# US 2018/0027007 A1 · Sandboxed execution of plug-ins > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2018/0027007 A1 - Document ID: US20180027007A1 - Status: Published application - Kind: A1 - Application number: 15/615,411 - Filed: 2017-06-06 - Published: 2018-01-25 - Earliest claimed: 2008-12-02 - Assignees: Microsoft Technology Licensing, LLC - Applicants: Microsoft Technology Licensing, LLC - Inventors: Nirav Yogesh SHAH; Allen F. Hafezipour; Steve Jamieson; Shashi Ranjan - Web page: https://patentgrep.com/patent/US20180027007A1 ## CPC - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP] - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A sandbox architecture that isolates and identifies misbehaving plug-ins (intentional or unintentional) to prevent system interruptions and failure. Based on plug-in errors, the architecture automatically disables and blocks registration of the bad plug-in via a penalty point system. Publishers of bad plug-ins are controlled by disabling the bad plug-ins and registering the publisher in an unsafe list. Isolation can be provided in multiple levels, such as machine isolation, process isolation, secure accounts with limited access rights, and application domain isolation within processes using local security mechanisms. A combination of the multiple levels of isolation achieves a high level of security. Isolation provides separation from other plug-in executions and restriction to system resources such as file system and network IP. Moreover, the architecture is highly scalable, stateless, and low administration architecture for the execution of the plug-ins, which can be scaled by adding/removing additional sandbox servers on-the-fly without prior configuration. ## Claims ### Claim at position 1 1-20. (canceled) ### Claim 21 A computing system comprising: a processor; and memory storing instructions executable by the processor, wherein the instructions, when executed, configure the computing system to provide: an interface component configured to receive an auxiliary code execution request indicative of auxiliary code associated with an application; a load management component configured to select an isolation component based on a load management characteristic associated with the isolation component, wherein the isolation component includes a worker process configured to: execute the auxiliary code in an application domain that is isolated from the application, and configured to generate an execution call that is indicative of execution of the auxiliary code by the application domain; and provide the execution call to the application; and a management component configured to; receive an indication of abnormal execution behavior associated with the execution of the auxiliary code; and generate an Instruction to stop the execution the auxiliary code. ### Claim 22 (depends on 21) The computing system of claim 21, Wherein the auxiliary code comprises executable code that corresponds to a plug-in and is configured for execution with the application. ### Claim 23 The computing system of claim. 21, wherein the isolation component comprises a sandbox server that is selected from a plurality of sandbox servers based on the load management characteristic. ### Claim 24 (depends on 21) The computing system of claim 21, wherein the isolation component is configured to execute the auxiliary code based on at least one of: a machine isolation level; or a process isolation level. ### Claim 25 (depends on 21) The computing system of claim 21, wherein the management component is configured to: determine a penalty metric based on the indication abnormal execution behavior; and generate an instruction to disable execution of the auxiliary code based on the penalty metric. ### Claim 26 (depends on 21) The computing system of claim 21, wherein the instructions, when executed, configure the computing system to provide a penalty component configured to: track penalty points based on abnormal execution behavior during execution of the auxiliary code. ### Claim 27 (depends on 21) The computing system of claim 21, wherein the application is associated with a first virtual machine that is implemented on a server computing machine, and the isolation component comprises a second virtual machine that is implemented on the server computing machine and is securely isolated from the first virtual machine. ### Claim 28 A computer-implemented method comprising: receiving an auxiliary code execution request indicative of auxiliary code associated with an application; selecting an isolation component based on a load management characteristic associated with the isolation component; executing, by a worker process associated with the isolation component, the auxiliary code in an application domain that is isolated from the application; generating an execution call that is indicative of execution of the auxiliary code by the application domain; providing the execution call to the application; receiving an indication of abnormal execution behavior associated with the execution of the auxiliary code; and generating an instruction to stop the execution of the auxiliary code. ### Claim 29 The computer-implemented method of claim wherein the auxiliary code comprises executable code that corresponds to a plug-in and is configured for execution with the application. ### Claim 30 (depends on 28) The computer-implemented method of claim 28, wherein the isolation component comprises a sandbox server that is selected from a plurality of sandbox servers based on the load management characteristic. ### Claim 31 (depends on 28) The computer-implemented method of claim 28, further comprising: identifying an error in execution of the auxiliary code based on the indication of abnormal execution behavior; based on the identified error, associating a penalty metric with the auxiliary code; and based on the associated penalty metric, generating the instruction to stop execution of the auxiliary code. ### Claim 32 (depends on 31) The computer-implemented method of claim 31, further comprising: based on a determination that the penalty Metric exceeds a pre-determined threshold, disabling the auxiliary code. ### Claim 33 (depends on 31) The computer-implemented method of claim 31, further comprising: identifying a source associated with the auxiliary code; and based on a determination that the penalty metric exceeds a pre-determined threshold, preventing registration of second auxiliary code associated with the source. ### Claim 34 (depends on 28) The computer-implemented method of claim 28, further comprising: managing execution of the auxiliary code based on a number of times the auxiliary code has been associated with a penalty metric. ### Claim 35 (depends on 28) The computer-implemented method of claim 28, wherein selecting the isolation component comprises: selecting the isolation component based on load balancing data that is indicative of an availability of the isolation component relative to availability of one or more other isolation components. ### Claim 36 A computing system comprising: a processor; and memory storing instructions executable by the processor, wherein the instructions, when executed, configure the computing system to: receive an auxiliary code execution request indicative of auxiliary code associated with an application; select an isolation component based on a load management characteristic associated with the isolation component; execute, by a worker process associated with the isolation component, the auxiliary code in an application domain that is isolated from the application; generate an execution call that is indicative of execution of the auxiliary code by the application domain: provide the execution call to the application; receive an indication of abnormal execution behavior associated with the execution of the auxiliary code; and generate an instruction to stop the execution of the auxiliary code. ### Claim 37 (depends on 36) The computing system of claim 36, wherein the auxiliary code comprises executable code that corresponds to a plug-in and is configured for execution with the application, and the isolation component comprises a sandbox server that is selected from a plurality of sandbox servers based on the load management characteristic. ### Claim 38 (depends on 36) The computing system of claim 36, wherein the instructions, when executed, configure the computing system to: identify an error in execution of the auxiliary code based on the indication of abnormal execution behavior; based on the identified error, associate a penalty metric with the auxiliary code; and based on the associated penalty metric, generate the instruction to stop execution of the auxiliary code. ### Claim 39 (depends on 36) The computing system of claim 36, wherein the instructions, when executed, configure the computing system to: determine that the penalty metric exceeds a pre-determined threshold; identify a source associated with the auxiliary code; and based on the determination, disable the auxiliary code, and prevent registration of second auxiliary code associated with the source. ### Claim 40 (depends on 36) The computing system of claim 36 wherein the instructions, when executed, configure the computing system to: select the isolation component based on load balancing data that is indicative of an availability of the isolation component relative to availability of one or more other isolation components.