# US 8,782,778 B2 · Rule-based application access management

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 8,782,778 B2
- Document ID: US8782778B2
- Status: Granted
- Kind: B2
- Application number: 13/594,041
- Filed: 2012-08-24
- Published: 2012-12-27
- Granted: 2014-07-15
- Earliest claimed: 2006-10-23
- Assignees: Numecent Holdings, Inc.
- Applicants: Arthur Shingen Hitomi; Robert Tran; Peter Joseph Kammer; Doug Pfiffner; Huy Nguyen
- Inventors: Arthur Shingen Hitomi; Robert Tran; Peter Joseph Kammer; Doug Pfiffner; Huy Nguyen
- Web page: https://patentgrep.com/patent/US8782778B2

## CPC

- H04L 63/10: {for controlling access to devices or network resources}
- G06F 9/468: {Specific access rights for resources, e.g. using capability register}
- G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database}
- H04L 41/0813: characterised by the conditions triggering a change of settings
- H04L 41/145: {involving simulating, designing, planning or modelling of a network}
- H04L 43/0823: Errors, e.g. transmission errors
- H04L 63/108: {when the policy decisions are valid for a limited amount of time}
- G06F 2221/2141: Access rights, e.g. capability lists, access control lists, access tables, access matrices
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A container that manages access to protected resources using rules to intelligently manage them includes an environment having a set of software and configurations that are to be managed. A rule engine, which executes the rules, may be called reactively when software accesses protected resources. The engine uses a combination of embedded and configurable rules. It may be desirable to assign and manage rules per process, per resource (e.g. file, registry, etc.), and per user. Access rules may be altitude-specific access rules.

## Claims

### Claim 1

A method comprising:
executing a first streaming software application in a first streaming software container including a first runtime environment;
setting a timer within the first streaming software container;
managing rule-based access to resources within the first streaming software container associated with executing the first streaming software application;
pausing the first streaming software application in the first streaming software container;
resetting the timer within the first streaming software container;
executing a second streaming software application in a second streaming software container including a second runtime environment;
receiving a request generated by a process associated with executing the second streaming software application to access a resource within the first streaming software container associated with executing the first streaming software application;
creating a virtual image of the resource within the first streaming software container associated with executing the first streaming software application;
determining whether the process associated with executing the second streaming software application has rule-based access to the resource within the first streaming software container associated with executing the first streaming software application;
if it is determined that the process associated with executing the second streaming software application has rule-based access to the requested resource, facilitating access to the resource within the first streaming software container by providing access to the virtual image of the resource;
resuming execution of the first streaming software application in the first streaming software container.

### Claim 2 (depends on 1)

The method of claim 1, further comprising managing rule-based access by the process associated with executing the second streaming software application to resources within the first streaming software container associated with executing the first streaming software application.

### Claim 3 (depends on 1)

The method of claim 1, wherein the resource and rules for determining whether rule-based access to the resource exists are generated within the first streaming software container during execution of the first streaming software application.

### Claim 4 (depends on 1)

The method of claim 1, wherein the request is received by intercepting the request using a file system hook.

### Claim 5 (depends on 1)

The method of claim 1, wherein rules for determining whether rule-based access to the resource exists are created on a per process basis.

### Claim 6 (depends on 1)

The method of claim 1, wherein rules for determining whether rule-based access to the resource exists are created on a per resource basis.

### Claim 7 (depends on 1)

The method of claim 1, wherein rules for determining whether rule-based access to the resource exists specify that the process associated with executing the second streaming software application has read-only access to the resource.

### Claim 8 (depends on 1)

The method of claim 1, wherein the first streaming software container is the second streaming software container.

### Claim 9 (depends on 1)

The method of claim 1, wherein the second streaming software application is executed concurrently with the resuming of execution of the first streaming software application.

### Claim 10 (depends on 1)

The method of claim 1, wherein the second streaming software application is executed after an occurrence of a trigger.

### Claim 11 (depends on 10)

The method of claim 10, wherein the trigger is a command to begin execution of the second streaming software application.

### Claim 12 (depends on 10)

The method of claim 10, wherein the trigger is an expiration of the timer within the first streaming software container.

### Claim 13

A system comprising:
at least one processor;
memory storing instructions configured to instruct the at least one processor to perform:
executing a first streaming software application in a first streaming software container including a first runtime environment;
setting a timer within the first streaming software container;
managing rule-based access to resources within the first streaming software container associated with executing the first streaming software application;
pausing the first streaming software application in the first streaming software container;
resetting the timer within the first streaming software container;
executing a second streaming software application in a second streaming software container including a second runtime environment;
receiving a request generated by a process associated with executing the second streaming software application to access a resource within the first streaming software container associated with executing the first streaming software application;
creating a virtual image of the resource within the first streaming software container associated with executing the first streaming software application;
determining whether the process associated with executing the second streaming software application has rule-based access to the resource within the first streaming software container associated with executing the first streaming software application;
if it is determined that the process associated with executing the second streaming software application has rule-based access to the requested resource, facilitating access to the resource within the first streaming software container by providing access to the virtual image of the resource;
resuming execution of the first streaming software application in the first streaming software container.

### Claim 14 (depends on 13)

The system of claim 13, wherein the first streaming software container is the second streaming software container.