Application remoting using network vector rendering

• US 10,650,166 B1
• Filed: 10/21/2019
• Issued: 05/12/2020
• Est. Priority Date: 02/04/2019
• Status: Active Grant

• Current Assignee: CloudFlare Incorporated
• Original Assignee: CloudFlare Incorporated
• Inventors: Sundberg, Trevor, Koenig, Killian, Remington, Darren, Buzbee, Benjamin, Conrad, Michael, Harnett, David
• Primary Examiner(s): Schwartz, Darren B
• Application Number:
  US16/659,482
• Time in Patent Office: 204 Days
• CPC Class Codes: G06F 11/3656 using a specific debug interface
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 21/6281 at program execution time, where the protection is within the operating system
• CPC Class Codes: G06F 21/629 to features or functions of an application
• CPC Class Codes: G06F 21/71 to assure secure computing or processing of information
• CPC Class Codes: G06F 9/452 Remote windowing, e.g. X-Window System, desktop virtualisation protocols for virtual reality H04L67/131
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

Methods, systems, and techniques for application isolation by remote-enabling applications are provided. Example embodiments provide an Adaptive Rendering Application Isolation System (“ARAIS”), which transparently and dynamically enables applications to run in an isolated execution environment yet be rendered locally in a manner that minimizes the amount of data to be transferred and the latency caused by expensive computation and/or by overburdening available bandwidth by remoting rendering using draw commands over rendering using pixel pushing or other techniques. In one embodiment, the ARAIS includes an orchestrator server which comprises remoting level determination logic and rules engine, pre-computed graphics libraries, connection support logic, data repositories for objects such as a render cache, whitelists, blacklists, client privileges, and application information, and one or more secure containers running remote application instances. These components cooperate to deliver isolation-ready technology to client applications.

Claims

1. A computer-implemented method for improving one or more computer technologies, comprising:

under control of a rendering computing device that is remotely located, separate, and distinct from an execution computing device;

providing to the execution computing device a request to initiate a remote application in the execution computing device while the rendering computing device executes an instance of a local application, the remote application instance having a compositor and a region renderer;

responsive to the request, obtaining one or more files from the execution computing device;

providing the one or more obtained files to the local application instance to facilitate the rendering computing device to display output of the remote application instance and to facilitate the local application instance to initiate a connection from the local application instance to the remote application instance and perform one or more of intercept events from an event loop to listen for events associated with the local application instance or generate a drawing canvas;

initiating the connection from the local application instance to the remote application instance to cause the connected remote application instance to;

intercept first draw commands from the compositor of the remote application instance, the first draw commands corresponding to one or more tiles to be rendered and representing only a portion of all draw commands used to provide a current output of the remote application instance;

capture first position information from the region renderer of the remote application instance for the one or more tiles that correspond to the first draw commands; and

intercept second draw commands from the region renderer of the remote application instance that correspond to one or more regions to be rendered and capture second position information for the one or more corresponding regions; and

obtaining the first and second draw commands with the first and second captured position information from the remote application instance;

rendering one or more portions of the output of the remote application instance based on the first and second draw commands and the first and second captured position information.

2. The method of claim 1 wherein rendering the one or more portions of the output of the remote application instance based on the first and second draw commands and the first and second captured position information includes rendering the one or more portions of the output of the remote application instance based on the first and second draw commands and the first and second captured position information without obtaining bitmap rasterizations of the first and second draw commands from the execution computing device.

3. The method of claim 1 wherein the local application instance renders one or more layers to a cache based on the first and second draw commands and the first and second captured position information obtained from the execution computing device, wherein one or more portions of the cache are rendered on a display of the rendering computing device based on a portion of the obtained first and second draw commands, and wherein one or more other portions of the cache are not rendered on the display of the rendering computing device concurrently with the one or more portions of the cache and are based on another portion of the received first and second draw commands.

4. The method of claim 3 wherein the cache includes one or more of an image cache, a texture cache, a font cache, a shape cache, a curve cache, or a draw command cache.

5. The method of claim 3 wherein, upon notification of a scrolling event or another event associated with a user action, the local application instance renders on the display of the rendering computing device some part of the one or more other portions of the cache without receiving further draw commands from the execution computing device.

6. The method of claim 1, further comprising:

providing to the execution computing device one or more indicators of one or more characteristics of one or more of the local application instance or a data channel connecting the execution computing device and the rendering computing device;

based on a determination of whether third draw commands associated with one or more portions of the current output facilitates higher performance than pixel information associated with the one or more portions of the current output based on an evaluation of the one or more characteristics, obtaining from the execution computing device whichever one of the third draw commands or the pixel information is determined to facilitate higher performance; and

rendering one or more portions of the output of the remote application instance based on the obtained third draw commands or the obtained pixel information.

7. The method of claim 6 wherein the evaluation includes determining a data bandwidth and/or a latency and comparing the data bandwidth and/or the latency to one or more thresholds to determine whether the third draw commands or the pixel information facilitate higher performance.

8. A computer-implemented method for improving one or more computer technologies, comprising:

under control of an output rendering computing device that is remotely located, separate, and distinct from a code execution computing device;

providing to the code execution computing device a request to initiate a remote application in the code execution computing device while the output rendering computing device executes an instance of a local application, the remote application instance having a compositor and a region renderer, the request indicating an operating system of the output rendering computing device and an application type of the local application, the remote application instance having a current compositor, a current region renderer, or a current graphics library determined based on one or more of the operating system of the output rendering computing device and/or the application type of the local application in the output rendering computing device;

responsive to the request, obtaining a set of files from the code execution computing device, the set of files being determined based on the request and the one or more of the current compositor, the current region renderer, or the current graphics library, the set of files containing compiled draw commands and information that modifies the local application instance to display output of the remote application instance;

providing the set of files to the local application instance to facilitate the output rendering computing device to display output of the remote application instance,

wherein one or more files in the set of files is configured to interface with an application programming interface (“

API”

) of the local application instance to cause the local application instance to load one or more files in the set of files, is configured to intercept events from an event loop to listen for events associated with the local application instance and invoke draw handling code, and is configured to initiate a connection from the local application instance to the remote application instance,

wherein one or more files in the set of files includes the draw handling code in a compiled instance of a graphics library of the remote application instance, the compiled instance of the graphics library being configured to cause draw commands to be rendered in the same manner on the local application instance as on the remote application instance to facilitate consistent rendering on the local application instance and on the remote application instance, and

wherein one or more files in the set of files is configured to cause the local application instance to generate a drawing canvas;

causing a connection between the remote application instance and the local application instance to facilitate the output rendering computing device to display the output of the remote application instance;

obtaining draw commands from the connected remote application instance; and

rendering one or more portions of the output of the remote application instance based on the obtained draw commands.

9. The method of claim 8 wherein the set of files include a script file, a rendering support file, and a canvas file, the script file being configured to (i) interface with the API of the local application instance, (ii) intercept events from the event loop, and (iii) initiate the connection from the local application instance to the remote application instance, the rendering support file including the draw handling code, and the canvas file being configured to cause the local application instance to generate the drawing canvas.

10. The method of claim 8 wherein one or more files in the set of files is configured to cause the local application instance to render one or more layers to a cache based on the draw commands received from the execution computing device, wherein one or more portions of the cache are caused to be rendered on a display of the rendering computing device based on a portion of the received draw commands, and wherein one or more other portions of the cache are not rendered on the display of the output rendering computing device concurrently with the one or more portions of the cache and are based on another portion of the received draw commands.

11. The method of claim 10 wherein one or more files in the set of files, upon notification of a scrolling event or another event associated with a user action, causes the local application instance to render on the display of the output rendering computing device some part of the one or more other portions of the cache without receiving further draw commands from the code execution computing device.

12. The method of claim 8 wherein obtaining the draw commands includes providing the draw commands to the local application instance to facilitate the one or more loaded files to cause the local application instance to render the one or more portions of the output of the remote application instance based on the draw commands without obtaining bitmap rasterizations of the draw commands from the code execution computing device to render the one or more portions of the output of the remote application instance.

13. A computer-implemented method for improving one or more computer technologies, comprising:

under control of a client computing device that is remotely located, separate, and distinct from a server computing device;

providing the server computing device a request to initiate a remote application in the server computing device while the client computing device executes an instance of a client application, the request indicating an operating system of the client computing device and an application type of the client application, the remote application instance having a current compositor, a current region renderer, or a current graphics library determined based on one or more of the operating system of the client computing device and/or the application type of the local application in the client computing device;

responsive to the request, obtaining a set of files from the server computing device based on the received request and the one or more of the current compositor, the current region renderer, or the current graphics library, the set of files including a script file, an executable code file, and a Hypertext Markup Language (“

HTML”

) file that include information that modifies the client application instance to display output of the remote application instance,

wherein the script file is configured to interface with an application programming interface (“

API”

) of the client application instance to cause the client application instance to load the executable code file, is configured to intercept events from an event loop to listen for events associated with the client application instance and invoke draw handling code, and is configured to initiate a connection from the client application instance to the remote application instance,

wherein the executable code file includes the draw handling code in a compiled instance of a graphics library of the remote application instance, the compiled instance of the graphics library being configured to cause draw commands to be rendered in the same manner on the client application instance as on the remote application instance to facilitate consistent rendering on the client application instance and on the remote application instance, and

obtaining draw commands from the remote application instance; and

rendering one or more portions of the output of the remote application instance based on the obtained draw commands.

14. The method of claim 13 wherein obtaining the draw commands includes providing to the client application instance the draw commands to facilitate the loaded executable code file to cause the client application instance to render the one or more portions of the output of the remote application instance based on the draw commands without sending bitmap rasterizations of the draw commands from the server computing device to render the one or more portions of the output of the remote application instance.

15. The method of claim 13 wherein the loaded executable code file is configured to cause the client application instance to render one or more layers to a cache based on the draw commands obtained from the server computing device, wherein one or more portions of the cache are caused to be rendered on a display of the client computing device based on a portion of the obtained draw commands, and wherein one or more other portions of the cache are not yet caused to be rendered on the display of the client computing device and are based on another portion of the obtained draw commands.

16. The method of claim 15 wherein the cache includes one or more of an image cache, a texture cache, a font cache, a shape cache, a curve cache, or a draw command cache.

17. The method of claim 15 wherein the loaded executable code file, upon notification of a scrolling event or another event associated with a user action, causes the client application instance to render on the display of the client computing device some part of the one or more other portions of the cache not yet caused to be rendered without receiving further draw commands from the server computing device.

18. The method of claim 13, further comprising:

detecting a user action associated with an event that causes one or more portions of a cache of the remote application instance to be updated;

providing an indication of the detected user action to the server computing device to cause the server computing device to intercepting further draw commands from one or more of the compositor or the region renderer of the remote application instance, the further draw commands being associated with updating the one or more portions of the cache of the remote application instance; and

obtaining from the server computing device the further draw commands; and

based on the obtained further draw commands, rendering an update to one or more portions of a cache of the client application instance, the one or more portions of the cache of the client application instance corresponding to the one or more updated portions of the cache of the remote application instance.

19. The method of claim 13, further comprising:

providing to the server computing device one or more indicators of one or more characteristics of one or more of the client application instance or a data channel connecting the server computing device and the client computing device;

based on a determination of whether further draw commands associated with one or more portions of the output facilitates higher performance than pixel information associated with the one or more portions of the output based on an evaluation of the one or more characteristics, obtaining from the server computing device whichever one of the further draw commands or the pixel information is determined to facilitate higher performance; and

rendering one or more portions of the output of the remote application instance based on the obtained further draw commands or the obtained pixel information.

20. The method of claim 19 wherein the evaluating includes determining a data bandwidth and/or a latency and comparing the data bandwidth and/or the latency to one or more thresholds to determine whether the further draw commands facilitate higher performance than the pixel information.