US 2019/0318079 A1 · RESTRICTING ACCESS TO APPLICATION PROGRAMMING INTERFACES (APIs)

Abstract

Examples of the present disclosure describe systems and methods for restricting access to application programming interfaces (APIs). For example, when a process calls an API, the API call may be intercepted by a security system for evaluation of its trustfulness before the API is allowed to run. Upon intercepting an API call, the process calling the API may be evaluated to determine if the process is known to the security system, such that known processes that are untrusted may be blocked from calling the API. Further, when the security system cannot identify the process calling the API, the security service may evaluate a call stack associated with the call operation to determine if attributes of the call operation are known to the security system. If the call operation is known to the security system as untrusted, the call operation may be blocked from calling the API.

Claims20

Dependent claims

A system comprising:

at least one processor;
and
memory storing instructions that, when executed by the at least one processor, causes the system to perform a set of operation, the set of operations comprising:
monitoring at least one application programming interface (API) associated with performing one or more file finding functions;
intercepting a call operation directed to the at least one API, wherein the call operation is associated with a process attempting to perform at least one of the one or more file finding functions;
determining a trust level for the process;
evaluating the determined trust level to determine whether the process is trusted or untrusted;
and
based on determining the process is untrusted, blocking the call operation directed to the at least one API from performing the at least one of the one or more file finding functions.

6 more elements

A method of restricting use of at least one application programming interface (API), the method comprising:

monitoring at least one API associated with performing one or more file finding functions;
intercepting a call operation directed to the at least one API, wherein the call operation is associated with a process attempting to perform at least one of the one or more file finding functions;
determining a trust level for the process;
evaluating the determined trust level to determine whether the process is trusted or untrusted;
and
based on determining the process is untrusted, blocking the call operation directed to the at least one API from performing the at least one of the one or more file finding functions.

3 more elements

Dependencies are inferred from the claim text.

RESTRICTING ACCESS TO APPLICATION PROGRAMMING INTERFACES (APIs)

Life of this patent

RESTRICTING ACCESS TO APPLICATION PROGRAMMING INTERFACES (APIs)

Life of this patent

Abstract

Claims20