host.

8. A method comprising:

executing an operating system by at least one hardware processor on a security system;

executing one or more device drivers on the security system by the at least one hardware processor;

establishing a first data communication channel between a host plug of a security device and a device port of a host;

receiving power from the host through the host plug;

establishing a second data communication channel between an external device and the security device;

receiving by the security device automatically before execution a data transfer request from the host, the data transfer request requesting transfer of data between the host and the external device, the external device including a storage device configured to store data;

evaluating, using a security engine and a security policy on the security device, the data transfer request based on the security policy to determine whether the data transfer request satisfies the security policy, the security policy including a data privacy policy;

authorizing a data transfer instruction by the security engine when the security policy is satisfied; and

controlling data transfer by the one or more device drivers upon receiving the data transfer instruction, the data transfer for causing execution of the data transfer request between the host and the external device.

9. The method of claim 8, wherein the second data communication channel operates over a wire of the external device to the security device.

10. The method of claim 8, wherein the data transfer request includes a request to transfer data from the host to the external device.

11. The method of claim 8, wherein the evaluating the data transfer request includes reviewing the data being transferred for at least one of viruses, spyware and adware, or determining whether the data transfer request includes a request for private data, or requiring an additional security check before allowing transfer of private data.

12. The method of claim 8, wherein the second communication channel operates over a wireless connection.

13. The method of claim 8, wherein the data transfer request includes a request to transfer data from the external device to the host.