# US 11,030,302 B2 · Restricting access to application programming interfaces (APIs) > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,030,302 B2 - Document ID: US11030302B2 - Status: Granted - Kind: B2 - Application number: 16/108,579 - Filed: 2018-08-22 - Published: 2019-10-17 - Granted: 2021-06-08 - Earliest claimed: 2018-04-12 - Assignees: Webroot Inc. - Applicants: Webroot Inc. - Inventors: Andrew L. Sandoval; John R. Shaw, II - Web page: https://patentgrep.com/patent/US11030302B2 ## CPC - G06F 21/51: at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability - G06F 9/54: Interprogram communication - G06F 21/52: during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow} - G06F 21/554: {involving event detection and direct action} - G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities - G06F 21/629: {to features or functions of an application} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Examples of the present disclosure describe systems and methods for restricting access to application programming interfaces (APIs). For example, when a process calls an API, the API call may be intercepted by a security system for evaluation of its trustfulness before the API is allowed to run. Upon intercepting an API call, the process calling the API may be evaluated to determine if the process is known to the security system, such that known processes that are untrusted may be blocked from calling the API. Further, when the security system cannot identify the process calling the API, the security service may evaluate a call stack associated with the call operation to determine if attributes of the call operation are known to the security system. If the call operation is known to the security system as untrusted, the call operation may be blocked from calling the API. ## Claims ### Claim 1 A system comprising: at least one processor; and memory storing instructions that, when executed by the at least one processor, causes the system to perform a set of operation, the set of operations comprising: monitoring at least one application programming interface (API) associated with performing one or more file finding functions; intercepting a call operation directed to the at least one API, wherein the call operation is associated with a process attempting to perform at least one of the one or more file finding functions; determining a trust level for the process; wherein determining the trust level for the process comprises: accessing a process data store to compare one or more attributes of the process to information for a set of known processes to determine whether the process is an unknown process; accessing a call operation data store to compare one or more attributes of the call operation to information for a set of known call operation attributes to determine whether the call operation is untrusted; and determining the trust level for the process based at least in part on the determination whether the process is an unknown process and the determination whether the call operation is untrusted; evaluating the determined trust level to determine whether the process is trusted or untrusted; based on determining the process is untrusted, presenting a prompt to a user to allow the call operation; responsive to a user indication to allow the call operation, allowing the call operation; and based on determining the process is untrusted and absent a user indication to allow the call operation, blocking the call operation directed to the at least one API from performing the at least one of the one or more file finding functions. ### Claim 2 (depends on 1) The system of claim 1, wherein the set of operations further comprises: in response to receiving a user indication at the displayed prompt to allow the call operation, adding the process to a set of known processes in a process data store. ### Claim 3 (depends on 1) The system of claim 1, wherein the set of operations further comprises: in response to receiving a user indication at the displayed prompt to deny the call operation, terminating the process. ### Claim 4 (depends on 1) The system of claim 1, wherein the prompt includes information relating to the at least one of the one or more file finding functions of the API. ### Claim 5 (depends on 1) The system of claim 1, wherein intercepting the call operation comprises analyzing a call stack associated with the process for an operation having a wildcard character. ### Claim 6 A method of restricting use of an application programming interface (API) associated with performing one or more file finding functions, the method comprising: receiving a call operation directed to an API associated with performing one or more file finding functions, wherein the call operation is associated with a process; performing an evaluation of the process based on the call operation, wherein the evaluation comprises at least one of: comparing one or more attributes of the process to a set of known processes; and comparing one or more attributes of the call operation to a set of known call operations; determining, based at least in part on the evaluation, a trust level for the process, wherein determining the trust level for the process comprises: accessing a process data store to compare one or more attributes of the process to information for a set of known processes to determine whether the process is an unknown process; accessing a call operation data store to compare one or more attributes of the call operation to information for a set of known call operation attributes to determine whether the call operation is untrusted; and determining the trust level for the process based at least in part on the determination whether the process is an unknown process and the determination whether the call operation is untrusted; evaluating the determined trust level to determine whether the process is trusted or untrusted; based on determining the process is untrusted, presenting a prompt to a user to allow the call operation; responsive to a user indication to allow the call operation, allowing the call operation; and based on determining that the process is untrusted and absent a user indication to allow the call operation, blocking the call operation directed to the API from performing at least one of the one or more file finding functions. ### Claim 7 (depends on 6) The method of claim 6, wherein, in response to allowing the call operation based on a user indication to allow the call operation, the method further comprises at least one action selected from the group consisting of: allowing the call operation and adding the process to the set of known processes; and allowing the call operation only once. ### Claim 8 (depends on 6) The method of claim 6, wherein, in response to blocking the call operation, the method further comprises: capturing information associated with the process; and reporting the process back to a security service. ### Claim 9 (depends on 6) The method of claim 6, wherein the API is associated with a user-mode of the operating system. ### Claim 10 A method of restricting use of at least one application programming interface (API), the method comprising: monitoring at least one API associated with performing one or more file finding functions; intercepting a call operation directed to the at least one API, wherein the call operation is associated with a process attempting to perform at least one of the one or more file finding functions; determining a trust level for the process, wherein determining the trust level for the process comprises: accessing a process data store to compare one or more attributes of the process to information for a set of known processes to determine whether the process is an unknown process; accessing a call operation process data store to compare one or more attributes of the call operation to information for a set of known call operation attributes to determine whether the call operation is untrusted; and determining the trust level for the process based at least in part on the determination whether the process is an unknown process and the determination whether the call operation is untrusted; evaluating the determined trust level to determine whether the process is trusted or untrusted; based on determining the process is untrusted, presenting a prompt to a user to allow the call operation; responsive to a user indication to allow the call operation, allowing the call operation; and based on determining the process is untrusted and absent a user indication to allow the call operation, blocking the call operation directed to the at least one API from performing the at least one of the one or more file finding functions. ### Claim 11 (depends on 10) The method of claim 10, wherein the method further comprises: in response to receiving a user indication at the displayed prompt to allow the call operation, adding the process to a set of known processes in a process data store. ### Claim 12 (depends on 10) The method of claim 10, wherein the method further comprises: in response to receiving a user indication at the displayed prompt to deny the call operation, terminating the process. ### Claim 13 (depends on 10) The method of claim 10, wherein the prompt includes information relating to the at least one of the one or more file finding functions of the API. ### Claim 14 (depends on 10) The method of claim 10, wherein intercepting the call operation comprises analyzing a call stack associated with the process for an operation having a wildcard character.