# US 11,451,548 B2 · Rule-based application access management

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,451,548 B2
- Document ID: US11451548B2
- Status: Granted
- Kind: B2
- Application number: 16/513,644
- Filed: 2019-07-16
- Published: 2020-05-21
- Granted: 2022-09-20
- Earliest claimed: 2006-10-23
- Assignees: Numecent Holdings, Inc.
- Applicants: Numecent Holdings, Inc.
- Inventors: Arthur S. Hitomi; Robert Tran; Peter J. Kammer; Doug Pfiffner; Huy Nguyen
- Web page: https://patentgrep.com/patent/US11451548B2

## CPC

- H04L 63/10: {for controlling access to devices or network resources}
- G06F 9/468: {Specific access rights for resources, e.g. using capability register}
- G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database}
- H04L 41/0813: characterised by the conditions triggering a change of settings
- H04L 41/145: {involving simulating, designing, planning or modelling of a network}
- H04L 43/0823: Errors, e.g. transmission errors
- H04L 63/108: {when the policy decisions are valid for a limited amount of time}
- G06F 2221/2141: Access rights, e.g. capability lists, access control lists, access tables, access matrices
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A container that manages access to protected resources using rules to intelligently manage them includes an environment having a set of software and configurations that are to be managed. A rule engine, which executes the rules, may be called reactively when software accesses protected resources. The engine uses a combination of embedded and configurable rules. It may be desirable to assign and manage rules per process, per resource (e.g. file, registry, etc.), and per user. Access rules may be altitude-specific access rules.

## Claims

### Claim 1

A method comprising:
obtaining, by a rule engine comprising one or more processors and memory, a request from a process to access one or more resources in a software container, wherein the rule engine obtaining the request comprises the rule engine using a file system hook to intercept the request, and wherein the software container includes the rule engine redundantly, or via relative global access;
assigning, by the rule engine to the process, a rule that allows or denies access to the one or more resources;
if the rule assigned to the process allows access to the one or more resources, instructing, by the rule engine, the software container to allow the process access to the one or more resources;
if the rule assigned to the process denies access to the one or more resources and the process is located within the software container, instructing, by the rule engine, the software container to copy the one or more resources for local modification by the process.

### Claim 2 (depends on 1)

The method of claim 1, wherein the assigning the rule to the process is based on one or more of file access control lists, user access control lists, process access control lists, software handlers, file overlays, and resource overlays.

### Claim 3 (depends on 1)

The method of claim 1, wherein the process is a main process having one or more child processes and the method comprises assigning, by the rule engine to the one or more child processes, the same rule assigned to the main process.

### Claim 4 (depends on 1)

The method of claim 1, wherein the rule engine obtaining the request comprises the rule engine receiving the request from the process.

### Claim 5 (depends on 1)

The method of claim 1, wherein the rule engine obtaining the request comprises the rule engine using a virtual drive to intercept the request.

### Claim 6 (depends on 1)

The method of claim 1, wherein the file system hook is a filter driver.

### Claim 7 (depends on 1)

The method of claim 1, wherein the rule engine is local to the software container.

### Claim 8 (depends on 1)

The method of claim 1, wherein the rule engine is remote to the software container.

### Claim 9

A system comprising:
a rule engine comprising one or more hardware processors and memory;
a software container including resources;
a process;
wherein, in operation, the rule engine:
obtains a request from the process to access one or more resources in the software container, wherein the rule engine obtaining the request comprises the rule engine using a file system hook to intercept the request, and wherein the software container includes the rule engine redundantly, or via relative global access;
assigns to the process a rule that allows or denies access to the one or more resources;
if the rule assigned to the process allows access to the one or more resources, instructs the software container to allow the process access to the one or more resources;
if the rule assigned to the process denies access to the one or more resources and the process is located within the software container, instructs the software container to copy the one or more resources for local modification by the process.

### Claim 10 (depends on 9)

The system of claim 9, wherein the assigning the rule to the process is based on one or more of file access control lists, user access control lists, process access control lists, software handlers, file overlays, and resource overlays.

### Claim 11 (depends on 9)

The system of claim 9, wherein the process is a main process having one or more child processes and wherein, in operation, the rule engine assigns to the one or more child processes the same rule assigned to the main process.

### Claim 12 (depends on 9)

The system of claim 9, wherein the rule engine obtaining the request comprises the rule engine receiving the request from the process.

### Claim 13 (depends on 9)

The system of claim 9, wherein the rule engine obtaining the request comprises the rule engine using a virtual drive to intercept the request.

### Claim 14 (depends on 9)

The system of claim 9, wherein the file system hook is a filter driver.

### Claim 15 (depends on 9)

The system of claim 9, wherein the rule engine is local to the software container.

### Claim 16 (depends on 9)

The system of claim 9, wherein the rule engine is remote to the software container.