Systems and methods for providing real time security and access monitoring of a removable media device

1. A method comprising:

detecting a removable media device being coupled to an external device port of a digital device, the digital device having an operating system and a file system;

causing, after detecting the removable media device being coupled to the external device port of the digital device, at least a portion of redirection code to be temporarily generated on the digital device by a login module, the redirection code including an interceptor, a data security policy, and a data security process;

intercepting, using the interceptor, a first function call to the operating system or the file system of the digital device before the first function call is executed by the operating system or the file system, the first function call including a request of the operating system or the file system to retrieve data from or write data to the removable media device, the first function call being initiated by a particular user or a particular application;

performing a set of one or more second function calls in response to intercepting the first function call, the set of one or more second function calls not including the first function call, the set of one or more second function calls including a data-security-based second function call, the data-security-based second function call causing the steps of:

executing the data security process, the data security process determining whether the particular user or the particular application is authorized to retrieve the data from or write the data to the removable media device based on the data security policy, and thus whether to allow the first function call based at least on results of the data security process and the data security policy; and

allowing the operating system or the file system to execute the first function call in response to a determination to allow the first function call;

detecting the removable media device is being removed from the external device port of the digital device; and

terminating the at least a portion of the redirection code after detecting the removable media device is being removed from the external port of the digital device.

2. The method of claim 1 , further comprising selecting the data security policy from a plurality of data security policies based, at least in part, on a password, wherein different passwords are associated with different access rights defined by different data security policies.

3. The method of claim 1 , wherein the data security process filters content of the data.

4. The method of claim 3 , wherein the data security process filters the content by scanning the data for confidential information.

5. The method of claim 1 , wherein causing the at least a portion of the redirection code to be generated comprises injecting the at least a portion of the redirection code into the digital device by temporarily replacing one or more dynamic-link libraries (dlls) within the digital device.

6. The method of claim 1 , wherein causing the at least a portion of the redirection code to be generated comprises injecting the at least a portion of the redirection code into the digital device by enumerating user processes of the digital device and injecting dlls into the enumerated user processes.

7. The method of claim 1 , further comprising receiving a shutdown command and removing the at least a portion of the redirection code in response to the shutdown command.

8. The method of claim 1 , wherein the step of terminating the at least a portion of the redirection code includes removing the at least a portion of the redirection code in response to a detection that the removable media device is no longer coupled to the digital device.

9. The method of claim 1 , wherein the data security process includes an authentication process.

10. The method of claim 1 , wherein the data security process includes a malware detection process.

11. A system comprising:

one or more hardware processors;

memory coupled to the one or more hardware processors and storing computer code, the computer code when executed controlling the one or more hardware processors to:

detect a removable media device being coupled to an external device port of a digital device, the digital device having an operating system and a file system;

cause, after detecting the removable media device being coupled to the external device port of the digital device, at least a portion of redirection code to be temporarily generated on the digital device by a login module, the redirection code including an interceptor, a data security policy, and a data security process;

intercept, using the interceptor, a first function call to the operating system or the file system of the digital device before the first function call is executed by the operating system or the file system, the first function call including a request of the operating system or the file system to retrieve data from or write data to the removable media device, the first function call being initiated by a particular user or a particular application; and

perform a set of one or more second function calls in response to intercepting the first function call, the set of one or more second function calls not including the first function call, the set of one or more second function calls including a data-security-based second function call, the data-security-based second function call causing the steps of:

execute the data security process, the data security process determining whether the particular user or the particular application is authorized to retrieve the data from or write the data to the removable media device based on the data security policy, and thus whether to allow the first function call based at least on results of the data security process and the data security policy; and

allow the operating system or the file system to execute the first function call in response to a determination to allow the first function call;

detect the removable media device is being removed from the external device port of the digital device; and

terminate the at least a portion of the redirection code after detecting the removable media device is being removed from the external port of the digital device.

12. The system of claim 11 , wherein the computer code is further configured to cause the one or more hardware processors to select the data security policy from a plurality of data security policies based, at least in part, on a password, wherein different passwords are associated with different access rights defined by different data security policies.

13. The system of claim 11 , wherein the computer code is further configured to cause the one or more hardware processors to filter content of the data.

14. The system of claim 13 , wherein filtering the content comprises scanning the data for confidential information.

15. The system of claim 11 , wherein the computer code is further configured to cause the one or more hardware processors to inject the at least a portion of the redirection code into the digital device by temporarily replacing one or more dynamic-link libraries (dlls) within the digital device.

16. The system of claim 11 , wherein the computer code is further configured to cause the one or more hardware processors to cause the at least a portion of the redirection code to be generated by injecting the at least a portion of the redirection code into the digital device by enumerating user processes of the digital device and injecting dlls into the enumerated user processes.

17. The system of claim 11 , wherein the computer code is further configured to cause the one or more hardware processors to receive a shut down command and remove the at least a portion of the redirection code in response to the shut down command.

18. The system of claim 11 , wherein the computer code is further configured to cause the one or more hardware processors to remove the at least a portion of the redirection code in response to a detection that the removable media device is no longer coupled to the digital device.

19. The system of claim 11 , wherein the data security process includes an authentication process.

20. The system of claim 11 , wherein the data security process includes a malware detection process.

21. A non-transitory computer readable media comprising instructions, the instructions executable by a processor to perform a method, the method comprising:

detecting a removable media device being coupled to an external device port of a digital device, the digital device having an operating system and a file system;

causing, after detecting the removable media device being coupled to the external device port of the digital device, at least a portion of redirection code to be temporarily generated on the digital device by a login module, the redirection code including an interceptor, a data security policy, and a data security process;

intercepting, using the interceptor, a first function call to the operating system or the file system of the digital device before the first function call is executed by the operating system or the file system, the first function call including a request of the operating system or the file system to retrieve data from or write data to the removable media device, the first function call being initiated by a particular user or a particular application;

performing a set of one or more second function calls in response to intercepting the first function call, the set of one or more second function calls not including the first function call, the set of one or more second function calls including a data-security-based second function call, the data-security-based second function call causing the steps of:

executing the data security process, the data security process determining whether the particular user or the particular application is authorized to retrieve the data from or write the data to the removable media device based on the data security policy, and thus whether to allow the first function call based at least on results of the data security process and the data security policy; and

allowing the operating system or the file system to execute the first function call in response to a determination to allow the first function call;

detecting the removable media device is being removed from the external device port of the digital device; and

terminating the at least a portion of the redirection code after detecting the removable media device is being removed from the external port of the digital device.