# US 8,789,138 B2 · Application execution in a restricted application execution environment > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,789,138 B2 - Document ID: US8789138B2 - Status: Granted - Kind: B2 - Application number: 12/978,664 - Filed: 2010-12-27 - Published: 2012-06-28 - Granted: 2014-07-22 - Earliest claimed: 2010-12-27 - Assignees: Microsoft Corporation - Applicants: Kristofer Hellick Reierson; Angela Mele Anderson - Inventors: Kristofer Hellick Reierson; Angela Mele Anderson - Web page: https://patentgrep.com/patent/US8789138B2 ## CPC - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - G06F 9/468: {Specific access rights for resources, e.g. using capability register} - G06F 9/541: {via adapters, e.g. between incompatible applications} - G06F 9/545: {where tasks reside in different layers, e.g. user- and kernel-space} - G06F 2209/542: Intercept - G06F 2221/2141: Access rights, e.g. capability lists, access control lists, access tables, access matrices - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Application programming interface (API) calls made by an application are intercepted at runtime. A determination is made as to whether each intercepted API call is allowed or blocked by a restricted application execution environment. Each API call that is blocked by the restricted application execution environment is modified so that the API call is allowable such as, for instance, modifying the API call to execute against a shadow resource. Remediation code might also be executed at runtime to reformat the API call so that it is allowed to execute in the restricted application execution environment. ## Claims ### Claim 1 A computer-implemented method comprising performing computer-implemented operations for: intercepting an application programming interface (API) call made by an application external to a restricted application execution environment before the API call is to be executed within the restricted application execution environment, wherein the API call is directed toward a secure resource; determining if the intercepted API call is blocked by the restricted application execution environment; in response to determining that the intercepted API call is blocked by the restricted application execution environment, modifying the blocked API call before the blocked API call is executed within the restricted application execution environment; creating a shadow resource within the restricted application execution environment; and causing the modified API call to be executed against the shadow resource within the restricted application execution environment, wherein the shadow resource comprises a version of the secure resource. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, wherein the modifying the blocked API call before the blocked API is executed within the restricted application execution environment further comprises: executing remediation code to reformat the blocked API call before it is executed within the restricted application execution environment; and executing the reformatted API call within the restricted application execution environment. ### Claim 3 (depends on 1) The computer-implemented method of claim 1, wherein determining if the intercepted API call is blocked by the restricted application execution environment further comprises determining whether the intercepted API call is described in a runtime remediation database. ### Claim 4 (depends on 3) The computer-implemented method of claim 3, wherein the runtime remediation database comprises a database storing data identifying API calls that are blocked by the restricted application execution environment. ### Claim 5 (depends on 4) The computer-implemented method of claim 4, wherein the runtime remediation database is generated by: intercepting API calls made by the external application before the API calls are to be executed within the restricted application execution environment; determining whether the API calls made by the external application are blocked from execution within the restricted application execution environment; and for each API call blocked from execution within the restricted application execution environment, storing data in the runtime remediation database that identifies the blocked API call. ### Claim 6 (depends on 5) The computer-implemented method of claim 5, wherein determining whether the API calls made by the external application are blocked from execution within the restricted application execution environment comprises determining whether the API calls are identified in a security rules database. ### Claim 7 (depends on 6) The computer-implemented method of claim 6, wherein the security rules database comprises a database storing data indicating whether API calls are allowed to execute within the restricted application execution environment. ### Claim 8 (depends on 4) The computer-implemented method of claim 4, wherein the runtime remediation database is generated by performing a static analysis on the external application to identify API calls that are blocked from execution within the restricted application execution environment. ### Claim 9 (depends on 1) The computer-implemented method of claim 1, wherein the restricted application execution environment comprises an operating system that restricts the use of legacy APIs. ### Claim 10 A computer-readable storage medium having computer-executable instructions stored thereupon which, when executed by a computer, cause the computer to: intercept an application programming interface (API) call made by an application external to a restricted application execution environment before the API call is to be executed within the restricted application execution environment, wherein the API call is directed toward a secure resource; determine if the intercepted API call is blocked by the restricted application execution environment; in response to determining that the intercepted API call is blocked by the restricted application execution environment, modify the blocked API call before the blocked API call is executed within the restricted application execution environment; create a shadow resource within the restricted application execution environment; and cause the modified API call to be executed against the shadow resource within the restricted application execution environment, wherein the shadow resource comprises a version of the secure resource. ### Claim 11 (depends on 10) The computer-readable storage medium of claim 10, wherein modifying the blocked API call before the blocked API call is executed within the restricted application execution environment further comprises executing remediation code to reformat the blocked API call before the blocked API call is executed within the restricted application execution environment. ### Claim 12 (depends on 10) The computer-readable storage medium of claim 10, wherein determining if the intercepted API call is blocked for execution within the restricted application execution environment further comprises determining whether the API call is described in a database that stores data identifying API calls that are blocked from execution within the restricted application execution environment. ### Claim 13 (depends on 12) The computer-readable storage medium of claim 12, wherein the database is generated by: intercepting API calls made by the external application before the API calls are to be executed within the restricted application execution environment; determining whether the API calls made by the external application are blocked from execution within the restricted application execution environment; and for each API call blocked from execution within the restricted application execution environment, storing data in the database that identifies the blocked API call. ### Claim 14 A computer-readable storage medium having computer-executable instructions stored thereupon which, when executed by a computer, cause the computer to: provide a learning mode of operation in which application programming interface (API) calls made by an application external to a restricted application execution environment are intercepted before the API calls are executed within the restricted application execution environment and in which data are stored in a database for each intercepted API call, wherein the API calls are directed toward a secure resource; and at a runtime of the external application, intercept an API call made by the external application before the API call is to be executed within the restricted application execution environment, utilize the database to determine if the intercepted API call is blocked by the restricted application execution environment, in response to determining that the intercepted API call is blocked by the restricted application execution environment, modify the blocked API call before it is executed within the restricted application execution environment, create a shadow resource comprising a version of the secure resource that is accessible to the modified API call within the restricted application execution environment, and cause the modified API call to be executed against the shadow resource. ### Claim 15 (depends on 14) The computer-readable storage medium of claim 14, wherein modifying the blocked API call before the blocked API call is executed within the restricted application execution environment further comprises: executing remediation code to reformat the blocked API call for execution within the restricted application execution environment; and executing the reformatted API call. ### Claim 16 A system comprising: a processor; and a computer-readable storage medium in communication with the processor, the computer-readable storage medium having executable instructions stored thereupon which, when executed by the processor, cause the processor to intercept an application programming interface (API) call made by an application external to a restricted application execution environment before the API call is to be executed within the restricted application execution environment, wherein the API call is directed toward a secure resource, determine if the intercepted API call is blocked by the restricted application execution environment, in response to determining that the intercepted API call is blocked by the restricted application execution environment, modify the blocked API call before the blocked API call is executed within the restricted application execution environment, create a shadow resource within the restricted application execution environment, and cause the modified API call to be executed against the shadow resource within the restricted application execution environment, wherein the shadow resource comprises a version of the secure resource. ### Claim 17 (depends on 16) The system of claim 16, wherein modify the blocked API call before the blocked API is executed within the restricted application execution environment further comprises: executing remediation code to reformat the blocked API call before it is executed within the restricted application execution environment; and executing the reformatted API call within the restricted application execution environment. ### Claim 18 (depends on 16) The system of claim 16, wherein determine if the intercepted API call is blocked by the restricted application execution environment further comprises determining whether the intercepted API call is described in a runtime remediation database. ### Claim 19 (depends on 18) The system of claim 18, wherein the runtime remediation database comprises a database storing data identifying API calls that are blocked by the restricted application execution environment. ### Claim 20 (depends on 19) The system of claim 19, wherein the runtime remediation database is generated by: intercepting API calls made by the external application before the API calls are to be executed within the restricted application execution environment; determining whether the API calls made by the external application are blocked from execution within the restricted application execution environment; and for each API call blocked from execution within the restricted application execution environment, storing data in the runtime remediation database that identifies the blocked API call. ### Claim 21 (depends on 20) The system of claim 20, wherein determining whether the API calls made by the external application are blocked from execution within the restricted application execution environment comprises determining whether the API calls are identified in a security rules database. ### Claim 22 (depends on 21) The system of claim 21, wherein the security rules database comprises a database storing data indicating whether API calls are allowed to execute within the restricted application execution environment. ### Claim 23 (depends on 19) The system of claim 19, wherein the runtime remediation database is generated by performing a static analysis on the external application to identify API calls that are blocked from execution within the restricted application execution environment. ### Claim 24 (depends on 16) The system of claim 16, wherein the restricted application execution environment comprises an operating system that restricts the use of legacy APIs.