US 11,720,666 B2
Application-level sandboxing on devices
Zhi Xu, Cupertino, CA (US); Cong Zheng, San Jose, CA (US); Tongbo Luo, Newark, CA (US); and Wenjun Hu, Santa Clara, CA (US)
Assigned to Palo Alto Networks, Inc., Santa Clara, CA (US)
Filed by Palo Alto Networks, Inc., Santa Clara, CA (US)
Filed on Oct. 21, 2021, as Appl. No. 17/507,574.
Application 17/507,574 is a continuation of application No. 16/205,051, filed on Nov. 29, 2018, granted, now 11,210,391.
Prior Publication US 2022/0043906 A1, Feb. 10, 2022
This patent is subject to a terminal disclaimer.
Int. Cl. G06F 21/53 (2013.01); G06F 21/14 (2013.01); G06F 21/55 (2013.01); G06F 21/56 (2013.01)
CPC G06F 21/53 (2013.01) [G06F 21/14 (2013.01); G06F 21/552 (2013.01); G06F 21/56 (2013.01)] 27 Claims
OG exemplary drawing
 
1. A system, comprising:
a processor configured to:
receive, by an operating system executing on a device, a request to launch an application;
determine that a stored copy of the application should be automatically executed within an application-level sandbox provided by a third party host application each time it is launched, until a triggering event takes place;
execute the stored copy of the application in the application-level sandbox provided by the third party host application, wherein the third party host application provides a framework layer that provides hooking functionality for monitoring system calls made by the application; and
determine that the triggering event has taken place and take an appropriate action, wherein the triggering event comprises receiving a notification from an external entity, and wherein the action comprises one of the following:
in the event the notification indicates that the application is benign, in response to receiving a subsequent request to launch the application, execute the stored copy of the application outside of the application-level sandbox, or
in the event the notification indicates that the application is malicious, prevent execution of the application; and
a memory coupled to the processor and configured to provide the processor with instructions.