Systems and methods for patching computer programs

• US 20080295086A1
• Filed: 09/17/2007
• Published: 11/27/2008
• Est. Priority Date: 06/12/2002
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Cook, Randall R., Greenwood, Mark A., Palethorpe, Robert P., Hopwood, Scott G.
• Granted Patent: US 8,291,407 B2
• Time in Patent Office: Days
• US Class Current: 717/168
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57
• CPC Class Codes: G06F 8/656 while running

Abstract

The disclosure is directed to systems and methods for patching computer programs. In one example, a patch is virtually installed to a computing device having a base file system and configuration, a computer program, and a patch layering subsystem. The virtual installation may include storing content of the patch to a patch layer, and generating and storing mapping data defining at least one relationship between the content in the patch layer and content in the base file system and configuration. The virtually installed patch may be enabled, including applying the mapping data to the patch layering subsystem such that the patch layering subsystem is configured for selectively redirecting access requests from the base file system and configuration to the patch layer. In certain embodiments, the enabled patch may be disabled by reversing the application of the mapping data to the patch layering subsystem.

Claims

1. A method, comprising:

virtually installing a computer program patch to a computing device having a base file system and configuration, a computer program, and a patch layering subsystem, said step of virtually installing said computer program patch including

storing content of said patch to a patch layer, and

generating and storing mapping data defining at least one relationship between said content in said patch layer and content of said base file system and configuration; and

enabling said patch layer, including applying said mapping data to said patch layering subsystem such that said patch layering subsystem is configured for selectively redirecting access requests from said base file system and configuration to said patch layer.

2. The method of claim 1, further comprising:

disabling said patch layer, including reversing said step of applying said mapping data to said patch layering subsystem such that said patch layering subsystem is configured not to redirect the access requests to said patch layer.

3. The method of claim 1, further comprising:

committing said virtually installed patch to said base file system and configuration, including performing an actual install of at least a subset of said content in said patch layer to said base file system and configuration based on said mapping data.

4. The method of claim 1, further comprising:

virtually installing another computer program patch to said computing device, said step of virtually installing said another computer program patch including

storing content of said another computer program patch to another patch layer,

generating and storing other mapping data defining at least one relationship between said content in said another patch layer and said content of said base file system and configuration, and

prioritizing said patch layer and said another patch layer with respect to one another; and

enabling said another patch layer, including applying said other mapping data to said patch layering subsystem such that said patch layering subsystem is configured for selectively redirecting the access requests from said base file system and configuration to said another patch layer.

5. The method of claim 4, further comprising:

combining said patch layer and said another patch layer into a composite patch layer, and

combining said mapping data and said other mapping data to form composite mapping data corresponding with said composite patch layer.

6. A system, comprising:

a computing device having a computer program and a base file system and configuration; and

a patch layering subsystem installed to said computing device and configured to

virtually install a patch for said computer program to a patch layer,

enable said patch layer such that said patch layering subsystem is configured for selectively redirecting access requests from said base file system and configuration to said patch layer, and

disable said patch layer such that said patch layering subsystem is configured not to redirect the access requests to said patch layer.

7. The system of claim 6, wherein said patch layering subsystem is configured to virtually install said patch by

storing content of said patch to said patch layer, said patch layer being separate from said base file system and configuration, and

generating and storing mapping data defining at least one relationship between said content in said patch layer and content in said base file system and configuration.

8. The system of claim 7, wherein said patch layering subsystem is configured to enable said patch layer by activating said mapping data for use in intercepting the access requests and to disable said patch layer by reversing said activating of said mapping data.

9. The system of claim 7, wherein said patch layering subsystem is configured to commit said patch to said base file system and configuration using said mapping data and said content of said patch layer.

10. The system of claim 6, wherein said patch layering subsystem is further configured to

virtually install another patch for said computer program to another patch layer,

prioritize said patch layer and said another patch layer in relation to one another,

enable said another patch layer such that said patch layering subsystem is configured for selectively redirecting the access requests from said base file system and configuration to said another patch layer, and

disable said another patch layer such that said patch layering subsystem is configured not to redirect the access requests to said another patch layer.

11. The system of claim 10, wherein said patch layering subsystem is configured to prioritize said patch layer and said another patch layer based on at least one of patch version information, patch release date information, and patch timestamp information.

12. The system of claim 10, wherein said patch layering subsystem is further configured to combine said patch layer and said another patch layer into a composite patch layer.

13. The system of claim 10, wherein said another patch is intended to supersede said patch, said patch layering subsystem being configured to recognize supersedure information associated with said another patch layer and to automatically disable said patch layer when said another patch layer is enabled.

14. The system of claim 6, further comprising a patch control subsystem communicatively coupled to said computing device by a network, said patch control subsystem being configured to

deliver said patch to said computing device,

transmit an enable command to said computing device, said enable command being configured to instruct said patch layering subsystem to enable said patch layer, and

transmit a disable command to said computing device, said disable command being configured to instruct said patch layering subsystem to disable said patch layer.

15. The system of claim 14, wherein said patch control subsystem is further configured to transmit a test command to said computing device, said test command being configured to instruct said computing device to perform at least one test operation for testing said enabled patch layer.

16. The system of claim 14, wherein said patch control subsystem is further configured to transmit a commit command to said computing device, said commit command being configured to instruct said patch layering subsystem to commit said patch layer to said base file system and configuration.

17. A computer program product embodied in a computer readable medium and comprising computer instructions executable by a computing device to perform the functions of:

virtually installing a computer program patch to the computing device, including

storing patch content associated with said computer program patch to a patch layer, and

generating and storing mapping data defining at least one relationship between said patch content in said patch layer and content of a base file system and configuration of the computing device; and

enabling said patch layer, including activating said mapping data for use in selectively redirecting access requests from said base file system and configuration to said patch layer.

18. The computer program product of claim 17, further comprising computer instructions executable by the computing device to perform the functions of:

intercepting an access request;

determining from said mapping data whether requested content is in said patch layer;

redirecting said access request to said patch layer based on said mapping data when it is determined that said requested content is in said patch layer; and

permitting said access request to continue to said base file system and configuration when it is determined that said requested content is not in said patch layer.

19. The computer program product of claim 17, further comprising computer instructions executable by the computing device to perform the function of disabling said patch layer, including reversing said step of activating said mapping data.

20. The computer program product of claim 17, further comprising computer instructions executable by the computing device to perform the function of committing said virtually installed computer program patch to said base file system and configuration based on said mapping data.