# US 2016/0259934 A1 · Enforcing trusted application settings for shared code libraries > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2016/0259934 A1 - Document ID: US20160259934A1 - Status: Published application - Kind: A1 - Application number: 15/061,837 - Filed: 2016-03-04 - Published: 2016-09-08 - Earliest claimed: 2015-03-07 - Assignees: Protegrity Corporation - Applicants: Protegrity Corporation - Inventors: Yigal Rozenberg; Pierre Burlin; Jan Boberg - Web page: https://patentgrep.com/patent/US20160259934A1 ## CPC - G06F 21/44: Program or device authentication - G06F 21/45: Structures or tools for the administration of authentication - H04L 63/102: {Entity profiles} - G06F 2221/2101: Auditing as a secondary aspect - G06F 2221/2137: Time limited access, e.g. to a computer or data - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Access to a shared library API is restricted for a customer application by a security system. A profile for each of a plurality of trusted applications is generated and stored in a security database. When a customer application attempts to access the shared library API, the customer application is verified by extracting a customer application profile for the customer application, comparing the customer application profile with each stored trusted application profile, and verifying that the customer application can access the shared library API based on the comparison. Based on the verification, the customer application may be allowed to or access to the shared library API or may be prevented from accessing the shared library API. ## Claims ### Claim 1 A method of restricting access to a shared library within a computer security system, the method comprising: storing, by a security database for each of a plurality of trusted applications, a trusted application profile identifying a set of application constraints each associated with an application property that must be satisfied before an application can access a shared library; detecting, by an administrative server, an attempt from a customer application to access the shared library; responsive to the attempt, generating, by the administrative server, a profile of the customer application, the customer application profile representative of a set of properties of the customer application; retrieving, by the administrative server from the security database, a profile for each of a set of trusted applications; comparing the customer application profile to each retrieved customer application profiles; responsive to a successful comparison between the customer application profile and at least one target application profile, verifying, by the administrative server, that the customer application can access the shared library; responsive to verifying that the customer application can access the shared library, allowing, by the administrative server, the attempt from the customer application to access the shared library; and responsive to not verifying that the customer application can access the shared library, denying, by the administrative server, the attempt from the customer application to access the shared library. ### Claim 2 (depends on 1) The method of claim 1, wherein each trusted application profile includes one or more of: a trusted application name, a trusted application user, a trusted application host id, a location of the trusted application within a computer system, an access date and time of the trusted application, and an internet protocol address of a system that executes the trusted application. ### Claim 3 (depends on 1) The method of claim 1, wherein one or more trusted application profiles are received from a system administrator. ### Claim 4 (depends on 1) The method of claim 1, wherein the customer application is verified in response to each application constraint in a trusted application profile is satisfied by the customer application profile. ### Claim 5 (depends on 1) The method of claim 1, wherein an audit record is created for the customer application in response to denying the attempt from the customer application to access the shared library. ### Claim 6 (depends on 1) The method of claim 1, wherein determining an attempt from a customer application to access the shared library comprises intercepting a call to an API of the shared library from a function of the application. ### Claim 7 (depends on 1) The method of claim 1, wherein responsive to verifying that the customer application can access the shared library further comprises storing the customer application profile in the security database as a trusted application profile. ### Claim 8 An administrative server computer system for restricting access to a shared library, the administrative server comprising a hardware processor and a security database, the hardware processor configured to perform steps comprising: storing, in the security database for each of a plurality of trusted applications, a trusted application profile identifying a set of application constraints each associated with an application property that must be satisfied before an application can access a shared library; detecting an attempt from a customer application to access the shared library; responsive to the attempt, generating a profile of the customer application, the customer application profile representative of a set of properties of the customer application; retrieving a profile for each of a set of trusted applications; comparing the customer application profile to each retrieved customer application profiles; responsive to a successful comparison between the customer application profile and at least one target application profile, verifying that the customer application can access the shared library; responsive to verifying that the customer application can access the shared library, allowing the attempt from the customer application to access the shared library; and responsive to not verifying that the customer application can access the shared library, denying the attempt from the customer application to access the shared library. ### Claim 9 (depends on 8) The administrative server of claim 8, wherein each trusted application profile includes one or more of: a trusted application name, a trusted application user, a trusted application host id, a location of the trusted application within a computer system, an access date and time of the trusted application, and an internet protocol address of a system that executes the trusted application. ### Claim 10 (depends on 8) The administrative server of claim 8, wherein one or more trusted application profiles are received from a system administrator. ### Claim 11 (depends on 8) The administrative server of claim 8, wherein the customer application is verified in response to each application constraint in a trusted application profile is satisfied by the customer application profile. ### Claim 12 (depends on 8) The administrative server of claim 8, wherein an audit record is created for the customer application in response to denying the attempt from the customer application to access the shared library. ### Claim 13 (depends on 8) The administrative server of claim 8, wherein determining an attempt from a customer application to access the shared library comprises intercepting a call to an API of the shared library from a function of the application. ### Claim 14 (depends on 8) The administrative server of claim 8, wherein responsive to verifying that the customer application can access the shared library further comprises storing the customer application profile in the security database as a trusted application profile. ### Claim 15 A non-transitory computer-readable storage medium storing executable computer instructions for restricting access to a shared library within a computer security system, the instructions configured to, when executed by a hardware processor, perform steps comprising: storing, in a security database for each of a plurality of trusted applications, a trusted application profile identifying a set of application constraints each associated with an application property that must be satisfied before an application can access a shared library; detecting an attempt from a customer application to access the shared library; responsive to the attempt, generating a profile of the customer application, the customer application profile representative of a set of properties of the customer application; retrieving, from the security database, a profile for each of a set of trusted applications; comparing the customer application profile to each retrieved customer application profiles; responsive to a successful comparison between the customer application profile and at least one target application profile, verifying that the customer application can access the shared library; responsive to verifying that the customer application can access the shared library, allowing the attempt from the customer application to access the shared library; and responsive to not verifying that the customer application can access the shared library, denying the attempt from the customer application to access the shared library. ### Claim 16 (depends on 15) The computer-readable storage medium of claim 15, wherein each trusted application profile includes one or more of: a trusted application name, a trusted application user, a trusted application host id, a location of the trusted application within a computer system, an access date and time of the trusted application, and an internet protocol address of a system that executes the trusted application. ### Claim 17 (depends on 15) The computer-readable storage medium of claim 15, wherein one or more trusted application profiles are received from a system administrator. ### Claim 18 (depends on 15) The computer-readable storage medium of claim 15, wherein the customer application is verified in response to each application constraint in a trusted application profile is satisfied by the customer application profile. ### Claim 19 (depends on 15) The computer-readable storage medium of claim 15, wherein an audit record is created for the customer application in response to denying the attempt from the customer application to access the shared library. ### Claim 20 (depends on 15) The computer-readable storage medium of claim 15, wherein determining an attempt from a customer application to access the shared library comprises intercepting a call to an API of the shared library from a function of the application. ### Claim 21 (depends on 15) The computer-readable storage medium of claim 15, wherein responsive to verifying that the customer application can access the shared library further comprises storing the customer application profile in the security database as a trusted application profile.