System and method for application isolation

• US 8,782,670 B2
• Filed: 04/10/2009
• Issued: 07/15/2014
• Est. Priority Date: 04/10/2009
• Status: Expired due to Fees

• Current Assignee: Philips North America LLC (Koninklijke Philips N.V.)
• Original Assignee: Open Invention Network LLC
• Inventors: Havemose, Allan
• Primary Examiner(s): Truong, Lechi
• Application Number:
  US12/421,694
• Publication Number:
  US 20100262977A1
• Time in Patent Office: 1,922 Days
• Field of Search: 719/310, 709/225
• US Class Current: 719/319
• CPC Class Codes: G06F 16/955 using information identifiers, e.g. uniform resource locators [URL]
• CPC Class Codes: G06F 2209/542 Intercept
• CPC Class Codes: G06F 8/60 Software deployment
• CPC Class Codes: G06F 8/61 Installation
• CPC Class Codes: G06F 9/45533 Hypervisors; Virtual machine monitors
• CPC Class Codes: G06F 9/52 Program synchronisation; Mutual exclusion, e.g. by means of semaphores
• CPC Class Codes: G06F 9/54 Interprogram communication
• CPC Class Codes: G06F 9/541 via adapters, e.g. between incompatible applications
• CPC Class Codes: G06F 9/545 where tasks reside in different layers, e.g. user- and kernel-space
• CPC Class Codes: H04L 47/788 Autonomous allocation of resources
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416

Abstract

A system, method, and computer readable medium for providing application isolation to one or more applications. The system may include an isolated environment including application files and executables, and an interception layer intercepting access to system resources and interfaces. The system may further include an interception database maintaining mapping between the system resources inside the isolated environment and outside, and a host operating system, wherein the isolated environments are saved on at least one of a local and remote storage.

Claims

1. A computer system for providing application isolation to one or more applications, the computer system comprising:

computer system memory comprised of one or more memory locations configured to store said one or more applications;

one or more central processing units (CPUs) operatively connected to said computer system memory and configured to execute said one or more applications on a host with a host operating system;

an isolated environment including application files and executables;

an interception layer configured to intercept user-space access to said host operating system resources and user-space access to said host operating system interfaces; and

an interception database configured to maintain mappings between the operating system resources as requested by the one or more applications when running inside the isolated environment and the corresponding host operating system resources outside the isolated environment,

wherein the mappings in said interception database are created during installation and running of said one or more applications;

wherein the isolated environments are saved on at least one of a local and remote storage;

wherein the isolated environment is prepared for network deployment by creating a copy of said isolated environment on the remote storage and delivering the copy of said isolated environment over a network, wherein said copy is created after the host operating system has booted;

wherein the one or more applications within the isolated environment are run remotely over the network and changes to the isolated environment are stored on a remote environment.

2. The computer system according to claim 1, wherein the isolated environment is deployed on a node by copying the isolated environment from the at least one of the local and remote storage to the node;

and wherein said isolate environment is deployed without use of Input/Output (I/O) virtualization.

3. The computer system according to claim 1, wherein the one or more applications within an isolated environment can be deployed on a node without requiring any application installation or configuration;

and wherein said isolated environment is deployed without use of Input/Output (I/O) virtualization.

4. The computer system according to claim 1, wherein the one or more applications within the isolated environment are run remotely over a network and changes to the isolated environment are stored locally;

and wherein the one or more applications within the isolated environment are run remotely over a network without using Input/Output (I/O) virtualization.

5. The computer system according to claim 1, wherein the isolated environment is stored to persistent storage and transmitted to a remote location.

6. The computer system according to claim 5, wherein the remote location uses the isolated environment to run the one or more applications without requiring any installations.

7. The computer system according to claim 5, wherein the remote location loads the isolated environment and runs the applications in response to a disaster recovery.

8. A method for providing application isolation to one or more applications executing on a host with host operating system, the method comprising:

executing said one or more applications on a host with a host operating system;

providing an isolated environment including application files and executables;

intercepting user-space access to said host operating system resources and user-space access to said host operating system interfaces;

maintaining database mappings between the operating system resources as requested by the one or more applications when running inside an isolated environment and the corresponding host operating system resources outside the isolated environment, wherein said mappings are created during installation and running of said one or more applications; and

saving the isolated environments on at least one of a local and remote storage;

preparing the isolated environment for network deployment by creating a copy said isolated environment on the remote storage and delivering the copy of said isolated environment over a network;

wherein said copy is created after the host operating system has booted;

remotely running the one or more applications within the isolated environment over the network and storing changes to the isolated environment on a remote environment.

9. The method according to claim 8, further comprising deploying the isolated environment on a node by copying the isolated environment from the at least one of the local and remote storage to the node after the host operating system has booted without using Input/Output (I/O) virtualization.

10. The method according to claim 8, further comprising deploying the one or more applications within an isolated environment on a node without requiring any application installation or configuration without using Input/Output (I/O) virtualization.

11. The method according to claim 8, further comprising remotely running the one or more applications within the isolated environment over a network and locally storing changes to the isolated environment without using Input/Output (I/O) virtualization.

12. The method according to claim 8, further comprising remotely running the one or more applications within the isolated environment over the network and storing all changes to the isolated environment on a remote environment.

13. A non-transitory computer readable storage medium for providing application isolation to one or more applications executing on a host with a host operating system, the computer readable medium including instructions executable by a computer, the instructions for:

executing said one or more applications on a host with a host operating system;

providing an isolated environment including application files and executables;

intercepting user-space access to said host operating system resources and user-space access to said host operating system interfaces;

maintaining database mappings between the operating system resources as requested by the one or more applications when running inside an isolated environment and the corresponding host operating system resources outside the isolated environment,

wherein said mappings are created during installation and running of said one or more applications; and

saving the isolated environments on at least one of a local and remote storage;

preparing the isolated environment for network deployment by creating a copy said isolated environment on the remote storage and delivering the copy of said isolated environment over a network;

wherein said copy is created after the host operating system has booted;

remotely running the one or more applications within the isolated environment over the network and storing changes to the isolated environment on a remote environment.

14. The non-transitory computer readable storage medium according to claim 13, wherein the instructions are further for deploying the isolated environment on a node by copying the isolated environment from the at least one of the local and remote storage to the node after the host operating system has booted without the use of Input/Output (I/O) virtualization.

15. The non-transitory computer readable storage medium according to claim 13, wherein the instructions are further for deploying the one or more applications within an isolated environment on a node without requiring any application installation or configuration without the use of Input/Output (I/O) virtualization.

16. The non-transitory computer readable storage medium according to claim 13, wherein the instructions are further for preparing the isolated environment for network deployment by creating a copy on the remote storage and delivering the copy over a network without the use of Input/Output (I/O) virtualization.