Device detection system for monitoring use of removable media in networked computers

• US 8,478,860 B2
• Filed: 03/14/2007
• Issued: 07/02/2013
• Est. Priority Date: 03/14/2006
• Status: Active Grant

• Current Assignee: RPX Corporation
• Original Assignee: STRONG BEAR, LLC
• Inventors: Gardner, Ronald B., Roberts, Rodeny B.
• Primary Examiner(s): Nawaz, Asad
• Assistant Examiner(s): HARLEY, JASON A
• Application Number:
  US11/686,055
• Publication Number:
  US 20070233842A1
• Time in Patent Office: 2,302 Days
• Field of Search: 709/223, 709/224
• US Class Current: 709/224
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: H04L 43/08 Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 67/125 involving control of end-device applications over a network

Abstract

A device detection system for detecting use of removable media such as flash drives, portable storage, disks, and digital cameras in computers. From each monitored client, messages are sent by a client device detection application to a server application running on a central or administrator computer or node. The messages include relevant information for the client computer such as IP address, computer name, and user name along with the device. Generally, a message will be sent when the device is first detected such as when it is attached to the client computer or connected to a port and when the device is later changed such as when the device is removed, and detection is achieved by a function intercepting event messages in the operating system environment combined with a drive detector. The messages are stored in system memory so as to log the attachment or use of removable media.

Claims

1. A system for monitoring use of removable devices in client computers that are linked to a network, comprising:

a device detection, server application running on a first computer linked to a communications network;

a second computer linked to the communications network, the second computer being configured for attachment and removal of removable media; and

a device detection client application running on the second computer to detect presence of the removable media on the second computer and in response to the detection of the presence to transmit a message to the device detection server application, wherein the device detection client application detects the removable media using both a message interceptor intercepting messages in the second computer and a drive detector detecting existing drives in the second computer,

wherein the intercepted messages are processed by the device detection client application, on an outgoing basis during operation of the second computer to detect the media based on events indicating a media change including addition or removal of the removable media from the second computer, wherein the drive detector operates periodically to detect the existing drives in the second computer without processing the intercepted messages, whereby the drive detector is configured to detect ones of the removable media undetectable by the message interceptor;

wherein the intercepted messages are generated by one or more messaging mechanisms in an operating system environment of the second computer and wherein the message interceptor comprises a sub-classed function of a program running in the operating system environment.

2. The system of claim 1, wherein the media change events are defined by a set of changes to be monitored by the device detection client application and wherein the set of changes is generated by the device detection server application and wherein the set of changes include removal of one of the removable media devices from the second computer.

3. The system of claim 1, wherein the message is transmitted automatically upon detection of one of the media changes based on one of the intercepted messages.

4. The system of claim 1, wherein the transmitted message includes a list of devices including the media detected using the message interceptor and the existing drives detected by the drive detector.

5. The system of claim 1, wherein the drive detector monitors drives defined by a list of drive types for monitoring to detect the existing drives in the second computer and wherein the list of drive types is generated by the device detection server application and transmitted to the device detection client application.

6. The system of claim 1, wherein the device detection client application provides to the device detection server application a user name identifying a user of the second computer based on login information at the second computer and a computer identifier identifying the second computer and wherein the device detection server application processes the message from the device detection client application based on the user name to determine whether the detected presence of the removable media on the second computer is an authorized use of the second computer and, if determined not authorized, to generate an alert.

7. The system of claim 1, wherein the device detection server application generates a graphical user interface on the first computer including the transmitted message received from the device detection client application and generates an alert after the transmitted message is received at the second computer, wherein the alert indicates violation of a removable media policy through the use of the detected removable media with the second computer.

17. The system of claim 1, wherein the removable media is one of a USB flash drive, a memory key, a ZIP disk, a floppy disk, a CD/DVD, a digital camera, or a plug-in-play device.

8. A method for monitoring use of removable data storage media comprising a physical device adapted to be attached and removed from an externally-accessible drive or port of a computer, comprising:

opening communications over a network between a client application on a first computer and a server application on second computer;

with the client application, transmitting a name of the first computer and login information for a user of the first computer to the server application;

determining a set of drives on the first computer with the client application;

generating a device list for the first computer that includes the determined set of drives;

transmitting the device list to the sewer application;

monitoring for changes in the removable data storage media in the first computer by intercepting with the client application messages generated by programs running on the first computer;

when one of the messages relates to one of the changes in the removable data storage media, updating the device list for the first computer based on the messages relating to the changes;

transmitting a message defining a change in the removable data storage media for the first computer based on the one of the messages to the server application; and

with the server application, determining if the change in the removable data storage media is a permitted use of the first computer, wherein the permitted use includes removal or removal of removable media from the first computer;

wherein the server application detects the removable media using both a message interceptor intercepting messages in the second computer and a drive detector detecting existing drives in the second computer;

wherein the intercepted messages are generated by one or more messaging mechanisms in an operating system environment of the second computer and wherein the message interceptor comprises a sub-classed function of a program running in the operating system environment.

9. The method of claim 8, wherein the determining if the change in media is a permitted use is performed based on the login information for the user, whereby differing users of the first computer may have differing permitted uses of removable media.

10. The method of claim 8, further comprising operating the server application to receive the message defining the change in media and in response, generating an alert indicating the change in media on the first computer.

11. The method of claim 8, further comprising determining that a monitoring frequency period has expired since performing the determining of the set of drives and in response, repeating the determining of the set of drives and updating the device list to show any existing drives found on the first computer not shown on the device list.

12. The method of claim 11, further wherein the determining of the set of drives is performed to determine if any drives of a type found in a drive type list are existing on the first computer and wherein the drive type list is transmitted from the server application to the client application.

22. The method of claim 8, wherein the removable data storage media comprises a USB drive.

13. A device detection system, comprising:

periodically determining a subset of existing drives on a computer, wherein the subset of existing drives comprises drives on the computer configured for use with removable media;

detecting a status change for removable media in the computer;

updating a list of devices for the computer to include a most recent one of the subset of the existing drives and each of the detected status changes;

transferring the list of devices to an administrator computer linked to the computer by a network; and

transferring a message to the administrator computer in response to each of the detected status changes,

wherein the computer comprises a message pump generating messages in response to OS-detected events associated with the status changes in the removable media and wherein the detecting means comprises intercepting the generated messages from the message pump;

wherein the intercepted messages are generated by one or more messaging mechanisms in an operating system environment of the computer and wherein the message interceptor comprises a sub-classed function of a program running in the operating system environment.

14. The system of claim 13, further comprising means on the administrator computer for generating a graphical user interface and means for displaying the message transferred to the administrator computer in the graphical user interface and displaying the transferred list of devices.

15. The system of claim 13, further comprising means on the administrator computer for generating an alert in response to the message transferred to the administrator computer when a media corresponding the message transferred to the administrator is determined to not be on a list of permitted devices for use on the first computer or for use by a user of the first computer.

16. The system of claim 13, further comprising means for transmitting to the administrator computer identification information for the first computer and user information for the first computer.

18. A method for monitoring authorized use of media in a computer, comprising:

opening communications over a network between a client application on a first computer and a server application on a second computer;

with the client application, intercepting event messages generated by at least one message generator running on the first computer;

with the client application, detecting addition or removal of a removable device in the first computer by processing the intercepted event messages;

based on the detecting, transmitting a message defining a change in the removable media for the first computer to the server application on the second computer;

with the server application, classifying the defined change as a permitted use of the first computer or an unauthorized use of the first computer; and

when the defined change is determined to be an unauthorized use, generating an alert indicting the defined change on the first computer;

wherein the intercepted messages are generated by one or more messaging mechanisms in an operating system environment of the second computer and wherein the message interceptor comprises a sub-classed function of a program running in the operating system environment.

19. The method of claim 18, wherein the detecting of the addition or removal further comprises first determining the removable device is a monitored type of device defined on a list in memory of the first computer, whereby only the monitored device types are monitored by the event message intercepting.

20. The method of claim 19, wherein the list is associated with a user logged onto the first computer, whereby the user may be assigned permitted devices for use with the first computer.

21. The method of claim 18, further comprising periodically running a drive device detector to detect existing drives in the first computer, reporting the detected existing drives to the server application on the second computer, and, with the server application, determining whether a current state of the detected existing drives complies with a defined authorized use of the first computer.