# US 8,752,128 B2 · Rule-based application access management > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,752,128 B2 - Document ID: US8752128B2 - Status: Granted - Kind: B2 - Application number: 13/594,546 - Filed: 2012-08-24 - Published: 2012-12-20 - Granted: 2014-06-10 - Earliest claimed: 2006-10-23 - Assignees: Numecent Holdings, Inc. - Applicants: Arthur Shingen Hitomi; Robert Tran; Peter Joseph Kammer; Doug Pfiffner; Huy Nguyen - Inventors: Arthur Shingen Hitomi; Robert Tran; Peter Joseph Kammer; Doug Pfiffner; Huy Nguyen - Web page: https://patentgrep.com/patent/US8752128B2 ## CPC - H04L 63/10: {for controlling access to devices or network resources} - G06F 9/468: {Specific access rights for resources, e.g. using capability register} - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - H04L 41/0813: characterised by the conditions triggering a change of settings - H04L 41/145: {involving simulating, designing, planning or modelling of a network} - H04L 43/0823: Errors, e.g. transmission errors - H04L 63/108: {when the policy decisions are valid for a limited amount of time} - G06F 2221/2141: Access rights, e.g. capability lists, access control lists, access tables, access matrices - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A container that manages access to protected resources using rules to intelligently manage them includes an environment having a set of software and configurations that are to be managed. A rule engine, which executes the rules, may be called reactively when software accesses protected resources. The engine uses a combination of embedded and configurable rules. It may be desirable to assign and manage rules per process, per resource (e.g. file, registry, etc.), and per user. Access rules may be altitude-specific access rules. ## Claims ### Claim 1 A method comprising: displaying resources; providing altitude stored in a table for a set of the resources; providing access control rules stored in the table for the set of resources at the altitude; providing a file object and a path in a table entry of the table associated with a resource of the set of resources, wherein the table entry further includes the altitude and an access control rule of the access control rules; receiving at runtime a request for the resource from an application having a process ID; determining whether the process ID is associated with the file object and the path; if it is determined that the process ID is associated with the file object and the path: populating a runtime table with the altitude, the access control rule, and the process ID; if it is determined that the process ID is not associated with the file object and the path: setting the access control rule to a Pass Through access control rule; populating the runtime table with the altitude, the Pass Through access control rule, and the process ID; providing security settings for the set of resources at the altitude. ### Claim 2 (depends on 1) The method of claim 1, wherein the resources include files and registry keys, further comprising: determining a current altitude, wherein the current altitude is represented as a whole number; setting up selective hooks for files at the current altitude in accordance with the altitude for files of the set of resources where the altitude equals the current altitude, while the current altitude is greater than zero. ### Claim 3 (depends on 2) The method of claim 2, further comprising, while the current altitude is greater than zero, setting up registry hooks for registry keys at the current altitude in accordance with the altitude for registry keys of the set of resources where the altitude equals the current altitude. ### Claim 4 (depends on 2) The method of claim 2, further comprising, while the current altitude is greater than zero, simulating an environment at the current altitude. ### Claim 5 (depends on 2) The method of claim 2, further comprising, while the current altitude is greater than zero, decrementing the current altitude. ### Claim 6 (depends on 1) The method of claim 1, further comprising, when the altitude is zero: writing files to a system; changing a registry of the system; updating environment variables of the system. ### Claim 7 (depends on 1) The method of claim 1, further comprising: initiating a request in association with a process ID for a resource having a resource ID at a first altitude; looking up the process ID and the resource ID in a requestor-specific access control table for the first altitude to determine access control. ### Claim 8 (depends on 7) The method of claim 7, further comprising: looking up the resource ID in a resource-specific access control table for the first altitude to determine file access type; granting access of the file access type to the resource at the first altitude if the access control is Accept. ### Claim 9 (depends on 7) The method of claim 7, further comprising executing an altitude-specific procedure if the access control is Pause. ### Claim 10 (depends on 7) The method of claim 7, further comprising: decrementing the first altitude, yielding a second altitude; looking up the process ID and the resource ID in a requestor-specific access control table for the second altitude to determine access control if the second altitude is greater than zero; granting access at altitude zero if the second altitude is zero. ### Claim 11 (depends on 7) The method of claim 7, further comprising denying the request if the access control is Deny. ### Claim 12 A system comprising: at least one processor; memory storing instructions configured to instruct the at least one processor to perform: displaying resources; providing altitude stored in a table for a set of the resources; providing access control rules stored in the table for the set of resources at the altitude; providing a file object and a path in a table entry of the table associated with a resource of the set of resources, wherein the table entry further includes the altitude and an access control rule of the access control rules; receiving at runtime a request for the resource from an application having a process ID; determining whether the process ID is associated with the file object and the path; if it is determined that the process ID is associated with the file object and the path: populating a runtime table with the altitude, the access control rule, and the process ID; if it is determined that the process ID is not associated with the file object and the path: setting the access control rule to a Pass Through access control rule; populating the runtime table with the altitude, the Pass Through access control rule, and the process ID; providing security settings for the set of resources at the altitude. ### Claim 13 (depends on 12) The system of claim 12, wherein the resources include files and registry keys, further comprising: determining a current altitude, wherein the current altitude is represented as a whole number; setting up selective hooks for files at the current altitude in accordance with the altitude for files of the set of resources where the altitude equals the current altitude, while the current altitude is greater than zero. ### Claim 14 (depends on 13) The system of claim 13, wherein the instructions are further configured to instruct the at least one processor to perform, while the current altitude is greater than zero, setting up registry hooks for registry keys at the current altitude in accordance with the altitude for registry keys of the set of resources where the altitude equals the current altitude. ### Claim 15 (depends on 13) The system of claim 13, wherein the instructions are further configured to instruct the at least one processor to perform, while the current altitude is greater than zero, simulating an environment at the current altitude. ### Claim 16 (depends on 13) The system of claim 13, wherein the instructions are further configured to instruct the at least one processor to perform, while the current altitude is greater than zero, decrementing the current altitude. ### Claim 17 (depends on 12) The system of claim 12, wherein the instructions are further configured to instruct the at least one processor to perform, when the altitude is zero: writing files to a system; changing a registry of the system; updating environment variables of the system. ### Claim 18 (depends on 12) The system of claim 12, wherein the instructions are further configured to instruct the at least one processor to perform: initiating a request in association with a process ID for a resource having a resource ID at a first altitude; looking up the process ID and the resource ID in a requestor-specific access control table for the first altitude to determine access control. ### Claim 19 (depends on 18) The system of claim 18, wherein the instructions are further configured to instruct the at least one processor to perform: looking up the resource ID in a resource-specific access control table for the first altitude to determine file access type; granting access of the file access type to the resource at the first altitude if the access control is Accept. ### Claim 20 (depends on 18) The system of claim 18, wherein the instructions are further configured to instruct the at least one processor to perform executing an altitude-specific procedure if the access control is Pause. ### Claim 21 (depends on 18) The system of claim 18, wherein the instructions are further configured to instruct the at least one processor to perform: decrementing the first altitude, yielding a second altitude; looking up the process ID and the resource ID in a requestor-specific access control table for the second altitude to determine access control if the second altitude is greater than zero; granting access at altitude zero if the second altitude is zero. ### Claim 22 (depends on 18) The system of claim 18, wherein the instructions are further configured to instruct the at least one processor to perform denying the request if the access control is Deny. ### Claim 23 A system comprising a processor, further comprising: means for displaying resources; means for providing altitude stored in a table for a set of the resources; means for providing access control rules stored in the table for the set of resources at the altitude; means for providing a file object and a path in a table entry of the table associated with a resource of the set of resources, wherein the table entry further includes the altitude and an access control rule of the access control rules; means for receiving at runtime a request for the resource from an application having a process ID; means for determining whether the process ID is associated with the file object and the path; means for populating a runtime table with the altitude, the access control rule, and the process ID if it is determined that the process ID is associated with the file object and the path; means for setting the access control rule to a Pass Through access control rule if it is determined that the process ID is not associated with the file object and the path; means for populating the runtime table with the altitude, the Pass Through access control rule, and the process ID if it is determined that the process ID is not associated with the file object and the path; means for providing security settings for the set of resources at the altitude.