Patent ID: 8250263

Claim:
A security apparatus for protecting USB data, wherein the USB data is provided by a USB device and input to an input/output request packet (IRP) by a USB bus class driver to complete the IRP, the apparatus comprising: a filter driver configured to modify a format of the IRP by inserting an identifier into the IRP in order to identify which USB device provides the USB data to be input to the IRP; and a USB bus class driver hooking module configured to perform, in a USB data protection mode, a security operation that includes: hooking an IoCompleteRequest function called by the USB bus class driver and used for notifying the completion of the IRP; detecting a target IRP having the USB data to be protected by checking the identifier of the completed IRP; intercepting, when the target IRP is detected, the USB data from the target IRP before the IoCompleteRequest function is called by the USB bus class driver.