# US 9,436,838 B2 · Secure local web application data manager > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,436,838 B2 - Document ID: US9436838B2 - Status: Granted - Kind: B2 - Application number: 13/721,912 - Filed: 2012-12-20 - Published: 2014-06-26 - Granted: 2016-09-06 - Earliest claimed: 2012-12-20 - Assignees: Intel Corporation - Applicants: Intel Corporation - Inventors: Hong C. Li; Mark D. Boucher; Conor P. Cahill; Manohar R. Castelino; Steve Orrin; Vinay Phegade; John E. Simpson, Jr. - Web page: https://patentgrep.com/patent/US9436838B2 ## CPC - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - G06F 21/602: {Providing cryptographic facilities or services} - G06F 21/62: Protecting access to data via a platform, e.g. using keys or access control rules - H04L 63/107: {wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals} - G06F 2221/2111: Location-sensitive, e.g. geographical location, GPS - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Apparatus, systems and methods may provide a browser interface to detect an attempt by web content to manipulate data in a local data store. In addition, the data may be classified into a category if the data is remotely accessible. Additionally, a security policy may be applied to the data based on the category. In one example, a separator may separate the data from other data based on the category, the data may be encrypted/decrypted based on the category, and/or context information and user input may be determined to apply the security policy further based on the context information and the user input. ## Claims ### Claim 1 An apparatus comprising: data management logic, implemented at least partly in hardware, to: make an identification of stored data in a local data store of the apparatus as being remotely accessible by web content before the stored data is labeled as being a particular type of remotely accessible data; and make an original selection, in response to the identification of the stored data in the local data store as being remotely accessible by web content, of a category from a plurality of categories that labels the stored data in the local data store as being a particular type of remotely accessible data; a separator to: separate the stored data in the local data store from other stored data in the local data store based on the category that labels the stored data in the local data store and another category from the plurality of categories that labels the other stored data in the local data store as being another particular type of remotely accessible data by web content, wherein the local data store is to include a first partition for the category and a second partition for the other category; and separate the stored data and the other stored data in the local data store from other further stored data in the local data store that is to be identified as not being remotely accessible by web content, wherein the local data store is include a third partition for the other further stored data to be identified as not being remotely accessible; a browser interface to make a detection of an attempt to access the stored data in the local data store by web content received at a browser of the apparatus; and policy logic, implemented at least partly in hardware, to apply, in response to the detection of the attempt to access the stored data by the web content received at the browser, a security policy to permit access or to deny access to the stored data in the local data store by the web content received at the browser based on the category that labels the stored data in the local data store as being the particular type of remotely accessible data by web content. ### Claim 2 (depends on 1) The apparatus of claim 1, wherein the category is to include privacy that labels the stored data in the local data store as being privacy data when the stored data includes remotely accessible browsing history data or personal data, cryptographic that labels the stored data in the local data store as being cryptographic data when the stored data includes username information, password information, or challenge information, and application specific that labels the stored data in the local data store as being application specific data when the stored data includes webmail data, retail data, or auction data. ### Claim 3 (depends on 1) The apparatus of claim 1, further including a context sensor interface to determine context information for the apparatus, wherein the context information is to include a geolocation of the apparatus when the attempt is made and a use of the apparatus when the attempt is made, and wherein the security policy is to be applied to permit access or to deny access to the stored data in the local data store by the web content received at the browser further based on the context information. ### Claim 4 (depends on 1) The apparatus of claim 1, wherein the browser interface is to receive user input including a user profile, and wherein the security policy is to be applied to permit access or to deny access to the stored data in the local data store by the web content received at the browser further based on the user input. ### Claim 5 (depends on 1) The apparatus of claim 1, further including a hardware security element to perform an encryption process on the stored data in the local data store. ### Claim 6 (depends on 5) The apparatus of claim 5, wherein the hardware security element is to selectively encrypt or decrypt the data existing in the local data store based on the category that labels the stored data in the local data store as being the particular type of remotely accessible data by web content. ### Claim 7 (depends on 1) The apparatus of claim 1, wherein the data management logic is further to generate a report that identifies the attempt to access the stored data in the local data store by the web content received at the browser, the category that labels the stored data in the local data store as being the particular type of remotely accessible data by web content, and the security policy to permit access or to deny access to the stored data in the local data store by the web content received at the browser based on the category that labels the stored data in the local data store as being the particular type of remotely accessible data by web content. ### Claim 8 (depends on 1) The apparatus of claim 1, wherein the browser interface is to monitor a Hypertext Markup Language 5 (HTML5) web application to detect the attempt to access the stored data in one or more of an HTML5 Web Storage of the apparatus or an HTML5 Application Cache of the apparatus. ### Claim 9 A method comprising: making an identification of stored data in a local data store of an apparatus as being remotely accessible by web content before the stored data is labeled as being a particular type of remotely accessible data; making an original selection, in response to the identification of the stored data in the local data store as being remotely accessible by web content, of a category from a plurality of categories that labels the stored data in the local data store as being a particular type of remotely accessible data by web content; separating the stored data in the local data store from other stored data in the local data store based on the category that labels the stored data in the local data store and another category from the plurality of categories that labels the other stored data in the local data store as being another particular type of remotely accessible data by web content; separating the stored data and the other stored data in a local data store from other further stored data in the local data store that is identified as not being remotely accessible by web content; making a detection of an attempt to access the stored data in the local data store by web content received at a browser of the apparatus; and applying, in response to the detection of the attempt to access the stored data by the web content received at the browser, a security policy to permit access or to deny access to the stored data in the local data store by the web content received at the browser based on the category that labels the stored data in the local data store as being the particular type of remotely accessible data by web content. ### Claim 10 (depends on 9) The method of claim 9, wherein the category includes one or more of privacy that labels the stored data in the local data store as being privacy data, cryptographic that labels the stored data in the local data store as being cryptographic data, and application specific that labels the stored data in the local data store as being application specific data. ### Claim 11 (depends on 9) The method of claim 9, further including determining context information for a device containing the local data store, wherein the context information includes one or more of a geolocation of the device when the attempt is made and a use of the device when the attempt is made, and wherein the security policy is applied to permit access or to deny access to the stored data in the local data store by the web content received at the browser further based on the context information. ### Claim 12 (depends on 9) The method of claim 9, further including receiving user input, wherein the security policy is applied to permit access or to deny access to the stored data in the local data store by the web content received at the browser further based on the user input. ### Claim 13 (depends on 9) The method of claim 9, further including instructing a hardware security element to perform an encryption process on the stored data in the local data store. ### Claim 14 (depends on 9) The method of claim 9, further including generating a report that identifies the attempt to access the stored data in the local data store by the web content received at the browser, the category that labels the stored data in the local data store as being the particular type of remotely accessible data by web content, and the security policy to permit access or to deny access to the stored data in the local data store by the web content received at the browser based on the category that labels the stored data in the local data store as being the particular type of remotely accessible data by web content. ### Claim 15 (depends on 9) The method of claim 9, wherein detecting the attempt includes monitoring a Hypertext Markup Language 5 (HTML5) web application. ### Claim 16 At least one non-transitory computer readable storage medium comprising a set of instructions which, when executed by a processor, cause a device to: make an identification of stored data in a local data store of an apparatus as being remotely accessible by web content before the stored data is labeled as being a particular type of remotely accessible data; make an original selection, in response to the identification of the stored data in the local data store as being remotely accessible by web content, of a category from a plurality of categories that labels the stored data in the local data store as being a particular type of remotely accessible data by web content; separate the stored data in the local data store from other stored data in the local data store based on the category that labels the stored data in the local data store and another category from the plurality of categories that labels the other stored data in the local data store as being another particular type of remotely accessible data by web content; separate the stored data and the other stored data in a local data store from other further stored data in the local data store that is to be identified as not being remotely accessible by web content; make a detection of an attempt to access the stored data in the local data store by web content received at a browser of the apparatus; and apply, in response to the detection of the attempt to access the stored data by the web content received at the browser, a security policy to permit access or to deny access to the stored data in the local data store by the web content received at the browser based on the category that labels the stored data in the local data store as being the particular type of remotely accessible data by web content. ### Claim 17 (depends on 16) The at least one computer readable storage medium of claim 16, wherein the category is to include one or more of privacy that labels the stored data in the local data store as being privacy data, cryptographic that labels the stored data in the local data store as being cryptographic data, and application specific that labels the stored data in the local data store as being application specific data. ### Claim 18 (depends on 16) The at least one computer readable storage medium of claim 16, wherein the instructions, when executed, cause the device to determine context information for the device, wherein the context information is to include one or more of a geolocation of the device when the attempt is made and a use of the device when the attempt is made, and wherein the security policy is to be applied to permit access or to deny access to the data in the stored local data store by the web content received at the browser further based on the context information. ### Claim 19 (depends on 16) The at least one computer readable storage medium of claim 16, wherein the instructions, when executed, cause the device to receive user input, and wherein the security policy is to be applied to permit access or to deny access to the stored data in the local data store by the web content received at the browser further based on the user input. ### Claim 20 (depends on 16) The at least one computer readable storage medium of claim 16, wherein the instructions, when executed, cause the device to instruct a hardware security element to perform an encryption process on the stored data in the local data store. ### Claim 21 (depends on 16) The at least one computer readable storage medium of claim 16, wherein the instructions, when executed, cause the device to generate a report that identifies the attempt to access the stored data in the local data store by the web content received at the browser, the category that labels the stored data in the local data store as being the particular type of remotely accessible data by web content, and the security policy to permit access or to deny access to the stored data in the local data store by the web content received at the browser based on the category that labels the stored data in the local data store as being the particular type of remotely accessible data by web content. ### Claim 22 (depends on 16) The at least one computer readable storage medium of claim 16, wherein the instructions, when executed, cause the device to monitor a Hypertext Markup Language 5 (HTML5) web application to detect the attempt.