IP Library › Granted Patent US 12675270

Granted Patent B2

US 12675270 · App. 17/854,662 · Granted Jul 7, 2026

Systems and methods for generating application policies

Inventors: Michael Herzberg (Cambridge, GB); Chris Mayers (Histon, GB)

G06F8/65 G06F8/71

View Patent ↗

Loading inventors, assignments & file history…

Monitor This Case

Get email alerts when status or documents change.

Order Certified Copies

Most orders are placed with the USPTO same day — all within 24 business hours.

Order via The Patent Place →

Pre-filled with this patent's details

Quick Facts

Patent No.: US 12675270
App. No.: 17/854,662
Granted: Jul 7, 2026
Kind: B2

External Links

USPTO Patent Center↗ Full Patent PDF↗

Abstract

One disclosed method involves causing, by a computing system, installation of at least a first application and a second application, determining, by the computing system, first application data indicative of modifications occurring in response to installation of the first application, determining, by the computing system, second application data indicative of modifications occurring in response to installation of the second application, and processing the first application data and the second application data to generate a set of application policies to control use of the first application and the second application at a user device.

Claims (126)

1 . A method, comprising:

causing, by a computing system, installation of at least a first application and a second application at a user device, wherein the first application is installed by a first application installer and the second application is installed using a second application installer;

monitoring, using a first application installer monitor, the installation of the first application at the user device;

generating, by the first application installer monitor, first application data indicative of first modifications occurring in response to installation of the first application, wherein the first modifications comprise at least a first downloaded file comprising a first filename and a first file path of the first downloaded file, in which the first file path indicates a location of the first downloaded file in memory of the user device;

monitoring, using a second application installer monitor, the installation of the second application at the user device;

generating, by the second application installer monitor, second application data indicative of second modifications occurring in response to installation of the second application, wherein the second modifications comprise at least a second downloaded file comprising a second filename and a second file path of the second downloaded file, in which the second file path indicates a location of the second downloaded file in memory of the user device;

storing, at an application installation repository, the first application data and the second application data;

resetting after the storing, the first application installer monitor, wherein the resetting the first application installer monitor comprises:

deleting the first application data from memory associated with the first application installer monitor; and

restoring an operating system of the first application installer monitor, wherein resetting the first application installer monitor readies the first application installer monitor for future application installations;

resetting after the storing, the second application installer monitor, wherein the resetting the second application installer monitor comprises:

deleting the second application data from memory associated with the second application installer monitor; and

restoring an operating system of the second application installer monitor, wherein resetting the second application installer monitor readies the second application installer monitor for the future application installations;

extracting, from the application installation repository and by a policy generator, the first application data and the second application data; and

processing, by the policy generator, the first application data and the second application data to generate a set of application policies to control use of the first application and the second application at the user device, wherein one or more policy configuration settings, stored in memory of the policy generator, are used to generate the set of application policies.

2 . The method of claim 1 , further comprising:

processing the first application data and an input representing that the user device is to be allowed to access the first application to generate a first application policy to control use of the first application;

processing the second application data and an input representing that the user device is to be prevented from accessing the second application to generate a second application policy to control use of the second application; and

processing the first application policy with respect to the second application policy to generate the set of application policies.

3 . The method of claim 1 , further comprising:

processing the first application data to generate a first application policy to control use of the first application;

processing the second application data to generate a second application policy to control use of the second application;

determining a conflict between the first application policy and the second application policy; and

based at least in part on determining the conflict, discarding the first application policy and the second application policy.

4 . The method of claim 1 , further comprising:

processing the first application data to generate a first application policy to control use of the first application;

processing the second application data to generate a second application policy to control use of the second application;

determining a duplicate among the first application policy and the second application policy; and

generating the set of application policies to include the first application policy.

5 . The method of claim 1 , further comprising:

receiving, by the computing system and from a client device, an input indicative of the first application and the second application; and

in response to receiving the input, causing, by the computing system, installation of the first application and the second application.

6 . The method of claim 1 , wherein the set of application policies includes a first application policy to control use of the first application at the user device, and the method further comprises:

determining, by the computing system, that an updated version of the first application is available;

causing, by the computing system, installation of the updated version of the first application;

determining, by the computing system, updated application data indicative of modifications occurring in response to installation of the updated version of the first application;

processing, by the computing system, the updated application data to determine a second application policy to control use of the updated version of the first application; and

determining, by the computing system, updated set of application policies based at least in part on the first application policy and the second application policy.

7 . The method of claim 1 , further comprising:

causing, by the computing system, installation of the first application on a first computing device;

causing, by the computing system, installation of the second application on a second computing device; and

after determining the first application data, resetting the first computing device to enable installation of an additional application.

8 . The method of claim 1 , further comprising:

after generating the set of application policies, sending data representing the set of application policies to a computing device;

causing, by the computing device, installation and launch of at least the first application and the second application; and

determining that the set of application policies controlled use of the first application and the second application at the computing device in accordance with stored application access indicators.

9 . The method of claim 1 , further comprising:

causing, by the computing system, installation of a third application;

determining, by the computing system, third application data indicative of modifications occurring in response to installation of the third application;

processing, by the computing system, the third application data to generate a publisher rule to control use of the third application;

determining, by the computing system, that the publisher rule is in conflict with the set of application policies; and

determining, by the computing system, a path rule, instead of the publisher rule, to control use of the third application, the path rule to be included in the set of application policies.

10 . A system, comprising:

at least one processor; and

at least one computer-readable medium encoded with instructions which, when executed

by the at least one processor, cause the system to:

cause installation of at least a first application and a second application at a user device, wherein the first application is installed by a first application installer and the second application is installed using a second application installer,

monitor, using a first application installer monitor, the installation of the first application at the user device,

generate, by the first application installer monitor, first application data indicative of first modifications occurring in response to installation of the first application, wherein the first modifications comprise at least a first downloaded file comprising a first filename and a first file path of the first downloaded file, in which the first file path indicates a location of the first downloaded file in memory of the user device,

monitor, using a second application installer monitor, the installation of the second application at the user device;

generate, by the second application installer monitor, second application data indicative of second modifications occurring in response to installation of the second application, wherein the second modifications comprise at least a second downloaded file comprising a second filename and a second file path of the second downloaded file, in which the second file path indicates a location of the second downloaded file in memory of the user device,

store, at an application installation repository, the first application data and the second application data,

reset, after the storing, the first application installer monitor, wherein the resetting the first application installer monitor comprises:

deleting the first application data from memory associated with the first application installer monitor; and

reset, after the storing, the second application installer monitor, wherein the resetting the second application installer monitor comprises:

deleting the second application data from memory associated with the second application installer monitor; and

extract, from the application installation repository and by a policy generator, the first application data and the second application data

process, by the policy generator, the first application data and the second application data to generate a set of application policies to control use of the first application and the second application at the user device, wherein one or more policy configuration settings, stored in memory of the policy generator, are used to generate the set of application policies.

11 . The system of claim 10 , wherein the at least one computer-readable medium is further encoded with additional instructions which, when executed by the at least one processor, further cause the system to:

process the first application data and an input representing that the user device is to be allowed to access the first application to generate a first application policy to control use of the first application;

process the second application data and an input representing that the user device is to be prevented from accessing the second application to generate a second application policy to control use of the second application; and

process the first application policy with respect to the second application policy to generate the set of application policies.

12 . The system of claim 10 , wherein the at least one computer-readable medium is further encoded with additional instructions which, when executed by the at least one processor, further cause the system to:

process the first application data to generate a first application policy to control use of the first application;

process the second application data to generate a second application policy to control use of the second application;

determine a conflict between the first application policy and the second application policy; and

based at least in part on determining the conflict, discard the first application policy and the second application policy.

13 . The system of claim 10 , wherein the at least one computer-readable medium is further encoded with additional instructions which, when executed by the at least one processor, further cause the system to:

process the first application data to generate a first application policy to control use of the first application;

process the second application data to generate a second application policy to control use of the second application;

determine a duplicate among the first application policy and the second application policy; and

generate the set of application policies to include the first application policy.

14 . The system of claim 10 , wherein the at least one computer-readable medium is further encoded with additional instructions which, when executed by the at least one processor, further cause the system to:

receive, from a client device, an input indicative of the first application and the second application; and

in response to receiving the input, cause installation of the first application and the second application.

15 . The system of claim 10 , wherein the set of application policies includes a first application policy to control use of the first application at the user device, and wherein the at least one computer-readable medium is further encoded with additional instructions which, when executed by the at least one processor, further cause the system to:

determine that an updated version of the first application is available;

cause installation of the updated version of the first application;

determine updated application data indicative of modifications occurring in response to installation of the updated version of the first application;

process the updated application data to determine a second application policy to control use of the updated version of the first application; and

determine updated set of application policies based at least in part on the first application policy and the second application policy.

16 . The system of claim 10 , wherein the at least one computer-readable medium is further encoded with additional instructions which, when executed by the at least one processor, further cause the system to:

cause installation of the first application on a first computing device;

cause installation of the second application on a second computing device; and

after determining the first application data, reset the first computing device to enable installation of an additional application.

17 . The system of claim 10 , wherein the at least one computer-readable medium is further encoded with additional instructions which, when executed by the at least one processor, further cause the system to:

after generating the set of application policies, send data representing the set of application policies to a computing device;

cause, by the computing device, installation and launch of at least the first application and the second application; and

determine that the set of application policies controlled use of the first application and the second application at the computing device in accordance with stored application access indicators.

18 . The system of claim 10 , wherein the at least one computer-readable medium is further encoded with additional instructions which, when executed by the at least one processor, further cause the system to:

cause installation of a third application;

determine third application data indicative of modifications occurring in response to installation of the third application;

process the third application data to generate a publisher rule to control use of the third application;

determine that the publisher rule is in conflict with the set of application policies; and

determine a path rule, instead of the publisher rule, to control use of the third application, the path rule to be included in the set of application policies.

19 . At least one non-transitory computer-readable medium encoded with instructions which, when executed by at least one processor of a system, cause the system to:

monitor, using a first application installer monitor, the installation of the first application;

monitor, using a second application installer monitor, the installation of the second application;

generate, by the second application installer, second application data indicative of second modifications occurring in response to installation of the second application, wherein the second modifications comprise at least a second downloaded file comprising a second filename and a second file path of the second downloaded file, in which the second file path indicates a location of the second downloaded file in memory of the user device;

store, at an application installation repository, the first application data and the second application data;

reset, after the storing, the first application installer monitor, wherein the resetting the first application installer monitor comprises:

deleting the first application data from memory associated with the first application installer monitor; and

reset, after the storing, the second application installer monitor, wherein the resetting the second application installer monitor comprises:

deleting the second application data from memory associated with the second application installer monitor; and

extract, from the application installation repository and by a policy generator, the first application data and the second application data; and

process, by the policy generator, the first application data and the second application data to generate a set of application policies to control use of the first application and the second application at a user device, wherein one or more policy configuration settings, stored in memory of the policy generator, are used to generate the set of application policies.

20 . The at least one non-transitory computer-readable medium of claim 19 , further encoded with additional instructions which, when executed by the at least one processor, further cause the system to:

process the first application policy with respect to the second application policy to generate the set of application policies.