Back to results
US 9,177,237 B2Granted
Computer device and method for isolating untrusted content
AssigneeAvecto Limited
InventorsMark Austin, John Goodridge
Life of this patent
Estimating the term…
Abstract
A computer system and method are provided to intercept a task from a primary user account 121 prior to execution of the task by the computer device 200, where the task relates to an untrusted content. A task isolation environment 350 is provisioned for executing the task, including programmatically creating a secondary user account 121b on the computer device. A local printer and/or a network printer which are connected to the primary user account 121 are discovered and automatically provisioned in the secondary user account 121b. Access to the or each printer 500 is controlled by an agent 300 on the computer device 200.
Claims20
A method for isolating untrusted content on a computer device, the method comprising:
- intercepting a task from a primary user account prior to execution of the task by the computer device, wherein the task relates to an untrusted content;
- provisioning a task isolation environment for executing the task, including (i) programmatically creating a secondary user account on the computer device, (ii) determining a printer which is available in the primary user account, and (iii) making the printer available in the secondary user account by populating printer-related user settings in the secondary user account;
- executing the task in the task isolation environment in relation to the untrusted content;
- intercepting, by an agent, a printer service request by the task in the secondary user account in relation to the printer;
- determining, by the agent, whether to allow or deny the printer service request by the task of the secondary user account in relation to the printer;
- providing impersonated credentials of the primary user account by the agent when the printer service request is allowed and allowing the printer service request to proceed using the impersonated credentials;
- and
- performing a printer related function by the task operating in the task isolation environment to obtain and display a list of connected printers available to the secondary user account, wherein the list of printers is a subset of a list of printers available in the primary user account.
5 more elements
A computer device, comprising:
- a hardware layer including at least a processor and a memory;
- an operating system which performs tasks using the hardware layer;
- a user process operating in a primary user account controlled by the operating system and configured to request a task to be actioned by the operating system, wherein the primary user account comprises a network drive which is mapped into the primary user account;
- an agent configured to execute in cooperation with the operating system, wherein the agent is configured to:
- intercept the task before being actioned by the operating system and provide task metadata relevant to the intercepted task;
- examine the task metadata and selectively output a policy result identifying the task as being an untrusted task;
- provision a task isolation environment by (i) programmatically creating a secondary user account on the computer device, (ii) determining a printer which is available in the primary user account, and (iii) making the printer available in the secondary user account by populating printer-related user settings in the secondary user account;
- and
- cause the untrusted task to be executed as an isolated process in the task isolation environment provided by the secondary user account,
- wherein the task operating in the task isolation environment is arranged to perform a printer related function by obtaining and displaying a list of connected printers available to the secondary user account, wherein the list of printers is a subset of a list of printers available in the primary user account.
7 more elements
A computer readable non-transitory storage medium having recorded thereon instructions which, when implemented by a computer device, perform the steps of:
- intercepting a task from a primary user account prior to execution of the task by the computer device, wherein the task relates to an untrusted content;
- provisioning a task isolation environment for executing the task, including (i) programmatically creating a secondary user account on the computer device, (ii) determining a printer which is available in the primary user account, and (iii) making the printer available in the secondary user account by populating printer-related user settings in the secondary user account;
- executing the task in the task isolation environment in relation to the untrusted content;
- intercepting, by an agent, a printer service request by the task in the secondary user account in relation to the printer;
- determining, by the agent, whether to allow or deny the printer service request by the task of the secondary user account in relation to the printer;
- providing impersonated credentials of the primary user account by the agent when the printer service request is allowed and allowing the printer service request to proceed using the impersonated credentials;
- and
- performing a printer related function b the task operating in the task isolation environment to obtain and display a list of connected printers available to the secondary user account, wherein the list of printers is a subset of a list of printers available in the primary user account.
5 more elements
Dependencies are inferred from the claim text.