# US 9,762,614 B2 · Systems and methods for providing network security using a secure digital device

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 9,762,614 B2
- Document ID: US9762614B2
- Status: Granted
- Kind: B2
- Application number: 14/622,764
- Filed: 2015-02-13
- Published: 2015-08-13
- Granted: 2017-09-12
- Earliest claimed: 2014-02-13
- Assignees: CUPP Computing AS
- Applicants: CUPP Computing AS
- Inventors: Omar Nathaniel Ely
- Web page: https://patentgrep.com/patent/US9762614B2

## CPC

- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- H04L 63/14: {for detecting or protecting against malicious traffic}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A system may include a traffic interception module configured to intercept network traffic of a host device. A traffic virtualization module may be configured to generate a virtual file on the host device containing the intercepted network traffic. A security system interface module may be configured to provide the virtual file to a secure digital security system over a virtualized file interface coupling the host device to the secure digital security system, and to receive instructions to allow or to deny the network traffic from the secure digital security system over the virtualized file interface. A traffic access management module may be configured to allow or to deny the network traffic based on the instructions.

## Claims

### Claim 1

A system comprising:
a host device;
a secure digital device including a data store and at least one security engine;
a virtual file interface configured to assist in transferring data at file transfer speeds between the host device and the secure digital device;
a traffic interception module configured to intercept network traffic of the host device, the network traffic of the host device including one of incoming network traffic or outgoing network traffic;
a host interface configured to receive data store commands to retrieve or store data in the data store and to receive the network traffic of the host device intercepted by the traffic interception module;
a virtualization module on the host device configured to identify the data store commands and the network traffic, to generate one or more virtual files containing the network traffic, to send the one or more virtual files containing the network traffic to the virtual file interface, and to send the data store commands to the data store;
the virtual file interface being configured to provide the one or more virtual files to the secure digital device at the file transfer speeds;
the at least one security engine being configured to evaluate the network traffic in the one or more virtual files, to generate an instruction whether to allow or deny the network traffic based on a security policy, and to assist in sending the instruction to the host device; and
a traffic access management module on the host device configured to allow or deny the network traffic based on the instruction.

### Claim 2 (depends on 1)

The system of claim 1, wherein the network traffic comprises outgoing network traffic.

### Claim 3 (depends on 1)

The system of claim 1, wherein the network traffic comprises incoming network traffic.

### Claim 4 (depends on 1)

The system of claim 1, further comprising a virtualized traffic encryption module configured to encrypt the one or more virtual files before the virtual file interface provides the one or more virtual files to the secure digital device.

### Claim 5 (depends on 1)

The system of claim 1, wherein the traffic interception module is further configured to monitor one or more applications and/or processes for a presence or absence of the network traffic.

### Claim 6 (depends on 1)

The system of claim 1, wherein the traffic interception module is further configured to monitor one or more root-level processes of a network interface for a presence or absence of the network traffic.

### Claim 7 (depends on 1)

The system of claim 1, wherein the secure digital device is incorporated into a Secure Digital (SD) card coupled to the host device.

### Claim 8 (depends on 1)

The system of claim 1, wherein the host device comprises a portable electronic device.

### Claim 9

A secure digital device comprising:
a data store;
a virtualized file management module configured to receive one or more virtual files from a host device over a virtual file interface configured to assist in transferring data at file transfer speeds between the host device and the secure digital device, the one or more virtual files containing network traffic intercepted at the host device, the network traffic of the host device including one of incoming network traffic or outgoing network traffic, the virtualized file management module further configured to receive data store commands to retrieve or store data in the data store;
a controller configured to manage the data store commands by retrieving or storing the data in the data store;
a security policy management module configured to evaluate the network traffic in the one or more virtual files for compliance with a security policy;
a traffic access determination module configured to generate an instruction whether to allow or deny the network traffic in accordance with the evaluation; and
an instruction providing module configured to provide to the host device over the virtual file interface the instruction whether to allow or deny the network traffic.

### Claim 10 (depends on 9)

The secure digital device of claim 9, wherein the network traffic comprises outgoing network traffic.

### Claim 11 (depends on 9)

The secure digital device of claim 9, wherein the network traffic comprises incoming network traffic.

### Claim 12 (depends on 9)

The secure digital device of claim 9, wherein the one or more virtual files comprises one or more encrypted virtual files.

### Claim 13 (depends on 9)

The secure digital device of claim 9, wherein the secure digital device is incorporated into a Secure Digital (SD) card coupled to the host device.

### Claim 14 (depends on 9)

The secure digital device of claim 9, wherein the host device comprises a portable electronic device.

### Claim 15

A method comprising:
receiving at a host device data store commands to retrieve or store data in a data store of a secure digital device, the secure digital device including the data store and at least one security engine;
intercepting network traffic of the host device, the network traffic of the host device including one of incoming network traffic or outgoing network traffic;
using a virtualization module to identify the data store commands and the network traffic;
sending the data store commands to the data store;
using the virtualization module to generate one or more virtual files containing the network traffic of the host device;
sending the one or more virtual files containing the network traffic to a virtual file interface;
using the virtual file interface to transfer the one or more virtual files at file transfer speeds to the secure digital device;
using the at least one security engine to evaluate the network traffic in the one or more virtual files to determine whether to allow or deny the network traffic based on a security policy;
generating an instruction whether to allow or deny the network traffic based on the evaluation;
sending the instruction to the host device; and
allowing or denying the network traffic based on the instruction.

### Claim 16 (depends on 15)

The method of claim 15, wherein the network traffic comprises outgoing network traffic.

### Claim 17 (depends on 15)

The method of claim 15, wherein the network traffic comprises incoming network traffic.

### Claim 18 (depends on 15)

The method of claim 15, wherein the one or more virtual files is encrypted before being provided to the secure digital device.

### Claim 19 (depends on 15)

The method of claim 15, further comprising monitoring the network traffic by monitoring one or more applications and/or processes.

### Claim 20 (depends on 15)

The method of claim 15, further comprising monitoring the network traffic by monitoring one or more root-level processes of a network interface.

### Claim 21 (depends on 15)

The method of claim 15, wherein the secure digital device is incorporated into a Secure Digital (SD) card coupled to the host device.

### Claim 22 (depends on 15)

The method of claim 15, wherein the host device comprises a portable electronic device.

### Claim 23

A method comprising:
in a secure digital device including a data store and at least one security engine:
receiving one or more virtual files from a host device over a virtual file interface configured to transfer data at file transfer speeds, the one or more virtual files containing network traffic intercepted at the host device, the network traffic of the host device including one of incoming network traffic or outgoing network traffic;
receiving data store commands to retrieve or store data in the data store;
managing the data store commands by retrieving or storing the data in the data store;
using the at least one security engine to evaluate the network traffic in the one or more virtual files for compliance with a security policy;
generating an instruction whether to allow or deny the network traffic in accordance with the evaluation; and
providing to the host device the instruction whether to allow or deny the network traffic.

### Claim 24 (depends on 23)

The method of claim 23, wherein the network traffic comprises outgoing network traffic.

### Claim 25 (depends on 23)

The method of claim 23, wherein the network traffic comprises incoming network traffic.

### Claim 26 (depends on 23)

The method of claim 23, wherein the one or more virtual files comprises one or more encrypted virtual files.

### Claim 27 (depends on 23)

The method of claim 23, wherein the secure digital device is incorporated into a Secure Digital (SD) card coupled to the host device.

### Claim 28 (depends on 23)

The method of claim 23, wherein the host device comprises a portable electronic device.