# US 12,111,915 B2 · Security-enhanced file open and download > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,111,915 B2 - Document ID: US12111915B2 - Status: Granted - Kind: B2 - Application number: 18/300,088 - Filed: 2023-04-13 - Published: 2023-08-10 - Granted: 2024-10-08 - Earliest claimed: 2019-11-08 - Assignees: Omnissa, LLC - Applicants: VMware LLC - Inventors: Sisimon Soman; Arun Padoor Chandramohan - Web page: https://patentgrep.com/patent/US12111915B2 ## CPC - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - G06F 9/45558: {Hypervisor-specific management and integration aspects} - G06F 16/188: Virtual file systems - G06F 16/954: Navigation, e.g. using categorised browsing - G06F 21/563: {by source code analysis} - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - G06F 21/568: {eliminating virus, restoring damaged files} - G06F 2009/45595: {Network integration; Enabling network access in virtual machine instances} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A method of downloading or opening a file in response to a user input made through an application running in the computer system, includes the steps of detecting by the application that the user input is to download or open a file, issuing a request by the application to a file sanitation server to sanitize the file to remove embedded codes in the file and return the sanitized file, and upon receiving the sanitized file by the application, saving the sanitized file in a folder where the sanitized file can be opened. ## Claims ### Claim 1 A method of downloading a file in response to a user input made through a remote desktop application running on a client device, comprising: transmitting the user input made through the remote desktop application from the client device to a virtual computing instance that is executing in a physical machine connected to the client device over a network and hosting a remote desktop service for the client device; detecting, by an application running inside the virtual computing instance, that the user input is to download a file through the application; issuing, by an extension of the application running inside the virtual computing instance, a request to download the file from a specified location corresponding to the user input, sanitize the downloaded file to remove embedded codes in the downloaded file, and return the sanitized file; sending, by a sanitation agent running inside the virtual computing instance, the request to a file sanitation server; receiving, by the sanitation agent, the sanitized file from the file sanitation server; and upon receiving the sanitized file by the sanitation agent, saving the sanitized file in a folder managed by the virtual computing instance. ### Claim 2 (depends on 1) The method of claim 1, wherein the application is a browser. ### Claim 3 (depends on 2) The method of claim 2, wherein the browser is running in an isolated execution space. ### Claim 4 (depends on 1) The method of claim 1, wherein the application is an e-mail application. ### Claim 5 (depends on 4) The method of claim 4, wherein the e-mail application is running in an isolated execution space. ### Claim 6 (depends on 1) The method of claim 1, wherein the virtual computing instance is one of a plurality of virtual machines that are isolated from each other and executing in the physical machine. ### Claim 7 (depends on 1) The method of claim 1, wherein the application is running inside an application execution space that is provisioned in the virtual computing instance. ### Claim 8 (depends on 1) The method of claim 1, further comprising: synchronizing the folder managed by the virtual computing instance with a local folder in the client device, such that the sanitized file is saved in the local folder. ### Claim 9 A non-transitory computer readable medium comprising instructions executable in a computer system to cause the computer system to carry out a method of downloading a file in response to a user input made through a remote desktop application running in a client device connectable to the computer system over a network, the method comprising: transmitting the user input made through the remote desktop application from the client device to a virtual computing instance that is executing in a physical machine connected to the client device over the network and hosting a remote desktop service for the client device; detecting by an application running inside the virtual computing instance, that the user input is to download a file through the application; issuing, by an extension of the application running inside the virtual computing instance, a request to download the file from a specified location corresponding to the user input, sanitize the downloaded file to remove embedded codes in the downloaded file, and return the sanitized file; sending, by a sanitation agent running inside the virtual computing instance, the request to a file sanitation server; receiving, by the sanitation agent, the sanitized file from the file sanitation server; and upon receiving the sanitized file by the sanitation agent, saving the sanitized file in a folder managed by the virtual computing instance. ### Claim 10 (depends on 9) The non-transitory computer readable medium of claim 9, wherein the application is a browser. ### Claim 11 (depends on 10) The non-transitory computer readable medium of claim 10, wherein the browser is running in an isolated execution space. ### Claim 12 (depends on 9) The non-transitory computer readable medium of claim 9, wherein the application is an e-mail application. ### Claim 13 (depends on 12) The non-transitory computer readable medium of claim 12, wherein the e-mail application is running in an isolated execution space. ### Claim 14 (depends on 9) The non-transitory computer readable medium of claim 9, wherein the computer system is a virtual machine. ### Claim 15 (depends on 9) The non-transitory computer readable medium of claim 9, wherein the method further comprises: synchronizing the folder managed by the virtual computing instance with a local folder in the client device, such that the sanitized file is saved in the local folder. ### Claim 16 A computer system comprising: a memory configured to store a program; and a processor configured to execute the program stored in the memory to perform an operation for downloading a file in response to a user input made through a remote desktop application running on a client device, the operation comprising: transmitting the user input made through the remote desktop application from the client device to a virtual computing instance that is executing in the computer system, which is connectable to the client device over a network and configured to host a remote desktop service for the client device; detecting, by an application running inside the virtual computing instance, that the user input is to download a file through the application; issuing, by an extension of the application running inside the virtual computing instance, a request to download the file from a specified location corresponding to the user input, sanitize the downloaded file to remove embedded codes in the downloaded file, and return the sanitized file; sending, by a sanitation agent running inside the virtual computing instance, the request to a file sanitation server; receiving, by the sanitation agent, the sanitized file from the file sanitation server; and upon receiving the sanitized file by the sanitation agent, saving the sanitized file in a folder managed by the virtual computing instance. ### Claim 17 (depends on 16) The computer system of claim 16, wherein the application is a browser. ### Claim 18 (depends on 17) The computer system of claim 17, wherein the browser is running in an isolated execution space. ### Claim 19 (depends on 16) The computer system of claim 16, wherein the application is an e-mail application. ### Claim 20 (depends on 19) The computer system of claim 19, wherein the e-mail application is running in an isolated execution space.