# US 11,308,204 B2 · Agentless security > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,308,204 B2 - Document ID: US11308204B2 - Status: Granted - Kind: B2 - Application number: 16/549,115 - Filed: 2019-08-23 - Published: 2021-02-25 - Granted: 2022-04-19 - Earliest claimed: 2019-08-23 - Assignees: McAfee, Inc. - Applicants: McAfee, LLC - Inventors: Lior Rudnik - Web page: https://patentgrep.com/patent/US11308204B2 ## CPC - G06F 21/52: during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow} - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - G06F 21/54: by adding security routines or objects to programs - G06F 21/562: {Static detection} - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - H04L 63/1416: {Event detection, e.g. attack signature detection} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract There is disclosed in one example a computing apparatus, including: a hardware platform including a processor and a memory; a closed operating system including instructions within the memory to sandbox userspace applications; and a sandboxed userspace application, including: instructions to provide a user interface and user application code; and an agentless security library within the sandboxed userspace application, the agentless security library including instructions to provide security or privacy services to the sandboxed userspace application with minimal direct interaction from the user interface and user application code. ## Claims ### Claim 1 A computing apparatus, comprising: a hardware platform comprising a processor and a memory; a closed operating system comprising instructions within the memory to sandbox userspace applications from one another, wherein sandboxing an application comprises assigning a memory space to the sandboxed application and restricting access to the memory space from other applications; and a sandboxed userspace application, comprising instructions to: provide a user interface and user application code; and provide an agentless security library within the sandboxed userspace application, the agentless security library comprising instructions to provide security or privacy services to the sandboxed userspace application with a single point of entry, comprising a single runtime or compile-time invocation of the agentless security library by the sandboxed userspace application. ### Claim 2 (depends on 1) The computing apparatus of claim 1, wherein the single point of entry comprises a single procedure invocation of the agentless security library. ### Claim 3 (depends on 1) The computing apparatus of claim 1, wherein the single point of entry comprises a compile-time inclusion of a header file that automatically invokes the agentless security library. ### Claim 4 (depends on 3) The computing apparatus of claim 3, wherein the header file further comprises macro replacements or overloads of common userspace methods to communicate data. ### Claim 5 (depends on 1) The computing apparatus of claim 1, wherein the sandboxed userspace application carries a certification that the sandboxed userspace application receives security or privacy services from the agentless security library. ### Claim 6 (depends on 5) The computing apparatus of claim 5, wherein the agentless security library comprises instructions to write verification data to a log file. ### Claim 7 (depends on 5) The computing apparatus of claim 5, wherein the agentless security library comprises instructions to communicate with a cloud server to provide verification. ### Claim 8 (depends on 1) The computing apparatus of claim 1, wherein the agentless security library comprises instructions to certify that the sandboxed userspace application complies with legal or regulatory requirements for security or privacy. ### Claim 9 (depends on 1) The computing apparatus of claim 1, wherein the agentless security library comprises instrumentation to intercept communication within the sandboxed userspace application, and outside of the sandboxed userspace application. ### Claim 10 (depends on 1) The computing apparatus of claim 1, wherein the agentless security library comprises a detection engine to detect security flaws within the sandboxed userspace application. ### Claim 11 One or more tangible, non-transitory computer-readable media having stored thereon executable instructions to provide an agentless security software development kit (SDK) for inclusion with a sandboxed application on a closed operating system, the agentless security SDK comprising a single point of entry for the sandboxed application to invoke security or privacy services of the agentless security SDK via a single runtime or compile-time invocation of the agentless security SDK by the sandboxed application. ### Claim 12 (depends on 11) The one or more tangible, non-transitory computer-readable storage media of claim 11, wherein the agentless security SDK comprises a detection engine to detect security flaws within the sandboxed application. ### Claim 13 (depends on 11) The one or more tangible, non-transitory computer-readable storage media of claim 11, wherein the agentless security SDK comprises a privacy engine to detect export of personally-identifying information (PII) outside of the sandboxed application. ### Claim 14 (depends on 11) The one or more tangible, non-transitory computer-readable storage media of claim 11, wherein the agentless security SDK comprises a network environment engine to detect an attack against a network environment of the sandboxed application. ### Claim 15 (depends on 11) The one or more tangible, non-transitory computer-readable storage media of claim 11, wherein the agentless security SDK comprises a best practices engine to enforce best security practices within the sandboxed application. ### Claim 16 (depends on 11) The one or more tangible, non-transitory computer-readable storage media of claim 11, wherein the agentless security SDK comprises an enforcement engine to enforce a usage or security policy within the sandboxed application. ### Claim 17 (depends on 16) The one or more tangible, non-transitory computer-readable storage media of claim 16, wherein the enforcement engine comprises instructions to provide parental controls. ### Claim 18 A method of developing a secured application for a closed operating system, comprising invoking, at build time, an agentless security software development kit (SDK) for inclusion with the secured application, wherein the invocation comprises a single compile-time invocation of the agentless security SDK within the secured application, wherein the secured application is sandboxed by a host operating system into a private memory space not accessible to other applications. ### Claim 19 The method of 18, wherein invoking the agentless security SDK comprises invoking a utility that overloads common communication procedures with communication procedures that are hooked by the agentless security SDK.