# US 11,030,303 B2 · Time limited application enablement > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,030,303 B2 - Document ID: US11030303B2 - Status: Granted - Kind: B2 - Application number: 15/626,892 - Filed: 2017-06-19 - Published: 2018-12-20 - Granted: 2021-06-08 - Earliest claimed: 2017-06-19 - Assignees: Microsoft Technology Licensing, LLC - Applicants: Microsoft Technology Licensing, LLC - Inventors: Moshe Israel; Ben Kliger - Web page: https://patentgrep.com/patent/US11030303B2 ## CPC - G06F 21/52: during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow} - G06F 21/10: Protecting distributed programs or content, e.g. vending or licensing of copyrighted material (protection in video systems or pay television H04N7/16) {; Digital rights management [DRM]} - G06F 21/51: at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - G06F 21/629: {to features or functions of an application} - H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP] - H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) - H04L 67/62: Establishing a time schedule for servicing the requests - G06F 2221/033: Test or assess software - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Methods, systems, and apparatuses are provided for managing an execution of applications in a computing environment. A whitelist list of applications that are permitted to execute in a computing environment is obtained. For one or more of the applications on the whitelist, a temporal rule is assigned that specifies a time period in which the application is permitted to execute in the computing environment. For instance, the temporal rule may be obtained via a user input or may be determined automatically by analyzing an execution history of the application. Applications are permitted to execute in the computing environment during the time period specified by the temporal rule, and are prevented from executing outside of the time period. By restricting the time period in which an application can execute, the overall vulnerability to malware attacks in a computing environment may be reduced. ## Claims ### Claim 1 A method of managing execution of applications in a computing environment, comprising: obtaining a list of one or more applications that are permitted to execute in the computing environment; receiving, from each of a plurality of devices in the computing environment, an execution history of at least one application in the list with respect to the device; determining a common time at which the at least one application in the list executes on the plurality of devices based on historical execution times identified in the execution histories; assigning, to the at least one application in the list, a rule that specifies a time period during which the application is allowed to execute, the specified time period being automatically determined based at least on the common time at which the at least one application in the list executes on the plurality of devices; permitting the at least one application to execute in the computing environment during the specified time period; and preventing the at least application from executing in the computing environment outside of the specified time period. ### Claim 2 (depends on 1) The method of claim 1, wherein the rule is assigned to the at least one application, at least in part, by a user. ### Claim 3 (depends on 1) The method of claim 1, further comprising: modifying the rule, wherein the modifying includes at least one of altering a start time, an end time, a run time, and a recurrence for the at least one application. ### Claim 4 (depends on 1) The method of claim 1, further comprising: adjusting the rule, wherein the adjusting is performed by a user. ### Claim 5 (depends on 1) The method of claim 1, wherein the rule permits only a limited number of executions of the at least one application in the computing environment. ### Claim 6 (depends on 1) The method of claim 1, further comprising: disabling an implementation of the rule, wherein the disabling is performed by a user. ### Claim 7 (depends on 1) The method of claim 1, wherein the execution history comprises a log that includes one or more of: a length of time that the at least one application was executed in the past; a time at which the at least one application started executing in the past; a time at which the at least one application ceased to execute in the past; the frequency at which the at least one application was executed in the past; a specific day, month, or year that the at least one application was executed in the past. ### Claim 8 A system, comprising: at least one processor circuit; at least one memory that stores program code configured to be executed by the at least one processor circuit, the program code comprising: a list obtainer configured to obtain a list of one or more applications that are permitted to execute on a managed device; an application manager configured to: receive, from each of a plurality of devices in the computing environment, an execution history of at least one application in the list with respect to the device, and determine a common time at which the at least one application in the list executes on the plurality of devices based on historical execution times identified in the execution histories; a rule assigner configured to assign, to the at least one application in the list, a rule that specifies a time period during which the application is allowed to execute on the managed device, the specified time period being automatically determined based at least on the common time at which the at least one application in the list executes on the plurality of devices, the rule when applied to the managed device permitting the at least one application to execute on the managed device during the specified time period and preventing the at least one application from executing on the managed device outside of the specified time period; and an interface configured to apply the rule to the managed device. ### Claim 9 (depends on 8) The system of claim 8, wherein the rule is assigned to the at least one application, at least in part, by a user. ### Claim 10 (depends on 8) The system of claim 8, wherein the program code further comprises: a rule modifier configured to modify the rule by altering at least one of a start time, an end time, a run time, and a recurrence for the at least one application. ### Claim 11 (depends on 8) The system of claim 8, wherein the program code further comprises: a rule modifier that is configured to adjust the rule based on a user input. ### Claim 12 (depends on 8) The system of claim 8, wherein the rule when applied to the managed device permits only a limited number of executions of the at least one application on the managed device. ### Claim 13 (depends on 8) The system of claim 8, wherein the program code further comprises: a rule disabler that is configured to disable an implementation of the rule based on user input. ### Claim 14 (depends on 8) The system of claim 8, wherein the execution history comprises a log that includes one or more of: a length of time that the at least one application was executed in the past; a time at which the at least one application started executing in the past; a time at which the at least one application ceased to execute in the past; the frequency at which the at least one application was executed in the past; a specific day, month, or year that the at least one application was executed in the past. ### Claim 15 A computer-readable storage medium having program instructions recorded thereon that, when executed by at least one processing circuit, perform a method for managing execution of applications on a computing device, the method comprising: specifying a time period in which at least one application is permitted to execute on the computing device; and preventing the at least one application from executing on the computing device outside of the specified time period by: inserting, by a software component, at a beginning of the specified time period, the at least one application into a whitelist of applications utilized by a security tool to selectively permit the at least one application to execute on the computing device, the security tool not being capable of implementing a temporal whitelist rule; and removing, by the software component, at the end of the specified time period, the at least one application from the whitelist of applications to prevent the at least one application from executing on the computing device. ### Claim 16 (depends on 15) The computer-readable storage medium of claim 15, wherein the specifying is performed, at least in part, by a user. ### Claim 17 (depends on 15) The computer-readable storage medium of claim 15, further comprising: modifying the specified time period for the at least one application, wherein the modifying includes at least one of altering a start time, an end time, a run time, and a recurrence for the at least one application. ### Claim 18 (depends on 15) The computer-readable storage medium of claim 15, further comprising: adjusting the specified time period, wherein the adjusting is performed by a user. ### Claim 19 (depends on 15) The computer-readable storage medium of claim 15, wherein the computing device is a managed computing device. ### Claim 20 (depends on 15) The computer-readable storage medium of claim 15, wherein the specifying the time period in which at the least one application is permitted to execute on the computing device is based at least in part on an execution history of the at least one application, the execution history comprising a log that includes one or more of: a length of time that the at least one application was executed in the past; a time at which the at least one application started executing in the past; a time at which the at least one application ceased to execute in the past; the frequency at which the at least one application was executed in the past; a specific day, month, or year that the at least one application was executed in the past.