System and method for application isolation

• US 8,341,631 B2
• Filed: 04/10/2009
• Issued: 12/25/2012
• Est. Priority Date: 04/10/2009
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: Open Invention Network LLC
• Inventors: Havemose, Allan
• Primary Examiner(s): Wu, Qing
• Application Number:
  US12/421,691
• Publication Number:
  US 20100262970A1
• Time in Patent Office: 1,355 Days
• Field of Search: None
• US Class Current: 718/100
• CPC Class Codes: G06F 11/00 Error detection; Error correction; Monitoring error detection, correction or monitoring in information storage based on relative movement between record carrier and transducer G11B20/18; monitoring, i.e. supervising the progress of recording or reproducing G11B27/36; in static stores G11C29/00
• CPC Class Codes: G06F 11/008 Reliability or availability analysis
• CPC Class Codes: G06F 2209/542 Intercept
• CPC Class Codes: G06F 8/61 Installation
• CPC Class Codes: G06F 8/62 Uninstallation
• CPC Class Codes: G06F 9/455 Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
• CPC Class Codes: G06F 9/46 Multiprogramming arrangements
• CPC Class Codes: G06F 9/461 Saving or restoring of program or task context
• CPC Class Codes: G06F 9/50 Allocation of resources, e.g. of the central processing unit [CPU]
• CPC Class Codes: G06F 9/545 where tasks reside in different layers, e.g. user- and kernel-space

Abstract

A system, method, and computer readable medium for providing application isolation to one or more applications and their associated resources. The system may include one or more isolated environments including application files and executables, and one or more interception layers intercepting access to system resources and interfaces. Further, the system may include an interception database maintaining mapping between the system resources inside the one or more isolated environments and outside, and a host operating system. The one or more applications may be isolated from other applications and the host operating system while running within the one or more isolated environments.

Claims

1. A system for providing application isolation to one or more applications, the system comprising:

one or more central processing units configured to interact with;

one or more isolated environments including application files and executables;

one or more interception layers configured to intercept access to host operating system resources and host operating system interfaces;

an interception database configured to maintain mapping between the system resources inside the one or more isolated environments and outside;

wherein the one or more applications are isolated from other applications and the host operating system while running within the one or more isolated environments; and

wherein the one or more isolated environments are created during installation of the one or more applications, and updates to the one or more isolated environments occur as the one or more applications use additional resources while running;

wherein the one or more isolated environments are removed as part of uninstalling the one or more applications;

wherein the one or more isolated environments are stored for retrieval at a later time after the one or more applications are uninstalled.

2. The system according to claim 1, wherein the host operating system is one of a Microsoft Windows based operating system and a Linux based operating system.

3. The system according to claim 1, wherein the one or more isolated environments are stored on a local storage.

4. The system according to claim 1, wherein the one or more isolated environments are stored on a networked storage and the one or more applications are delivered over a network.

5. The system according to claim 1, wherein the one or more interception layers intercept calls to the host operating system and system libraries created by the one or more applications, and using the interception database, translate parameters and context between a host environment and the one or more isolated environments.

6. The system according to claim 1, wherein each of the one or more applications is installed into its own isolated environment.

7. The system according to claim 1, wherein two or more applications are installed into a shared isolated environment.

8. The system according to claim 7, wherein the two or more applications share resources inside the shared isolated environment.

9. The system according to claim 1, wherein two or more applications are installed into separate isolated environments and the one or more applications run concurrently in the separate isolated environments.

10. The system according to claim 1, wherein a first application of the one or more applications is installed twice into separate isolated environments, and the separate isolated environments run concurrently and independently.

11. A method for providing application isolation to one or more applications, the method comprising:

intercepting access to system resources and interfaces at one or more interception layers;

maintaining mapping between the system resources inside one or more isolated environments and outside;

isolating the one or more applications from other applications and a host operating system while running within the one or more isolated environments; and

creating the one or more isolated environments during installation of the one or more applications, and updating the one or more isolated environments as the one or more applications use additional resources while running;

wherein the one or more isolated environments are removed as part of uninstalling the one or more applications; and

wherein the one or more isolated environments are stored for retrieval at a later time after the one or more applications are uninstalled.

12. A non-transitory computer readable medium for providing application isolation to one or more applications, the computer readable medium including instructions executable by a computer, the instructions for:

intercepting access to system resources and interfaces at one or more interception layers;

maintaining mapping between the system resources inside one or more isolated environments and outside;

isolating the one or more applications from other applications and a host operating system while running within the one or more isolated environments; and

creating the one or more isolated environments during installation of the one or more applications, and updating the one or more isolated environments as the one or more applications use additional resources while running;

wherein the one or more isolated environments are one of removed as part of uninstalling the one or more applications, and stored for retrieval at a later time after the one or more applications are uninstalled.