Security sharing systems and methods
Inventors
Philbrick, Ashley Raine • Russell, Ryan Thomas • Harris, David Joaquin • De'Angeli, Sacha Melquiades
Assignees
Interested in licensing this patent?
MTEC can help explore whether this patent might be available for licensing for your application.
Publication Number
US-12639465-B1
Publication Date
2026-05-26
Expiration Date
Abstract
A computing device may include a memory storing a first dataset and a second dataset and a processor configured to provide an operating system. The computing device may also include a container defined by a programmed boundary within at least the memory and provided by the operating system. A resource executed within the container may access the first dataset without accessing the second dataset. However, the resource may access the second dataset in response to a generation of a certificate. The resource may originate from following a hyperlink in a communication.
Core Innovation
A computing device includes a processor configured to execute an operating system and an operating-system-provided container defined by a programmed boundary within at least memory. The memory stores a first dataset within the programmed boundary and a second dataset outside the programmed boundary, and based upon the programmed boundary, the container provides resource access to the first dataset while refraining from providing resource access to the second dataset.
The resource accesses the second dataset outside the programmed boundary only in response to receiving a certificate authorizing access. The certificate is configured to expire after a threshold number of transactions associated with the second dataset is reached between the memory and the resource, and in dependent refinements the certificate behavior can reflect unauthorized and authorized access states and can be based on time-based expiration rather than or in addition to transaction-threshold expiration.
The document further ties access control to security handling and phishing detection, including detection via deviation from expected purchase or user data and detection of unauthorized communication by destination-address mismatch. It also includes executing potentially malicious hyperlinks within a sandbox/container context and updating or verifying container software, including container version/hash-based verification, to ensure up-to-date container software before permitting access.
Claims Coverage
The independent claims cover three implementations: a computing device, a method, and a tangible, non-transitory computer-readable medium. Across these, the claims focus on container confinement using a programmed boundary and conditional, certificate-authorized access to a second dataset outside the boundary, with certificate expiration based on a transaction threshold between memory and the resource.
Programmed boundary container restricts resource access to an in-bound dataset
A container defined by a programmed boundary within at least memory and provided by the operating system, where the memory stores a first dataset within the programmed boundary and a second dataset outside the programmed boundary, and where based upon the programmed boundary the container is configured to provide a resource access to the first dataset while refraining from providing the resource access to the second dataset outside the programmed boundary.
Certificate-authorized conditional access to out-of-bound dataset
In response to receiving a certificate authorizing access to the second dataset outside the programmed boundary, the resource accesses the second dataset using the certificate, while the resource otherwise accesses only the first dataset within the programmed boundary.
Transaction-threshold certificate expiration for authorized out-of-bound access
The certificate is configured to expire after a threshold number of transactions associated with the second dataset is reached between the memory and the resource.
Time-based unauthorized/authorized certificate semantics
The certificate provides a state indicating that the resource is unauthorized at a first time and authorized at a second time for accessing the second dataset outside the programmed boundary.
Destination address authorization detection via textual-context mismatch
Identifying that the resource includes an unauthorized destination address by comparing the textual context of the destination address with the destination address and observing a mismatch.
Hyperlink-driven generation of a resource within a container
Generating the resource inside a container after receiving a user selection of a hyperlink shown on a graphical user interface.
Blocking access to the out-of-bound dataset after certificate expiration
Blocking access to the second dataset after expiration of the certificate.
The claims implement a container confinement model using a programmed boundary so the resource normally accesses only the in-bound first dataset. Access to the out-of-bound second dataset is provided only when a certificate authorizes the access, and the authorization is limited by certificate expiration configured for threshold transaction counts and, in refinements, time-based unauthorized/authorized semantics, with further refinements that include destination-address mismatch detection, hyperlink-driven resource generation, and blocking after expiration.
Stated Advantages
Not explicitly described in patent.
Documented Applications
Not explicitly described in patent.
Interested in licensing this patent?