Methods and systems for launching applications into existing isolation environments

• US 8,090,797 B2
• Filed: 05/02/2009
• Issued: 01/03/2012
• Est. Priority Date: 05/02/2009
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Chinta, Madhav, Raj, SamArun
• Primary Examiner(s): HIGA, BRENDAN Y
• Application Number:
  US12/434,629
• Publication Number:
  US 20100281102A1
• Time in Patent Office: 976 Days
• Field of Search: 709213-229, 709204-205, 709/201, 709/203, 718/1, 718100-104
• US Class Current: 709/217
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine

Abstract

Methods and systems that can launch applications into existing isolation environments do so by executing a run module on a computing machine to intercept requests to execute an application. A client communicating with the computing machine generates requests to execute an application on the computing machine. A run module identifies a profile associated with the requested application and queries an application delivery service to identify at least one isolation environment that corresponds to the profile. The run module receives from the application delivery service a response that identifies a first isolation environment associated with the application, and issues a command to a launch module to launch the application into the first isolation environment.

Claims

1. A method for launching applications into existing isolation environments, the method comprising:

receiving, by a run module executing on a computing machine, a request by a user to execute an application on the computing machine;

identifying, by the run module, a profile associated with the application;

querying, by the run module, an application delivery service executing on the computing machine to identify at least one isolation environment corresponding to the profile;

determining that no isolation environment on the computing machine corresponds to the profile;

launching, by the run module, a launch module in a suspended mode responsive to determining that no isolation environment corresponds to the profile;

issuing, by the run module, a command to the application delivery service to isolate the launch module;

sending, by the run module, application information to the launch module; and

issuing, by the run module, a command to the launch module to resume execution.

2. The method of claim 1, wherein sending application information comprises transmitting a location of the application.

3. The method of claim 1, wherein isolating the launch module comprises creating an isolation environment.

4. The method of claim 3, wherein an address for the isolation environment is identified.

5. The method of claim 1, wherein isolating the launch module comprises generating one or more isolation scopes having a set of native resources corresponding to the profile.

6. The method of claim 5, wherein isolating the launch module further comprises generating a user isolation scope and an application isolation scope having native resources corresponding to the profile.

7. The method of claim 1, wherein isolating the launch module comprises generating an application isolation layer and a user isolation layer having attributes corresponding to the profile.

8. The method of claim 1, wherein issuing a command to the launch module to resume execution comprises sending a command to the launch module to cease executing delay modules within the launch module.

9. A system for launching applications into existing isolation environments, the system comprising:

a computing machine communicating with a client generating a request to execute an application on the computing machine, the application associated with a profile;

an application delivery service executing on the computing machine;

a launch module executing on the computing machine; and

a run module executing on the computing machine, the run module;

receiving the client request,

querying the application delivery service to identify at least one isolation environment corresponding to the profile,

determining that no isolation environment on the computing machine corresponds to the profile;

launching a launch module in a suspended mode responsive to determining that no isolation environment corresponds to the profile;

issuing a command to the application delivery service to isolate the launch module;

sending application information to the launch module; and

issuing a command to the launch module to resume execution.

10. The system of claim 9, wherein sending application information comprises transmitting a location of the application.

11. The system of claim 9, wherein isolating the launch module comprises creating an isolation environment.

12. The system of claim 11, wherein an address for the isolation environment is identified.

13. The system of claim 9, wherein isolating the launch module comprises generating one or more isolation scopes having a set of native resources corresponding to the profile.

14. The system of claim 13, wherein isolating the launch module further comprises generating a user isolation scope and an application isolation scope having native resources corresponding to the profile.

15. The system of claim 9, wherein isolating the launch module comprises generating an application isolation layer and a user isolation layer having attributes corresponding to the profile.

16. The system of claim 9, wherein issuing a command to the launch module to resume execution comprises sending a command to the launch module to cease executing delay modules within the launch module.