# US 12,182,312 B1 · Techniques to support tiered security zones for web-based applications > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,182,312 B1 - Document ID: US12182312B1 - Status: Granted - Kind: B1 - Application number: 18/776,878 - Filed: 2024-07-18 - Granted: 2024-12-31 - Earliest claimed: 2024-07-18 - Assignees: Here Enterprise Inc. - Applicants: Here Enterprise Inc. - Inventors: Chuck Doerr - Web page: https://patentgrep.com/patent/US12182312B1 ## CPC - G06F 21/6263: {during internet communication, e.g. revealing personal data from cookies} - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - G06F 21/55: Detecting local intrusion or implementing counter-measures - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract First data from a first application logically located in a first security zone may be identified. A processing device may determine a second application is logically located in a second security zone having a higher trust level than the first security zone based on configuration data. The first data may be communicated, via an interoperation bus, to the second application based on the second security zone having the higher trust level. ## Claims ### Claim 1 A method, comprising: identifying first data from a first application logically located in a first security zone; determining, by a processing device, a second application is logically located in a second security zone having a higher trust level than the first security zone based on configuration data; communicating, via an interop bus, the first data to the second application based on the second security zone having the higher trust level; identifying second data from the first application logically located in the first security zone; determining, based on the configuration data, a third application is logically located in a third security zone having a lower trust level than the first security zone; and blocking communication of the second data to the third application based on the third security zone having the lower trust level, wherein communication of the second data to the third application is blocked based on an attempted copy and paste operation from the first application to the third application. ### Claim 2 (depends on 1) The method of claim 1, further comprising: determining a third application is logically located in the first security zone based on the configuration data; and communicating, via the interop bus, the first data to the third application based on each of the third application and the first application being logically located in the first security zone. ### Claim 3 (depends on 1) The method of claim 1, wherein the interop bus comprises a logical bus having a network of nodes including a first node associated with the first security zone and a second node associated with the second security zone. ### Claim 4 (depends on 1) The method of claim 1, wherein the first application comprises a first web-based application and the second application comprises a second web-based application. ### Claim 5 (depends on 1) The method of claim 1, wherein the first data is communicated to the second application in support of a copy and paste operation from the first application to the second application. ### Claim 6 (depends on 1) The method of claim 1, wherein the first application and the second application are at least one of process isolated or cache isolated. ### Claim 7 A system comprising: a memory; and a processing device, operatively coupled to the memory, to: identify first data from a first application logically located in a first security zone; determine a second application is logically located in a second security zone having a higher trust level than the first security zone based on configuration data; communicate, via an interop bus, the first data to the second application based on the second security zone having the higher trust level; identify second data from the first application logically located in the first security zone; determine, based on the configuration data, a third application is logically located in a third security zone having a lower trust level than the first security zone; and block communication of the second data to the third application based on the third security zone having the lower trust level, wherein communication of the second data to the third application is blocked based on an attempted copy and paste operation from the first application to the third application. ### Claim 8 (depends on 7) The system of claim 7, wherein the processing device is further to: determine a third application is logically located in the first security zone based on the configuration data; and communicate, via the interop bus, the first data to the third application based on each of the third application and the first application being logically located in the first security zone. ### Claim 9 (depends on 7) The system of claim 7, wherein the interop bus comprises a logical bus having a network of nodes including a first node associated with the first security zone and a second node associated with the second security zone. ### Claim 10 (depends on 7) The system of claim 7, wherein the first application comprises a first web-based application and the second application comprises a second web-based application. ### Claim 11 (depends on 7) The system of claim 7, wherein the first data is communicated to the second application in support of a copy and paste operation from the first application to the second application. ### Claim 12 (depends on 7) The system of claim 7, wherein the first application and the second application are at least one of process isolated or cache isolated. ### Claim 13 A non-transitory computer-readable storage medium including instructions that, when executed by a processing device, cause the processing device to: identify first data from a first application logically located in a first security zone; determine a second application is logically located in a second security zone having a higher trust level than the first security zone based on configuration data; communicate, via an interop bus, the first data to the second application based on the second security zone having the higher trust level; identify second data from the first application logically located in the first security zone; determine, based on the configuration data, a third application is logically located in a third security zone having a lower trust level than the first security zone; and block communication of the second data to the third application based on the third security zone having the lower trust level, wherein communication of the second data to the third application is blocked based on an attempted copy and paste operation from the first application to the third application. ### Claim 14 (depends on 13) The non-transitory computer-readable storage medium of claim 13, wherein the processing device is further to: determine a third application is logically located in the first security zone based on the configuration data; and communicate, via the interop bus, the first data to the third application based on each of the third application and the first application being logically located in the first security zone. ### Claim 15 (depends on 13) The non-transitory computer-readable storage medium of claim 13, wherein the interop bus comprises a logical bus having a network of nodes including a first node associated with the first security zone and a second node associated with the second security zone. ### Claim 16 (depends on 13) The non-transitory computer-readable storage medium of claim 13, wherein the first application comprises a first web-based application and the second application comprises a second web-based application.