# US 8,789,159 B2 · System for running potentially malicious code > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,789,159 B2 - Document ID: US8789159B2 - Status: Granted - Kind: B2 - Application number: 12/029,168 - Filed: 2008-02-11 - Published: 2009-08-13 - Granted: 2014-07-22 - Earliest claimed: 2008-02-11 - Assignees: Microsoft Corporation - Applicants: S. Franklin Williams; Kiran Akella Venkata; David C. LeBlanc; Juraj Gottweis; Gareth A. Howell; Scott A. Field; Ramesh Chinta - Inventors: S. Franklin Williams; Kiran Akella Venkata; David C. LeBlanc; Juraj Gottweis; Gareth A. Howell; Scott A. Field; Ramesh Chinta - Web page: https://patentgrep.com/patent/US8789159B2 ## CPC - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Systems and methods for creating a secure process on a web server can include creating an application manager process, and creating an application host process, the application host process being created under control of the application manager process. Example methods can also include restricting attributes of the application host process, and assigning a unique logon identifier to the application host process so that the application host process can only communicate with the application manager process. ## Claims ### Claim 1 A method for creating a secure process on a web server, the method comprising: creating an application manager process, the application manager process obtaining a first file handle for a file; creating a second file handle for the file, the second file handle being a duplicate of the first file handle, the second file handle having restricted access to memory of the web server; creating a plurality of application host processes, each of the plurality of the application host processes being created under control of the application manager process; providing the second file handle to an application host process, wherein file data is written to the second file handle; running one or more legacy applications on one or more of the application host processes, each of the one or more legacy applications running in a separate application host process; restricting privileges and groups of the application host processes so that privileges and groups of each application host process are different than privileges and groups of the one or more legacy applications running on the application host processes; and assigning a unique logon identifier to each application host process so that each application host process can only communicate with the application manager process. ### Claim 2 (depends on 1) The method of claim 1, further comprising creating each application host process with a restricted access token. ### Claim 3 (depends on 2) The method of claim 2, further comprising restricting attributes of each application host process using a job object. ### Claim 4 (depends on 3) The method of claim 3, further comprising assigning the unique logon identifier to each application host process via a logon function. ### Claim 5 (depends on 1) The method of claim 1, further comprising assigning the unique logon identifier to each application host process via a logon function. ### Claim 6 A method for servicing a request on a server to render a document from a file, the method comprising: receiving a request for the file; processing the request for the file using an application manager process, the application manager process obtaining a first file handle for the file; creating a second file handle for the file, the second file handle being a duplicate of the first file handle, the second file handle having restricted access to memory of the server; providing the second file handle to an application host process, wherein file data is written to the second file handle; activating the application host process from a pool of available processes, the activation of the application host process being controlled by the application manager process, running one or more legacy applications on one or more of the application host processes, each of the one or more legacy applications running in a separate application host process, the available processes in the pool of available processes having each been created with a unique logon identifier, the unique logon identifier permitting the application host process to communicate only with the application manager process; executing an application using the application host process to render the document from the requested file, the one or more legacy applications running in the application host process; monitoring the application host process using the application manager process; detecting when the application host process has abnormally terminated; and activating a new application host process when an abnormal termination is detected. ### Claim 7 (depends on 6) The method of claim 6, further comprising terminating the application host process when the application host process remains active for longer than a specified period. ### Claim 8 (depends on 6) The method of claim 6, further comprising: sending a message from the application manager process to the application host process at predetermined time intervals; and verifying that a response is sent from the application host process to the application manager process for each message sent. ### Claim 9 (depends on 8) The method of claim 8, further comprising terminating the application host process if the response to the message is not received within a predetermined time. ### Claim 10 (depends on 6) The method of claim 6, further comprising monitoring resources in the application host process. ### Claim 11 (depends on 10) The method of claim 10, wherein monitoring resources further comprises selecting the resources from a group consisting of memory usage, input file size, individual file output size, and total file size of all output files. ### Claim 12 (depends on 11) The method of claim 11, further comprising terminating the application host process if a resource exceeds a predetermined value. ### Claim 13 (depends on 6) The method of claim 6, further comprising terminating the application host process if the application host process attempts to launch another process not contained on a process list. ### Claim 14 (depends on 6) The method of claim 6, further comprising terminating the application host process after the application host process has been used to render a predetermined number of documents. ### Claim 15 (depends on 6) The method of claim 6, further comprising preventing the application host process from performing operations from the group consisting of accessing a network and writing to a server registry. ### Claim 16 A system for running application code on a web server, the system comprising: a plurality of application host processes; and an application manager process, the application manager process obtaining a first file handle for a file, creating a second file handle for the file, the second file handle being a duplicate of the first file handle, the second file handle having restricted access to memory of the web server, the application manager process further comprising: an application host process creation module programmed to create a pool of application host processes and to activate an application host process when required, providing the second file handle to the application host process, wherein file data is written to the second file handle, running one or more legacy applications on one or more of the application host processes, each of the one or more legacy applications running in a separate application host process, the application host process creation module configured to restrict inter-process communication for the pool of application host processes, each application host process in the pool of application host processes prevented from communicating with any other application host process in the pool of application host processes; an application host process monitor module programmed to monitor attributes of the application host processes and terminate a first application host process when attributes of the first application host process exceed a predetermined limit and activate a new application host process when the first application host process is terminated; and a data marshal module programmed to marshal data between the file and an application host process, the data marshal module marshaling data via a file handle, the file handle having restricted access to the memory and disk of the web server; wherein each of the plurality of application host processes has a unique logon identifier, the unique logon identifier permitting an application host process to communicate only with the application manager process.