Systems and methods for patching computer programs

• US 8,291,407 B2
• Filed: 09/17/2007
• Issued: 10/16/2012
• Est. Priority Date: 06/12/2002
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Greenwood, Mark A., Cook, Randall R., Hopwood, Scott G., Palethorpe, Robert P.
• Primary Examiner(s): ZHEN, WEI Y
• Assistant Examiner(s): Rampuria, Satish
• Application Number:
  US11/901,327
• Publication Number:
  US 20080295086A1
• Time in Patent Office: 1,856 Days
• Field of Search: 717168-178
• US Class Current: 717/174
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57
• CPC Class Codes: G06F 8/656 while running

Abstract

The disclosure is directed to systems and methods for patching computer programs. In one example, a patch is virtually installed to a computing device having a base file system and configuration, a computer program, and a patch layering subsystem. The virtual installation may include storing content of the patch to a patch layer, and generating and storing mapping data defining at least one relationship between the content in the patch layer and content in the base file system and configuration. The virtually installed patch may be enabled, including applying the mapping data to the patch layering subsystem such that the patch layering subsystem is configured for selectively redirecting access requests from the base file system and configuration to the patch layer. In certain embodiments, the enabled patch may be disabled by reversing the application of the mapping data to the patch layering subsystem.

Claims

1. A method, comprising:

virtually installing a computer program patch to a computing device having a base file system and configuration, a computer program, and a patch layering subsystem, said step of virtually installing said computer program patch including;

creating a patch layer that is isolated from said base file system and configuration such that patches stored to said patch layer are virtually installed and contents of said base file system and configuration are preserved instead of being overwritten;

storing content of said patch to said patch layer, and

generating and storing mapping data defining at least one relationship between said content in said patch layer and content of said base file system and configuration; and

enabling said patch layer, including applying said mapping data to said patch layering subsystem such that said patch layering subsystem, while enabled, is configured to intercept access requests and selectively redirect the access requests from said base file system and configuration to said patch layer, wherein said patch layering subsystem does not redirect the access requests when said patch layer is disabled.

2. The method of claim 1, further comprising:

disabling said patch layer, including reversing said step of applying said mapping data to said patch layering subsystem such that said patch layering subsystem is configured not to redirect the access requests to said patch layer.

3. The method of claim 1, further comprising:

committing said virtually installed patch to said base file system and configuration, including performing an actual install of at least a subset of said content in said patch layer to said base file system and configuration based on said mapping data.

4. The method of claim 1, further comprising:

virtually installing another computer program patch to said computing device, said step of virtually installing said another computer program patch including;

storing content of said another computer program patch to another patch layer,

generating and storing other mapping data defining at least one relationship between said content in said another patch layer and said content of said base file system and configuration, and

prioritizing said patch layer and said another patch layer with respect to one another; and

enabling said another patch layer, including applying said other mapping data to said patch layering subsystem such that said patch layering subsystem is configured for selectively redirecting the access requests from said base file system and configuration to said another patch layer.

5. The method of claim 4, further comprising:

combining said patch layer and said another patch layer into a composite patch layer, and

combining said mapping data and said other mapping data to form composite mapping data corresponding with said composite patch layer.

6. A system, comprising:

a computing device having a computer program and a base file system and configuration; and

a patch layering subsystem installed to said computing device and configured to;

create a patch layer that is isolated from said base file system and configuration such that patches stored to said patch layer are virtually installed and contents of said base file system and configuration are preserved instead of being overwritten;

virtually install a patch for said computer program to said patch layer by storing content of said patch to said patch layer and by generating and storing mapping data defining at least one relationship between said content in said patch layer and content of said base file system and configuration; and

enable said patch layer, including applying said mapping data to said patch layering subsystem such that said patch layering subsystem such that said patch layering subsystem, while enabled, is configured to intercept access requests and selectively redirect the access requests from said base file system and configuration to said patch layer, and

disable said patch layer such that said patch layering subsystem is configured not to redirect the access requests to said patch layer.

7. The system of claim 6, wherein said patch layering subsystem is configured to virtually install said patch by:

storing content of said patch to said patch layer, said patch layer being separate from said base file system and configuration, and

generating and storing mapping data defining at least one relationship between said content in said patch layer and content in said base file system and configuration.

8. The system of claim 7, wherein said patch layering subsystem is configured to enable said patch layer by activating said mapping data for use in intercepting the access requests and to disable said patch layer by reversing said activating of said mapping data.

9. The system of claim 7, wherein said patch layering subsystem is configured to commit said patch to said base file system and configuration using said mapping data and said content of said patch layer.

10. The system of claim 6, wherein said patch layering subsystem is further configured to:

virtually install another patch for said computer program to another patch layer,

prioritize said patch layer and said another patch layer in relation to one another,

enable said another patch layer such that said patch layering subsystem is configured for selectively redirecting the access requests from said base file system and configuration to said another patch layer, and

disable said another patch layer such that said patch layering subsystem is configured not to redirect the access requests to said another patch layer.

11. The system of claim 10, wherein said patch layering subsystem is configured to prioritize said patch layer and said another patch layer based on at least one of patch version information, patch release date information, and patch timestamp information.

12. The system of claim 10, wherein said patch layering subsystem is further configured to combine said patch layer and said another patch layer into a composite patch layer.

13. The system of claim 10, wherein said another patch is intended to supersede said patch, said patch layering subsystem being configured to recognize supersedure information associated with said another patch layer and to automatically disable said patch layer when said another patch layer is enabled.

14. The system of claim 6, further comprising a patch control subsystem communicatively coupled to said computing device by a network, said patch control subsystem being configured to:

deliver said patch to said computing device,

transmit an enable command to said computing device, said enable command being configured to instruct said patch layering subsystem to enable said patch layer, and

transmit a disable command to said computing device, said disable command being configured to instruct said patch layering subsystem to disable said patch layer.

15. The system of claim 14, wherein said patch control subsystem is further configured to transmit a test command to said computing device, said test command being configured to instruct said computing device to perform at least one test operation for testing said enabled patch layer.

16. The system of claim 14, wherein said patch control subsystem is further configured to transmit a commit command to said computing device, said commit command being configured to instruct said patch layering subsystem to commit said patch layer to said base file system and configuration.

17. A computer program product embodied in a non-transitory computer readable medium and comprising computer instructions executable by a computing device to perform the functions of:

virtually installing a computer program patch to the computing device, including;

creating a patch layer that is isolated from a base file system and configuration such that patches stored to said patch layer are virtually installed and contents of said base file system and configuration are preserved instead of being overwritten;

storing patch content associated with said computer program patch to said patch layer, and

generating and storing mapping data defining at least one relationship between said patch content in said patch layer and content of said base file system and configuration of the computing device; and

enabling said patch layer, including activating said mapping data for use in intercepting access requests and selectively redirecting the access requests from said base file system and configuration to said patch layer, wherein a patch layering subsystem does not redirect the access requests when said patch layer is disabled.

18. The computer program product of claim 17, further comprising computer instructions executable by the computing device to perform the functions of:

intercepting an access request;

determining from said mapping data whether requested content is in said patch layer;

redirecting said access request to said patch layer based on said mapping data when it is determined that said requested content is in said patch layer; and

permitting said access request to continue to said base file system and configuration when it is determined that said requested content is not in said patch layer.

19. The computer program product of claim 17, wherein virtually installing said computer program patch comprises isolating said computer program patch from said base file system and configuration without overwriting memory locations of said base file system and configuration.

20. The computer program product of claim 17, further comprising computer instructions executable by the computing device to perform the function of committing said virtually installed computer program patch to said base file system and configuration based on said mapping data by overwriting memory locations of said base file system and configuration with said computer program patch.