# US 8,752,047 B2 · Automated management of virtual machines to process untrusted data based on client policy information > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,752,047 B2 - Document ID: US8752047B2 - Status: Granted - Kind: B2 - Application number: 13/223,091 - Filed: 2011-08-31 - Published: 2013-02-28 - Granted: 2014-06-10 - Earliest claimed: 2010-05-28 - Assignees: Bromium, Inc. - Applicants: Gaurav Banga; Kiran Bondalapati; Ian Pratt; Vikram Kapoor - Inventors: Gaurav Banga; Kiran Bondalapati; Ian Pratt; Vikram Kapoor - Web page: https://patentgrep.com/patent/US8752047B2 ## CPC - G06F 9/45533: {Hypervisors; Virtual machine monitors} - G06F 9/45558: {Hypervisor-specific management and integration aspects} - G06F 9/5077: {Logical partitioning of resources; Management or configuration of virtualized resources (specific details on emulation or internal functioning of virtual machines G06F9/455)} - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - G06F 2009/45587: {Isolation or security of virtual machine instances} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Approaches for transferring data to a client by safely receiving the data in or more virtual machines. In response to the client determining that digital content, originating from an external source, is to be received or processed by the client, the client identifies, without human intervention, one or more virtual machines, executing or to be executed on the client, into which the digital content is to be stored. In doing so, the client may consult policy data to determine a placement policy, a containment policy, and a persistence policy for any virtual machine to receive the digital content. In this way, digital content, such as executable code or interpreted data, of unknown trustworthiness may be safely received by the client without the possibility of any malicious code therein from affecting any undesirable consequence upon the client. ## Claims ### Claim 1 A non-transitory computer readable storage medium storing one or more sequences of instructions, which when executed by one or more processors, causes: in response to a client determining that digital content, originating from an external source, is to be received or processed by the client, the client identifying, without human intervention, one or more virtual machines, executing or to be executed on the client, into which the digital content is to be stored; wherein identifying the one or more virtual machines comprises the client consulting policy data, stored at the client, to determine a placement policy, a containment policy, and a persistence policy used in identifying the one or more virtual machines; wherein the containment policy identifies what network resources and client resources the one or more virtual machines can access, and the persistence policy identifies whether data stored in the one or more virtual machines is persistently stored; and wherein the placement policy specifies that the digital content should be stored by a virtual machine that has not yet been instantiated, wherein the policy data identifies a template for use in instantiating the particular virtual machine, and wherein the template describes characteristics of a virtual machine suitable for executable code originating from the external source. ### Claim 2 (depends on 1) The non-transitory computer readable storage medium of claim 1, wherein the digital content comprises executable code or interpreted code. ### Claim 3 (depends on 1) The non-transitory computer readable storage medium of claim 1, wherein the digital content comprises non-executable, interpreted data. ### Claim 4 (depends on 1) The non-transitory computer readable storage medium of claim 1, wherein at least a portion of the policy data, used in identifying the one or more virtual machines, is obtained from a remote server after the client determines that the digital content is to be received or processed. ### Claim 5 (depends on 1) The non-transitory computer readable storage medium of claim 1, wherein one or more of the placement policy, the containment policy, and the persistence policy consider a historical record of use for the client in identifying the one or more virtual machines. ### Claim 6 (depends on 1) The non-transitory computer readable storage medium of claim 1, wherein one or more of the placement policy, the containment policy, and the persistence policy consider a current physical location of the client or to which networks the client currently has access in identifying the one or more virtual machines. ### Claim 7 (depends on 1) The non-transitory computer readable storage medium of claim 1, wherein the policy data specifies that the one or more virtual machines each can only access a limited subset of metadata properties of a client resource or a network resource. ### Claim 8 (depends on 1) The non-transitory computer readable storage medium of claim 1, wherein the placement policy identifies the particular virtual machine into which the digital content is to be stored by observing application dependencies. ### Claim 9 (depends on 1) The non-transitory computer readable storage medium claim 1, wherein the placement policy identifies a plurality of classes of virtual machines, wherein each class of the plurality of classes is associated with a different trust level for external sources of digital content, and wherein code executing in the particular virtual machine cannot access external sources associated with less trustworthy external sources of digital content. ### Claim 10 (depends on 1) The non-transitory computer readable storage medium of claim 1, wherein the external source is a web site and the digital content is a web page to be displayed in a new tab of a web browser executing in a first virtual machine on the client, and wherein the placement policy specifies that the digital content is to be stored by a second virtual machine separate from the first virtual machine, and wherein the second virtual machine should execute a copy of the web browser to display the web page in the new tab of the web browser. ### Claim 11 (depends on 1) The non-transitory computer readable storage medium of claim 1, wherein the containment policy considers one or more of the following factors: an identity of the user of the client, a set of properties of the digital content, a physical location of the client, the current time, a holiday schedule, and a set of administrator-specified policy rules. ### Claim 12 (depends on 1) The non-transitory computer readable storage medium of claim 1, wherein the containment policy specifies that code executing within the one or more virtual machines may access a first set of network resources and may not access a second set of network resources. ### Claim 13 (depends on 1) The non-transitory computer readable storage medium of claim 1, wherein the containment policy identifies each client resource accessible to each of the one or more virtual machines. ### Claim 14 (depends on 1) The non-transitory computer readable storage medium of claim 1, wherein the containment policy identifies whether code executing in the particular virtual machine can access a USB port on the client or a network to which the client is connected. ### Claim 15 (depends on 1) The non-transitory computer readable storage medium of claim 1, wherein the containment policy identifies whether code executing in the particular virtual machine can perform a copy operation or a paste operation. ### Claim 16 (depends on 1) The non-transitory computer readable storage medium of claim 1, wherein the containment policy identifies whether code executing in the particular virtual machine can access a GPS device of the client, location information for the client, or tilt information for the client. ### Claim 17 (depends on 1) The non-transitory computer readable storage medium of claim 1, wherein the containment policy identifies whether code executing in the particular virtual machine can access a printer or facsimile machine to which the client is connected or a digital camera or screen data for the client. ### Claim 18 (depends on 1) The non-transitory computer readable storage medium of claim 1, wherein the digital content is an attachment, and wherein the containment policy instructs that a particular virtual machine, in which the digital content is to be received, should not have access to any network accessible to the client. ### Claim 19 (depends on 1) The non-transitory computer readable storage medium of claim 1, wherein the digital content is executable code, and wherein execution of the one or more sequences of instructions further causes: upon the executable code requesting access to a user file, preventing the executable code from accessing the user file without obtaining a user's permission to allow the executable code to access the user file. ### Claim 20 (depends on 1) The non-transitory computer readable storage medium of claim 1, execution of the one or more sequences of instructions further causes: at a plurality of virtual machines executing at the client, generating visual content to be displayed by the client; and presenting the visual content generated from each of the plurality of virtual machines in a unified manner to present a single, cohesive presentation to a user of the client. ### Claim 21 A client, comprising: one or more processors; one or more storage mediums storing one or more sequences of instructions, which when executed by the one or more processors, causes: in response to the client determining that digital content, originating from an external source, is to be received or processed by the client, the client identifying, without human intervention, one or more virtual machines, executing or to be executed on the client, into which the digital content is to be stored; wherein identifying the one or more virtual machines comprises the client consulting policy data, stored at the client, to determine a placement policy, a containment policy, and a persistence policy used in identifying the one or more virtual machines; wherein the containment policy identifies what network resources and client resources the one or more virtual machines can access, and the persistence policy identifies whether data stored in the one or more virtual machines is persistently stored; and wherein the placement policy specifies that the digital content should be stored by a virtual machine that has not yet been instantiated, and wherein the policy data identifies a template for use in instantiating the particular virtual machine, and wherein the template describes characteristics of a virtual machine suitable for executable code originating from the external source. ### Claim 22 A method for transferring data to a client, comprising: in response to a client determining that digital content, originating from an external source, is to be received or processed by the client, the client identifying, without human intervention, one or more virtual machines, executing or to be executed on the client, into which the digital content is to be stored; wherein identifying the one or more virtual machines comprises the client consulting policy data, stored at the client, to determine a placement policy, a containment policy, and a persistence policy used in identifying the one or more virtual machines; wherein the containment policy identifies what network resources and client resources the one or more virtual machines can access, and the persistence policy identifies whether data stored in the one or more virtual machines is persistently stored; and wherein the placement policy specifies that the digital content should be stored by a virtual machine that has not yet been instantiated, and wherein the policy data identifies a template for use in instantiating the particular virtual machine, and wherein the template describes characteristics of a virtual machine suitable for executable code originating from the external source. ### Claim 23 A method for transferring data to a client, comprising: in response to the client determining that digital content, originating from an external source, is to be received or processed by the client, the client identifying, without human intervention, one or more virtual machines, executing or to be executed on the client, into which the digital content is to be stored; wherein identifying the one or more virtual machines comprises the client consulting policy data, stored at the client, to determine a placement policy, a containment policy, and a persistence policy used in identifying the one or more virtual machines; wherein the containment policy identifies what network resources and client resources the one or more virtual machines can access, and the persistence policy identifies whether data stored in the one or more virtual machines is persistently stored; wherein the placement policy identifies a plurality of classes of virtual machines, wherein each class of the plurality of classes is associated with a different trust level for external sources of digital content, and wherein code executing in the particular virtual machine cannot access external sources associated with less trustworthy external sources of digital content; and wherein the policy data further identifies, from the plurality of classes of virtual machines, a particular virtual machine into which the digital content is to be stored. ### Claim 24 A client, comprising: one or more processors; one or more storage mediums storing one or more sequences of instructions, which when executed by the one or more processors, causes: in response to the client determining that digital content, originating from an external source, is to be received or processed by the client, the client identifying, without human intervention, one or more virtual machines, executing or to be executed on the client, into which the digital content is to be stored; wherein identifying the one or more virtual machines comprises the client consulting policy data, stored at the client, to determine a placement policy, a containment policy, and a persistence policy used in identifying the one or more virtual machines; wherein the containment policy identifies what network resources and client resources the one or more virtual machines can access, and the persistence policy identifies whether data stored in the one or more virtual machines is persistently stored; wherein the placement policy identifies a plurality of classes of virtual machines, wherein each class of the plurality of classes is associated with a different trust level for external sources of digital content, and wherein code executing in the particular virtual machine cannot access external sources associated with less trustworthy external sources of digital content; and wherein the policy data further identifies, from the plurality of classes of virtual machines, a particular virtual machine into which the digital content is to be stored. ### Claim 25 A non-transitory computer readable storage medium storing one or more sequences of instructions, which when executed by one or more processors, causes: in response to a client determining that digital content, originating from an external source, is to be received or processed by the client, the client identifying, without human intervention, one or more virtual machines, executing or to be executed on the client, into which the digital content is to be stored; wherein identifying the one or more virtual machines comprises the client consulting policy data, stored at the client, to determine a placement policy, a containment policy, and a persistence policy used in identifying the one or more virtual machines; wherein the containment policy identifies what network resources and client resources the one or more virtual machines can access, and the persistence policy identifies whether data stored in the one or more virtual machines is persistently stored; wherein the placement policy identifies a plurality of classes of virtual machines, wherein each class of the plurality of classes is associated with a different trust level for external sources of digital content, and wherein code executing in the particular virtual machine cannot access external sources associated with less trustworthy external sources of digital content; and wherein the policy data further identifies, from the plurality of classes of virtual machines, a particular virtual machine into which the digital content is to be stored. ### Claim 26 (depends on 25) The non-transitory computer readable storage medium of claim 25, wherein one or more of the placement policy, the containment policy, and the persistence policy consider a current physical location of the client or to which networks the client currently has access in identifying the one or more virtual machines. ### Claim 27 (depends on 25) The non-transitory computer readable storage medium of claim 25, wherein the policy data specifies that the one or more virtual machines each can only access a limited subset of metadata properties of a client resource or a network resource. ### Claim 28 (depends on 25) The non-transitory computer readable storage medium of claim 25, wherein the placement policy identifies the particular virtual machine into which the digital content is to be stored by observing application dependencies. ### Claim 29 (depends on 25) The non-transitory computer readable storage medium of claim 25, wherein the external source is a web site and the digital content is a web page to be displayed in a new tab of a web browser executing in a first virtual machine on the client, and wherein the placement policy specifies that the digital content is to be stored by a second virtual machine separate from the first virtual machine, and wherein the second virtual machine should execute a copy of the web browser to display the web page in the new tab of the web browser. ### Claim 30 (depends on 25) The non-transitory computer readable storage medium of claim 25, wherein the containment policy considers one or more of the following factors: an identity of the user of the client, a set of properties of the digital content, a physical location of the client, the current time, a holiday schedule, and a set of administrator-specified policy rules. ### Claim 31 (depends on 25) The non-transitory computer readable storage medium of claim 25, wherein the containment policy specifies that code executing within the one or more virtual machines may access a first set of network resources and may not access a second set of network resources. ### Claim 32 (depends on 25) The non-transitory computer readable storage medium of claim 25, wherein the containment policy identifies whether code executing in the particular virtual machine can (a) access a USB port on the client, (b) access a network to which the client is connected, (c) perform a copy operation or a paste operation, (d) access a GPS device of the client, location information for the client, or tilt information for the client, or (e) access a printer or facsimile machine to which the client is connected or a digital camera or screen data for the client. ### Claim 33 (depends on 25) The non-transitory computer readable storage medium of claim 25, wherein the digital content is an attachment, and wherein the containment policy instructs that the particular virtual machine should not have access to any network accessible to the client. ### Claim 34 (depends on 25) The non-transitory computer readable storage medium of claim 25, wherein the digital content is executable code, and wherein execution of the one or more sequences of instructions further causes: upon the executable code requesting access to a user file, preventing the executable code from accessing the user file without obtaining a user's permission to allow the executable code to access the user file. ### Claim 35 (depends on 25) The non-transitory computer readable storage medium of claim 25, wherein execution of the one or more sequences of instructions further causes: at a plurality of virtual machines executing at the client, generating visual content to be displayed by the client; and presenting the visual content generated from each of the plurality of virtual machines in a unified manner to present a single, cohesive presentation to a user of the client.