# US 8,789,202 B2 · Systems and methods for providing real time access monitoring of a removable media device

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 8,789,202 B2
- Document ID: US8789202B2
- Status: Granted
- Kind: B2
- Application number: 12/622,386
- Filed: 2009-11-19
- Published: 2010-08-19
- Granted: 2014-07-22
- Earliest claimed: 2008-11-19
- Assignees: CUPP Computing AS
- Applicants: Shlomo Touboul; Sela Ferdman; Yonathan Yusim
- Inventors: Shlomo Touboul; Sela Ferdman; Yonathan Yusim
- Web page: https://patentgrep.com/patent/US8789202B2

## CPC

- G06F 21/31: User authentication
- G06F 21/85: interconnection devices, e.g. bus-connected or in-line devices
- G06F 11/1456: {Hardware arrangements for backup}
- G06F 21/554: {involving event detection and direct action}
- G06F 21/56: Computer malware detection or handling, e.g. anti-virus arrangements
- H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)}
- G06F 11/1446: Point-in-time backing up or restoration of persistent data
- G06F 11/3034: {where the computing system component is a storage system, e.g. DASD based or network based (digital input from or digital output to record carriers G06F3/06; digital recording or reproducing G11B20/18; for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS], H04L67/1097)}
- G06F 11/3438: {monitoring of user actions (tracking the activity of the user H04L67/535)}
- G06F 11/3476: {Data logging (G06F11/14, G06F11/2205 take precedence)}
- G06F 21/52: during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow}
- G06F 2221/034: Test or assess a computer or a system
- H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)}
- H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)}
- H04L 63/102: {Entity profiles}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A mobile security system connects to a mobile device and filters out attacks and malicious code. Using the mobile security system, a mobile device can be protected by greater security and possibly by the same level of security offered by a corporation, enterprise, or other entity associated with the mobile device.

## Claims

### Claim 1

A method, comprising:
detecting a removable media device coupled to a digital device;
injecting redirection code into the digital device after detecting the removable media device is coupled to the digital device, the redirection code configured to intercept a first function call and configured to execute a second function call in place of the first function call;
intercepting, with the redirection code, a request for data on the removable media device;
determining whether to allow the intercepted request for data based on a security policy, the security policy implementing content analysis and risk assessment algorithms; and
providing requested data based on the determination.

### Claim 2 (depends on 1)

The method of claim 1, further comprising selecting the security policy from a plurality of security policies based, at least in part, on a password used to authenticate access to the removable media device.

### Claim 3 (depends on 1)

The method of claim 1, further comprising filtering content of the requested data.

### Claim 4 (depends on 3)

The method of claim 3, wherein filtering the content comprises scanning the data for malware.

### Claim 5 (depends on 3)

The method of claim 3, wherein filtering the content comprises scanning the data for confidential information.

### Claim 6 (depends on 1)

The method of claim 1, wherein injecting redirection code into the digital device comprises temporarily replacing one or more dynamic-link libraries (DLLs) within the digital device.

### Claim 7 (depends on 1)

The method of claim 1, wherein receiving injected redirection code into the digital device comprises enumerating user processes of the digital device and receiving injected Dynamic Link Libraries (DLLs) to the enumerated user processes.

### Claim 8 (depends on 1)

The method of claim 1, further comprising receiving a shut down command and removing the redirection code in response to the shut down command.

### Claim 9 (depends on 1)

The method of claim 1, further comprising removing the redirection code in response to a detection that the removable media device is no longer coupled to the digital device.

### Claim 10 (depends on 1)

The method of claim 1, further comprising intercepting, with the redirection code, a request to store data to the removable media device and determining whether to allow the request to store data based on the security policy.

### Claim 11

A removable media device comprising:
a login engine configured to detect coupling to a digital device, the login engine further configured to inject redirection code into the digital device after detecting the coupling to the digital device, the redirection code being configured to intercept a first function call and configured to execute a second function call in place of the first function call; and
a controller configured to intercept a request for the data, determine whether to allow the request for the data based on a security policy, the security policy implementing content analysis and risk assessment algorithms, and provide requested data based on the determination.

### Claim 12 (depends on 11)

The removable media device of claim 11, wherein the controller is further configured to select the security policy from a plurality of security policies based, at least in part, on a password used to authenticate access to the removable media device.

### Claim 13 (depends on 11)

The removable media device of claim 11, wherein the controller is further configured to filter content of the requested data.

### Claim 14 (depends on 13)

The removable media device of claim 13, wherein filtering the content comprises scanning the data for malware.

### Claim 15 (depends on 13)

The removable media device of claim 13, wherein filtering the content comprises scanning the data for confidential information.

### Claim 16 (depends on 11)

The removable media device of claim 11, wherein the login engine is configured to temporarily replace one or more dynamic-link libraries (DLLs) within the digital device.

### Claim 17 (depends on 11)

The removable media device of claim 11, wherein the login engine is configured to enumerate user processes of the digital device and receive injected Dynamic Link Libraries (DLLs) to the enumerated user processes.

### Claim 18 (depends on 11)

The removable media device of claim 11, wherein the digital device is configured to receive a shut down command and remove the redirection code in response to the shut down command.

### Claim 19 (depends on 11)

The removable media device of claim 11, wherein the digital device is configured to remove the redirection code in response to a detection that the removable media device is no longer coupled to the digital device.

### Claim 20 (depends on 11)

The removable media device of claim 11, further comprising intercepting, with the redirection code, a request to store data and determining whether to allow the request to store data based on the security policy.

### Claim 21

A non-transitory computer readable storage media comprising instructions, the instructions executable by a processor to perform a method, the method comprising:
detecting a removable media device coupled to a digital device;
injecting redirection code into the digital device after detecting the removable media device is coupled to the digital device, the redirection code configured to intercept a first function call and configured to execute a second function call in place of the first function call;
intercepting, with the redirection code, a request for data on the removable media device;
determining whether to allow the intercepted request for data based on a security policy, the security policy implementing content analysis and risk assessment algorithms; and
providing requested data based on the determination.