# US 12,111,927 B2 · Use of an application controller to monitor and control software file and application environments > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,111,927 B2 - Document ID: US12111927B2 - Status: Granted - Kind: B2 - Application number: 18/359,283 - Filed: 2023-07-26 - Published: 2024-05-02 - Granted: 2024-10-08 - Earliest claimed: 2010-03-31 - Assignees: Sophos Limited - Applicants: Sophos Limited - Inventors: Andrew J. Thomas - Web page: https://patentgrep.com/patent/US12111927B2 ## CPC - G06F 21/56: Computer malware detection or handling, e.g. anti-virus arrangements - G06F 21/62: Protecting access to data via a platform, e.g. using keys or access control rules - H04L 63/107: {wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals} - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract In embodiments, a framework for an extensible, file-based security system is described for determining an appropriate application, application environment, and/or access or security control measure based at least in part on a file's reputation. ## Claims ### Claim 1 A method for operating an application controller on an endpoint in an enterprise network, the method comprising: in response to a selection of a file, determining at least one access and security parameter for the file; selecting a secure software application from a number of software applications on the endpoint suitable for opening the file based on a security configuration according to the at least one access and security parameter, wherein the secure software application includes a secure application for opening the file when the file has a poor or unknown reputation, and wherein the secure software application limits access by the file to resources of an environment of the endpoint more than one or more other files with a good reputation; launching the selected software application to open the file and access the file in accordance with the security configuration; controlling a use of the file by the secure software application in a test mode to require that the use of the file is in accord with the at least one access and security parameter for the file; receiving an update to a reputation of the file; and in response to the update, permitting a user to escalate the use of the file by the secure software application from the test mode to an insecure mode by providing the secure software application with access to additional resources of the endpoint based on the reputation of the file. ### Claim 2 (depends on 1) The method of claim 1, wherein permitting the user to escalate the use of the file includes increasing access to files on the endpoint when the reputation is updated to the good reputation. ### Claim 3 (depends on 1) The method of claim 1, wherein permitting the user to escalate the use of the file includes increasing access to network resources of the endpoint. ### Claim 4 (depends on 1) The method of claim 1, wherein permitting the user to escalate the use of the file includes increasing access to memory resources of the endpoint. ### Claim 5 (depends on 1) The method of claim 1, wherein permitting the user to escalate the use of the file includes increasing access to processes executing on the endpoint. ### Claim 6 (depends on 1) The method of claim 1, further comprising decreasing access to resources of the endpoint by the secure software application using the file when the reputation of the file is updated to a poor reputation. ### Claim 7 A computer program product for operating an application controller on an endpoint in an enterprise network, the computer program product embodied in a non-transitory computer readable medium that, when executing on one or more computers, performs the steps of: determining whether a file contains unwanted code based on scanning the file for the unwanted code; determining a reputation of the file based on metadata for the file; selecting a software application with an application controller according to a security parameter for the file based on at least one of the reputation of the file and a determination that the file contains the unwanted code; opening the file with the software application, wherein the software application opens the file with limited access to one or more resources based on the reputation of the file determined based on the metadata for the file; managing use of the file by the software application; receiving a reputation update to the reputation of the file; and escalating the software application to an insecure configuration by granting the software application access to additional resources based on the reputation update. ### Claim 8 (depends on 7) The computer program product of claim 7, wherein the application controller stores the reputation that is associated with the file. ### Claim 9 (depends on 7) The computer program product of claim 7, wherein the application controller is configured to adjust the one or more resources available to the selected software application by managing communications related to the selected software application. ### Claim 10 (depends on 9) The computer program product of claim 9, wherein the one or more resources include a network. ### Claim 11 (depends on 9) The computer program product of claim 9, wherein the one or more resources include a local file system on the endpoint. ### Claim 12 (depends on 9) The computer program product of claim 9, wherein the one or more resources include a process executing on the endpoint. ### Claim 13 (depends on 9) The computer program product of claim 9, wherein the one or more resources include a memory. ### Claim 14 (depends on 7) The computer program product of claim 7, wherein the one or more resources include a registry of the endpoint. ### Claim 15 (depends on 7) The computer program product of claim 7, wherein the metadata for determining the reputation includes data relating to a file format. ### Claim 16 (depends on 7) The computer program product of claim 7, wherein the metadata for determining the reputation includes data relating to an originating location of the file. ### Claim 17 (depends on 16) The computer program product of claim 16, wherein the originating location is an Internet URL. ### Claim 18 (depends on 16) The computer program product of claim 16, wherein the originating location is an IP address. ### Claim 19 (depends on 16) The computer program product of claim 16, wherein the origination location is a third software application. ### Claim 20 An endpoint comprising: a memory storing computer executable instructions that, when executed, provide an application controller for managing applications executing on the endpoint; and one or more processors configured by the computer executable instructions to operate the application controller by performing the steps of: in response to a selection of a file, determining at least one access and security parameter for the file; selecting a software application from a number of software applications on the endpoint suitable for opening the file based on a security configuration according to the at least one access and security parameter, wherein the software application includes a secure application for opening the file when the file has a poor or unknown reputation, and wherein the software application limits access by the file to resources of the endpoint more than one or more other files with a good reputation; launching the selected software application to open the file and access the file in accordance with the security configuration; controlling a use of the file by the software application in a test mode to require that the use of the file is in accord with the at least one access and security parameter for the file; receiving an update to a reputation of the file; and in response to the update, permitting a user to escalate the use of the file by the software application from the test mode to an insecure mode by providing the software application with access to additional resources of the endpoint based on the reputation of the file.