# US 8,782,797 B2 · Lockbox for mitigating same origin policy failures > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,782,797 B2 - Document ID: US8782797B2 - Status: Granted - Kind: B2 - Application number: 12/175,264 - Filed: 2008-07-17 - Published: 2010-01-21 - Granted: 2014-07-15 - Earliest claimed: 2008-07-17 - Assignees: Microsoft Corporation - Applicants: Jiahe Helen Wang; Xiaofeng Fan; Shuo Chen - Inventors: Jiahe Helen Wang; Xiaofeng Fan; Shuo Chen - Web page: https://patentgrep.com/patent/US8782797B2 ## CPC - G06F 21/55: Detecting local intrusion or implementing counter-measures - H04L 63/1416: {Event detection, e.g. attack signature detection} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Systems and methods to manage same-origin-policy (SOP) failures that occur in a computing environment are provided. In an illustrative implementation, an exemplary computing environment comprises a lockbox module, and an instruction set comprising at least one instruction directing the lockbox module to process data and/or computing application execution commands representative of and a request for a selected operation/feature according to a selected SOP management paradigm. In the illustrative implementation, the SOP management paradigm comprises one or more instructions to deploy a “lockbox” computing application element allowing for the management, monitoring, and control of computing application features/operations operable under a same origin policy. ## Claims ### Claim 1 A system configured to facilitate mitigating security policy failures in a computing environment, the system comprising: a processing unit; a lockbox module configured to process one or more requests for at least one of data or an application feature; an instruction set comprising at least one instruction configured to instruct the lockbox module to: generate a lockbox computing application element that contains the at least one of the data or the application feature, the lockbox computing application element being configured to associate security privileges to selected content, and process the at least one of the data or the application feature contained in the lockbox computing application element to determine whether the at least one of the data or the application feature is associated with the lockbox computing application element according to a selected same-origin-policy (SOP) management paradigm, wherein the selected SOP management paradigm comprises at least one other instruction configured to associate the at least one of the data or the application feature with a plurality of nested lockboxes including at least an inner lockbox having a first associated security privilege and an outer lockbox having a second associated security privilege; and a computer-readable storage medium storing instructions that, when executed by the processing unit, cause the processing unit to implement the lockbox module. ### Claim 2 (depends on 1) The system as recited in claim 1, wherein the inner lockbox is accessible by the outer lockbox. ### Claim 3 (depends on 2) The system as recited in claim 2, wherein: the at least one of the data or the application feature is included in the inner lockbox, and the at least one instruction is configured to instruct the lockbox module to allow access to the at least one of the data or the application feature by a requesting entity when a source of the one or more requests is provided by a document object model (DOM) tree of the inner lockbox. ### Claim 4 (depends on 3) The system as recited in claim 3, wherein the DOM tree is a hyper text mark-up language (HTML) document object tree. ### Claim 5 (depends on 3) The system as recited in claim 3, wherein the at least one of the data or the application feature is associated with the inner lockbox as a principal of a domain that deploys the inner lockbox. ### Claim 6 (depends on 1) The system as recited in claim 1, wherein the lockbox module is configured to attach a source universal resource locator (URL) associated with the inner lockbox as a hypertext transfer protocol (HTTP) header comprising a portion of an out-going HTTP request. ### Claim 7 (depends on 6) The system as recited in claim 6, wherein the HTTP header is unique. ### Claim 8 (depends on 7) The system as recited in claim 7, wherein the lockbox module is configured to deploy a personal image based at least on asserting authenticity of individual contents contained in the inner lockbox. ### Claim 9 (depends on 8) The system as recited in claim 8, wherein the personal image is configured to be displayed via one or more cooperating computing environments and is configured to be used by the lockbox module in determining at least some of the selected content to release from the lockbox. ### Claim 10 (depends on 1) The system as recited in claim 1, wherein the at least one of the data or the application feature is contained in the lockbox computing application element according to a selected tag. ### Claim 11 A method performed by executing instructions with at least one processing unit, the method comprising: creating a lockbox computing application element that associates security privileges with data or an application feature contained in the lockbox computing application element, the lockbox computing application element being associated with a plurality of nested lockboxes including at least: an inner lockbox that includes the data or the application feature and has a first associated security privilege, and an outer lockbox that includes the inner lockbox and has a second associated security privilege; receiving a request for the data or the application feature that is contained in the lockbox computing application element; identifying a source of the request; making a determination whether the source is an approved source to which the lockbox computing application element is configured to provide access; and selectively providing access to the data or the application feature based on the determination. ### Claim 12 (depends on 11) The method as recited in claim 11, further comprising associating the inner lockbox with a selected document object model tree. ### Claim 13 (depends on 12) The method as recited in claim 12, further comprising determining whether the source of the request is part of a domain tree that contains the inner lockbox. ### Claim 14 (depends on 13) The method as recited in claim 13, further comprising providing an error to the source when the determination is that the source is not approved. ### Claim 15 (depends on 11) The method as recited in claim 11, wherein the determination is based on whether the source of the request has the first associated security privilege. ### Claim 16 (depends on 15) The method as recited in claim 15, wherein the determination is also based on whether the source of the request has the second associated security privilege. ### Claim 17 (depends on 16) The method as recited in claim 16, wherein the selectively providing comprises providing the access when the determination indicates that the source of the request has both the first associated security privilege and the second associated security privilege. ### Claim 18 (depends on 16) The method as recited in claim 16, wherein the selectively providing comprises denying the access when the determination indicates that the source of the request does not have both the first associated security privilege and the second associated security privilege. ### Claim 19 (depends on 18) The method as recited in claim 18, wherein the lockbox computing application element is a hypertext markup language (HTML) element of an HTML document. ### Claim 20 One or more hardware computer storage media storing computer executable instructions that, when executed by a computing device, cause the computing device to perform operations comprising: creating a lockbox computing application element that associates a first security privilege and a second security privilege with data or an application feature, the lockbox computing application element identifying nested lockboxes including at least: an inner lockbox that contains the data or the application feature and associates the first security privilege with the data or the application feature, and an outer lockbox that contains the inner lockbox and associates the second security privilege with the data or the application feature; receiving a request for the data or the application feature that is contained in the inner lockbox identified by the lockbox computing application element; identifying a source of the request; determining that the source of the request is approved to access the data or the application feature in accordance with both the first security privilege and the second security privilege; and responsive to the determining, providing the data or the application feature to the source of the request.