Systems and methods for providing real time access monitoring of a removable media device

• US 8,789,202 B2
• Filed: 11/19/2009
• Issued: 07/22/2014
• Est. Priority Date: 11/19/2008
• Status: Active Grant

• Current Assignee: CUPP Computing AS
• Original Assignee: CUPP Computing AS
• Inventors: Touboul, Shlomo, Ferdman, Sela, Yusim, Yonathan
• Primary Examiner(s): Armouche, Hadi
• Assistant Examiner(s): WRIGHT, BRYAN F
• Application Number:
  US12/622,386
• Publication Number:
  US 20100212012A1
• Time in Patent Office: 1,706 Days
• Field of Search: 726/1
• US Class Current: 726/27
• CPC Class Codes: G06F 11/1446 Point-in-time backing up or restoration of persistent data
• CPC Class Codes: G06F 11/1456 Hardware arrangements for backup
• CPC Class Codes: G06F 11/3034 where the computing system component is a storage system, e.g. DASD based or network based digital input from or digital output to record carriers G06F3/06; digital recording or reproducing G11B20/18; for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS], H04L67/1097
• CPC Class Codes: G06F 11/3438 monitoring of user actions tracking the activity of the user H04L67/535
• CPC Class Codes: G06F 11/3476 Data logging G06F11/14, G06F11/2205 take precedence
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/85 interconnection devices, e.g. bus-connected or in-line devices
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

A mobile security system connects to a mobile device and filters out attacks and malicious code. Using the mobile security system, a mobile device can be protected by greater security and possibly by the same level of security offered by a corporation, enterprise, or other entity associated with the mobile device.

Claims

1. A method, comprising:

detecting a removable media device coupled to a digital device;

injecting redirection code into the digital device after detecting the removable media device is coupled to the digital device, the redirection code configured to intercept a first function call and configured to execute a second function call in place of the first function call;

intercepting, with the redirection code, a request for data on the removable media device;

determining whether to allow the intercepted request for data based on a security policy, the security policy implementing content analysis and risk assessment algorithms; and

providing requested data based on the determination.

2. The method of claim 1, further comprising selecting the security policy from a plurality of security policies based, at least in part, on a password used to authenticate access to the removable media device.

3. The method of claim 1, further comprising filtering content of the requested data.

4. The method of claim 3, wherein filtering the content comprises scanning the data for malware.

5. The method of claim 3, wherein filtering the content comprises scanning the data for confidential information.

6. The method of claim 1, wherein injecting redirection code into the digital device comprises temporarily replacing one or more dynamic-link libraries (DLLs) within the digital device.

7. The method of claim 1, wherein receiving injected redirection code into the digital device comprises enumerating user processes of the digital device and receiving injected Dynamic Link Libraries (DLLs) to the enumerated user processes.

8. The method of claim 1, further comprising receiving a shut down command and removing the redirection code in response to the shut down command.

9. The method of claim 1, further comprising removing the redirection code in response to a detection that the removable media device is no longer coupled to the digital device.

10. The method of claim 1, further comprising intercepting, with the redirection code, a request to store data to the removable media device and determining whether to allow the request to store data based on the security policy.

11. A removable media device comprising:

a login engine configured to detect coupling to a digital device, the login engine further configured to inject redirection code into the digital device after detecting the coupling to the digital device, the redirection code being configured to intercept a first function call and configured to execute a second function call in place of the first function call; and

a controller configured to intercept a request for the data, determine whether to allow the request for the data based on a security policy, the security policy implementing content analysis and risk assessment algorithms, and provide requested data based on the determination.

12. The removable media device of claim 11, wherein the controller is further configured to select the security policy from a plurality of security policies based, at least in part, on a password used to authenticate access to the removable media device.

13. The removable media device of claim 11, wherein the controller is further configured to filter content of the requested data.

14. The removable media device of claim 13, wherein filtering the content comprises scanning the data for malware.

15. The removable media device of claim 13, wherein filtering the content comprises scanning the data for confidential information.

16. The removable media device of claim 11, wherein the login engine is configured to temporarily replace one or more dynamic-link libraries (DLLs) within the digital device.

17. The removable media device of claim 11, wherein the login engine is configured to enumerate user processes of the digital device and receive injected Dynamic Link Libraries (DLLs) to the enumerated user processes.

18. The removable media device of claim 11, wherein the digital device is configured to receive a shut down command and remove the redirection code in response to the shut down command.

19. The removable media device of claim 11, wherein the digital device is configured to remove the redirection code in response to a detection that the removable media device is no longer coupled to the digital device.

20. The removable media device of claim 11, further comprising intercepting, with the redirection code, a request to store data and determining whether to allow the request to store data based on the security policy.

21. A non-transitory computer readable storage media comprising instructions, the instructions executable by a processor to perform a method, the method comprising:

detecting a removable media device coupled to a digital device;

injecting redirection code into the digital device after detecting the removable media device is coupled to the digital device, the redirection code configured to intercept a first function call and configured to execute a second function call in place of the first function call;

intercepting, with the redirection code, a request for data on the removable media device;

determining whether to allow the intercepted request for data based on a security policy, the security policy implementing content analysis and risk assessment algorithms; and

providing requested data based on the determination.