Transferring files using a virtualized application

• US 8,839,245 B1
• Filed: 06/18/2012
• Issued: 09/16/2014
• Est. Priority Date: 06/18/2012
• Status: Active Grant

• Current Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Original Assignee: Bromium (HP Inc.)
• Inventors: Khajuria, Deepak, Bondalapati, Kiran, Kapoor, Vikram, Banga, Gaurav, Pratt, Ian
• Primary Examiner(s): Puente, Emerson
• Assistant Examiner(s): KIM, SISLEY NAHYUN
• Application Number:
  US13/526,354
• Time in Patent Office: 820 Days
• Field of Search: None
• US Class Current: 718/1
• CPC Class Codes: G06F 16/188 Virtual file systems
• CPC Class Codes: G06F 2009/45595 Network integration; Enabling network access in virtual machine instances
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects

Abstract

Approaches for transferring a file using a virtualized application. A virtualized application executes within a virtual machine residing on a physical machine. When the virtualized application is instructed to download a file stored external to the physical machine, the virtualized application displays an interface which enables at least a portion of a file system, maintained by a host OS, to be browsed while preventing files stored within the virtual machine to be browsed. Upon the virtualized application receiving input identifying a target location within the file system, the virtualized application stores the file at the target location. The virtualized application may also upload a file stored on the physical machine using an interface which enables at least a portion of a file system of a host OS to be browsed while preventing files in the virtual machine to be browsed.

Claims

1. One or more non-transitory computer-readable storage mediums storing one or more sequences of instructions for transferring a file using a virtualized application, which when executed by one or more processors, cause:

executing a first portion of the virtualized application within a host operating system executing on a physical machine;

executing a second portion of the virtualized application within a virtual machine running on said physical machine,

wherein the first portion of the virtualized application is responsible for displaying content on the physical machine, and wherein the second portion of the virtualized application is responsible for retrieving said content from across a network and cannot display said content on the physical machine;

upon the virtualized application receiving an instruction to download one or more files stored external to the physical machine, the virtualized application displaying an interface which enables at least a portion of a file system, maintained by the host operating system, to be browsed while preventing files stored within the virtual machine to be browsed; and

upon the virtualized application receiving input identifying a target location within said file system, the virtualized application storing said one or more files at said target location.

2. The one or more non-transitory computer-readable storage mediums of claim 1, wherein the virtualized application consults policy data to determine which portions of the file system are visible to the virtualized application.

3. The one or more non-transitory computer-readable storage mediums of claim 1, wherein the virtualized application is one of a virtualized web browser or a virtualized email application.

4. The one or more non-transitory computer-readable storage mediums of claim 1, wherein execution of the one or more sequences of instructions further causes:

as a result of consulting a policy, storing data that identifies the one or more files stored at the target location as untrusted documents.

5. The one or more non-transitory computer-readable storage mediums of claim 1, wherein execution of the one or more sequences of instructions further causes:

storing a record, in a log file, which evidences that the one or more files were stored at the target location.

6. The one or more non-transitory computer-readable storage mediums of claim 1, wherein the virtualized application storing said one or more files comprises:

prior to storing the one or more files at said target location, storing the one or more files at an intermediate location;

performing analysis on said one or more files at said intermediate location to render the one or more files safe or verify whether the one or more files should be deemed safe; and

only upon the one or more files being deemed safe as a result of performing said analysis, moving said one or more files from said intermediate location to said target location.

7. The one or more non-transitory computer-readable storage mediums of claim 6, wherein the intermediate location is one of a plurality of intermediate locations that are each associated within a particular virtual machine in which a file transfer was initiated.

8. The one or more non-transitory computer-readable storage mediums of claim 6, wherein the intermediate location is a virtual machine that is instantiated for the purpose of performing said analysis on said one or more files.

9. The one or more non-transitory computer-readable storage mediums of claim 6,

wherein moving said one or more files from said intermediate location to said target location comprises:

determining whether to move said one or more files from said intermediate location to said target location via a network connection, via copying to disk, or via copying into memory based on the size of said one or more files.

10. One or more non-transitory computer-readable storage mediums storing one or more sequences of instructions for transferring a file using a virtualized application, which when executed by one or more processors, cause:

executing a first portion of the virtualized application within a host operating system executing on a physical machine;

executing a second portion of the virtualized application within a virtual machine running on a physical machine;

wherein the first portion of the virtualized application is responsible for displaying content on the physical machine, and wherein the second portion of the virtualized application is responsible for retrieving said content from across a network and cannot display said content on the physical machine;

upon the virtualized application receiving an instruction to download one or more files stored external to the physical machine, the virtualized application displaying an interface which enables at least a portion of a file system, maintained by a host operating system executing on the physical machine,

to be browsed while preventing any files stored within the virtual machine to be browsed; and

upon the virtualized application receiving input identifying a target location within said file system, performing;

storing said one or more files at a quarantined location external to said file system, and

storing linking data, at the target location within the file system, which is used to traverse to the one or more files at the quarantined area.

11. One or more non-transitory computer-readable storage mediums storing one or more sequences of instructions for transferring a file using a virtualized application, which when executed by one or more processors, cause:

executing a first portion of the virtualized application within a host operating system executing on a physical machine;

executing a second portion of the virtualized application within a virtual machine that is executing on a physical machine;

wherein the first portion of the virtualized application is responsible for displaying content on the physical machine, and wherein the second portion of the virtualized application is responsible for retrieving said content from across a network and cannot display said content on the physical machine;

upon the virtualized application receiving an instruction to upload one or more files stored on the physical machine to a target location external to the physical machine, the virtualized application displaying an interface which enables at least a portion of a file system, maintained by a host operating system executing on the physical machine, to be browsed while preventing files stored within the virtual machine to be browsed; and

upon the virtualized application receiving input identifying one or more files in said file system, the virtualized application causing said one or more files to be stored at said target location.

12. The one or more non-transitory computer-readable storage mediums of claim 11, wherein execution of the one or more sequences of instructions further causes:

storing a record, in a log file, which evidences that the one or more files were stored at the target location.

13. An apparatus for transferring a file using a virtualized application, comprising:

one or more processors; and

one or more non-transitory computer-readable storage mediums storing one or more sequences of instructions, which when executed, cause;

executing a first portion of the virtualized application within a host operating system executing on a physical machine;

executing a second portion of the virtualized application within a virtual machine running on a physical machine;

wherein the first portion of the virtualized application is responsible for displaying content on the physical machine, and wherein the second portion of the virtualized application is responsible for retrieving said content from across a network and cannot display said content on the physical machine;

upon the virtualized application receiving an instruction to download one or more files stored external to the physical machine, the virtualized application displaying an interface which enables at least a portion of a file system, maintained by a host operating system executing on the physical machine, to be browsed while preventing files stored within the virtual machine to be browsed; and

upon the virtualized application receiving input identifying a target location within said file system, the virtualized application storing said one or more files at said target location.

14. The apparatus of claim 13, wherein the virtualized application consults policy data to determine which portions of the file system are visible to the virtualized application.

15. The apparatus of claim 13, wherein the virtualized application is one of a virtualized web browser or a virtualized email application.

16. The apparatus of claim 13, wherein execution of the one or more sequences of instructions further causes:

as a result of consulting a policy, storing data that identifies the one or more files stored at the target location as untrusted documents.

17. The apparatus of claim 13, wherein execution of the one or more sequences of instructions further causes:

storing a record, in a log file, which evidences that the one or more files were stored at the target location.

18. The apparatus of claim 13, wherein the virtualized application storing said one or more files comprises:

prior to storing the one or more files at said target location, storing the one or more files at an intermediate location;

performing analysis on said one or more files at said intermediate location to render the one or more files safe or verify whether the one or more files should be deemed safe; and

only upon the one or more files being deemed safe as a result of performing said analysis, moving said one or more files from said intermediate location to said target location.

19. The apparatus of claim 18, wherein the intermediate location is one of a plurality of intermediate locations that are each associated within a particular virtual machine in which a file transfer was initiated.

20. The apparatus of claim 18, wherein the intermediate location is a virtual machine that is instantiated for the purpose of performing said analysis on said one or more files.

21. The apparatus of claim 18, wherein moving said one or more files from said intermediate location to said target location comprises:

determining whether to move said one or more files from said intermediate location to said target location via a network connection, via copying to disk, or via copying into memory based on the size of said one or more files.

22. An apparatus for transferring a file using a virtualized application, comprising:

one or more processors; and

one or more non-transitory computer-readable storage mediums storing one or more sequences of instructions, which when executed, cause;

executing a first portion of the virtualized application within a host operating system executing on a physical machine;

executing a second portion of the virtualized application within a virtual machine running on a physical machine;

wherein the first portion of the virtualized application is responsible for displaying content on the physical machine, and wherein the second portion of the virtualized application is responsible for retrieving said content from across a network and cannot display said content on the physical machine;

upon the virtualized application receiving an instruction to download one or more files stored external to the physical machine, the virtualized application displaying an interface which enables at least a portion of a file system, maintained by a host operating system executing on the physical machine, to be browsed while preventing any files stored within the virtual machine to be browsed; and

upon the virtualized application receiving input identifying a target location within said file system, performing;

storing said one or more files at a quarantined location external to said file system, and

storing linking data, at the target location within the file system, which is used to traverse to the one or more files at the quarantined area.

23. An apparatus for transferring a file using a virtualized application, comprising:

one or more processors; and

one or more non-transitory computer-readable storage mediums storing one or more sequences of instructions, which when executed, cause;

executing a first portion of the virtualized application within a host operating system executing on a physical machine;

executing a second portion of the virtualized application within a virtual machine that is executing on a physical machine;

wherein the first portion of the virtualized application is responsible for displaying content on the physical machine, and wherein the second portion of the virtualized application is responsible for retrieving said content from across a network and cannot display said content on the physical machine;

upon the virtualized application receiving an instruction to upload one or more files stored on the physical machine to a target location external to the physical machine, the virtualized application displaying an interface which enables at least a portion of a file system, maintained by a host operating system executing on the physical machine, to be browsed while preventing files stored within the virtual machine to be browsed; and

upon the virtualized application receiving input identifying one or more files in said file system, the virtualized application causing said one or more files to be stored at said target location.

24. The apparatus of claim 23, wherein execution of the one or more sequences of instructions further causes:

storing a record, in a log file, which evidences that the one or more files were stored at the target location.