SECURE MULTI-PURPOSE COMPUTING CLIENT

• US 20090307705A1
• Filed: 06/03/2009
• Published: 12/10/2009
• Est. Priority Date: 06/05/2008
• Status: Abandoned Application

• Current Assignee: Intel Corporation
• Original Assignee: Neocleus Israel Limited
• Inventors: Bogner, Etay
• Application Number:
  US12/477,167
• Publication Number:
  US 20090307705A1
• Time in Patent Office: Days
• US Class Current: 718/104
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: G06F 9/5077 Logical partitioning of resources; Management or configuration of virtualized resources specific details on emulation or internal functioning of virtual machines G06F9/455

Abstract

A method includes, in a computer that runs multiple operating environments using hardware resources, defining and managing an allocation policy of the hardware resources, which eliminates effects from operations performed in one of the operating environments on the operations performed in another of the operating environments. The hardware resources are assigned to the multiple operating environments in accordance with the allocation policy, so as to isolate the multiple operating environments from one another.

Claims

1. A method, comprising:

in a computer that runs multiple operating environments using hardware resources, defining and managing an allocation policy of the hardware resources, which eliminates effects from operations performed in one of the operating environments on the operations performed in another of the operating environments; and

assigning the hardware resources to the multiple operating environments in accordance with the allocation policy, so as to isolate the multiple operating environments from one another.

2. The method according to claim 1, and comprising running in one or more of the operating environments respective client programs for communicating with remote servers.

3. The method according to claim 2, wherein running the client programs comprises performing data processing functions locally in the computer by at least one of the client programs.

4. The method according to claim 3, wherein performing the data processing functions comprises performing multimedia processing functions locally in the computer.

5. The method according to claim 4, wherein performing the multimedia processing functions comprises performing at least one processing type selected from a group of types consisting of Voice over Internet Protocol (VoIP) processing and video streaming processing.

6. The method according to claim 2, wherein running the client programs comprises performing Virtual Private Network (VPN) processing functions locally in the computer by at least one of the client programs.

7. The method according to claim 2, wherein running the client programs comprises performing security functions locally in the computer by at least one of the client programs.

8. The method according to claim 2, wherein running the client programs comprises performing Internet browsing functions locally in the computer by at least one of the client programs.

9. The method according to claim 1, and comprising running in one or more of the operating environments respective applications that execute locally in the computer.

10. The method according to claim 1, and comprising running in one or more of the operating environments respective software appliances, each running a respective single-purpose application.

11. The method according to claim 1, and comprising communicating with a management system external to the computer, so as to enable the management system to apply authentication testing to the computer.

12. The method according to claim 1, wherein assigning the hardware resources comprises enforcing a predefined isolation policy on the operating environments.

13. The method according to claim 12, wherein enforcing the isolation policy comprises dividing the operating environments into groups, and allowing interaction among the operating environments only within each of the groups.

14. The method according to claim 13, wherein the isolation policy defines allowed sharing of data among the operating environments within each of the groups.

15. The method according to claim 1, and comprising provisioning a set of the operating environments for use by a given user responsively to a predefined profile of the given user.

16. The method according to claim 15, wherein provisioning the operating environments comprises retrieving one or more of the operating environments in the set over a network.

17. The method according to claim 15, wherein at least one of the operating environments in the set comprises a software appliance, which runs a single-purpose application.

18. The method according to claim 15, wherein provisioning the operating environments comprises authenticating the given user and provisioning the operating environments responsively to successful authentication.

19. The method according to claim 1, and comprising merging respective Graphical User Interfaces (GUIs) of two or more of the operating environments to produce a unified GUI, and presenting the unified GUI to a user of the computer.

20. The method according to claim 1, wherein the hardware resources comprise at least one resource type selected from a group of types consisting of processor resources, memory resources, network interface resources and peripheral devices.

21. A computer, comprising:

a memory, which is operative to store software code; and

a processor, which is configured to execute the software code so as to run multiple operating environments using hardware resources of the computer, to define and manage an allocation policy of the hardware resources, which eliminates effects from operations performed in one of the operating environments on the operations performed in another of the operating environments, and to assign the hardware resources to the multiple operating environments in accordance with the allocation policy, so as to isolate the multiple operating environments from one another.

22. The computer according to claim 21, wherein the processor is configured to run in one or more of the operating environments respective client programs for communicating with remote servers.

23. The computer according to claim 22, wherein the processor is configured to perform data processing functions locally by at least one of the client programs.

24. The computer according to claim 23, wherein the data processing functions comprise multimedia processing functions.

25. The computer according to claim 24, wherein the multimedia processing functions comprise at least one processing type selected from a group of types consisting of Voice over Internet Protocol (VoIP) processing and video streaming processing.

26. The computer according to claim 22, wherein the processor is configured to perform Virtual Private Network (VPN) processing functions locally by at least one of the client programs.

27. The computer according to claim 22, wherein the processor is configured to perform security functions locally by at least one of the client programs.

28. The computer according to claim 22, wherein the processor is configured to perform Internet browsing functions locally by at least one of the client programs.

29. The computer according to claim 21, wherein the processor is configured to run in one or more of the operating environments respective applications that execute locally in the computer.

30. The computer according to claim 21, wherein the processor is configured to run in one or more of the operating environments respective software appliances, each running a respective single-purpose application.

31. The computer according to claim 21, wherein the processor is configured to communicate with a management system external to the computer, so as to enable the management system to apply authentication testing to the computer.

32. The computer according to claim 21, wherein the processor is configured to enforce a predefined isolation policy on the operating environments.

33. The computer according to claim 32, wherein the processor is configured to enforce the isolation policy by dividing the operating environments into groups, and allowing interaction among the operating environments only within each of the groups.

34. The computer according to claim 33, wherein the isolation policy defines allowed sharing of data among the operating environments within each of the groups.

35. The computer according to claim 21, wherein the processor is configured to provision a set of the operating environments for use by a given user responsively to a predefined profile of the given user.

36. The computer according to claim 35, wherein the processor is configured to retrieve one or more of the operating environments in the set over a network.

37. The computer according to claim 35, wherein at least one of the operating environments in the set comprises a software appliance, which runs a single-purpose application.

38. The computer according to claim 35, wherein the processor is configured to authenticate the given user and to provision the operating environments responsively to successful authentication.

39. The computer according to claim 21, wherein the processor is configured to merge respective Graphical User Interfaces (GUIs) of two or more of the operating environments to produce a unified GUI, and to present the unified GUI to a user of the computer.

40. The computer according to claim 21, wherein the hardware resources comprise at least one resource type selected from a group of types consisting of processor resources, memory resources, network interface resources and peripheral devices.

41. A computer software product for operating a computer that includes hardware resources and runs multiple operating environments using the hardware resources, the product comprising a computer-readable medium, in which program instructions are stored, which instructions, when read by a processor, cause the processor to define and manage an allocation policy of the hardware resources, which eliminates effects from operations performed in one of the operating environments on the operations performed in another of the operating environments, and to assign the hardware resources to the multiple operating environments in accordance with the allocation policy, so as to isolate the multiple operating environments from one another.