# US 12,602,474 B2 · Use of an application controller to monitor and control software file and application environments

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,602,474 B2
- Document ID: US12602474B2
- Status: Granted
- Kind: B2
- Application number: 18/906,646
- Filed: 2024-10-04
- Published: 2025-06-05
- Granted: 2026-04-14
- Earliest claimed: 2010-03-31
- Assignees: Sophos Limited
- Applicants: Sophos Limited
- Inventors: Andrew J. Thomas
- Web page: https://patentgrep.com/patent/US12602474B2

## CPC

- G06F 21/56: Computer malware detection or handling, e.g. anti-virus arrangements
- G06F 21/62: Protecting access to data via a platform, e.g. using keys or access control rules
- H04L 63/107: {wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals}
- H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

In embodiments, a framework for an extensible, file-based security system is described for determining an appropriate application, application environment, and/or access or security control measure based at least in part on a file's reputation.

## Claims

### Claim 1

A method for operating an application controller on an endpoint in an enterprise network, the method comprising:
in response to a selection of a file, determining at least one access and security parameter for the file;
selecting a secure software application from a number of software applications on the endpoint suitable for opening the file based on a security configuration according to the at least one access and security parameter, wherein the secure software application includes a secure application for opening the file when the file has a poor or unknown reputation because the file was received from the Internet, and wherein the secure software application limits access by the file to resources of an environment of the endpoint more than one or more other files with a good reputation;
launching the selected software application to open the file and access the file in accordance with the security configuration;
controlling a use of the file by the secure software application in a test mode to require that the use of the file is in accord with the at least one access and security parameter for the file;
receiving an update to a reputation of the file; and
in response to the update, permitting a user to escalate the use of the file by the secure software application from the test mode to an insecure mode by providing the secure software application with access to additional resources of the endpoint based on the reputation of the file.

### Claim 2 (depends on 1)

The method of claim 1, wherein permitting the user to escalate the use of the file includes increasing access to files on the endpoint when the reputation is updated to the good reputation.

### Claim 3 (depends on 1)

The method of claim 1, wherein permitting the user to escalate the use of the file includes increasing access to network resources of the endpoint.

### Claim 4 (depends on 1)

The method of claim 1, wherein permitting the user to escalate the use of the file includes increasing access to memory resources of the endpoint.

### Claim 5 (depends on 1)

The method of claim 1, wherein permitting the user to escalate the use of the file includes increasing access to processes executing on the endpoint.

### Claim 6 (depends on 1)

The method of claim 1, further comprising decreasing access to resources of the endpoint by the secure software application using the file when the reputation of the file is updated to a poor reputation.

### Claim 7

A computer program product for operating an application controller on an endpoint in an enterprise network, the computer program product embodied in a non-transitory computer readable medium that, when executing on one or more computers, performs the steps of:
receiving a file at an endpoint from a network;
determining that a reputation of the file is untrusted based on metadata for the file indicating that a source of the file is the network;
selecting a software application to open the file based on the metadata for the file;
opening the file with the software application, wherein the software application uses an application controller to open the file with limited access to one or more resources based on the reputation of the file being untrusted due to the source of the file in the metadata;
managing use of the file by the software application;
receiving a reputation update to the reputation of the file; and
escalating the software application to an insecure configuration by granting the software application access to additional resources based on the reputation update.

### Claim 8 (depends on 7)

The computer program product of claim 7, wherein the application controller stores the reputation that is associated with the file.

### Claim 9 (depends on 7)

The computer program product of claim 7, wherein the application controller is configured to adjust the one or more resources available to the selected software application by managing communications related to the selected software application.

### Claim 10 (depends on 9)

The computer program product of claim 9, wherein the one or more resources include a network.

### Claim 11 (depends on 9)

The computer program product of claim 9, wherein the one or more resources include a local file system on the endpoint.

### Claim 12 (depends on 9)

The computer program product of claim 9, wherein the one or more resources include a process executing on the endpoint.

### Claim 13 (depends on 9)

The computer program product of claim 9, wherein the one or more resources include a memory.

### Claim 14 (depends on 7)

The computer program product of claim 7, wherein the one or more resources include a registry of the endpoint.

### Claim 15 (depends on 7)

The computer program product of claim 7, wherein the metadata for determining the reputation includes data relating to a file format.

### Claim 16 (depends on 7)

The computer program product of claim 7, wherein the source of the file includes data relating to an originating location of the file.

### Claim 17 (depends on 16)

The computer program product of claim 16, wherein the originating location is an Internet URL.

### Claim 18 (depends on 16)

The computer program product of claim 16, wherein the originating location is an IP address.

### Claim 19

An endpoint comprising:
a memory storing computer executable instructions that, when executed, provide an application controller for managing applications executing on the endpoint; and
one or more processors configured by the computer executable instructions to operate the application controller by performing the steps of:
in response to a selection of a file, determining at least one access and security parameter for the file;
selecting a software application on the endpoint suitable for opening the file based on a security configuration according to the at least one access and security parameter, wherein the software application limits access by the file to resources of the endpoint when the file has an untrusted reputation due to a source of the file more than the software application limits access to resources for one or more other files with a good reputation;
launching the selected software application to open the file and access the file in accordance with the security configuration;
controlling a use of the file by the software application in a test mode to require that the use of the file is in accord with the at least one access and security parameter for the file;
receiving an update to a reputation of the file; and
in response to the update, permitting a user to escalate the use of the file by the software application from the test mode to an insecure mode by providing the software application with access to additional resources of the endpoint based on the reputation of the file.

### Claim 20 (depends on 19)

The endpoint of claim 19, wherein the reputation of the file is untrusted because the source of the file is the Internet.