System and method for securely hosting applications

• US 8,979,655 B2
• Filed: 09/14/2011
• Issued: 03/17/2015
• Est. Priority Date: 12/10/2002
• Status: Active Grant

• Current Assignee: Sony Interactive Entertainment LLC (Sony Group Corp.)
• Original Assignee: OL2 Incorporated (Sony Group Corp.)
• Inventors: Mamtani, Vinod, McLarnon, Brett, Markello, Jay, Heath, Scott
• Primary Examiner(s): D'Agostino, Paul A
• Assistant Examiner(s): DOSHI, ANKIT B
• Application Number:
  US13/232,990
• Publication Number:
  US 20120124573A1
• Time in Patent Office: 1,280 Days
• Field of Search: None
• US Class Current: 463/40
• CPC Class Codes: A63F 13/355 Performing operations on behalf of clients with restricted processing capabilities, e.g. servers transform changing game scene into an encoded video stream for transmitting to a mobile phone or a thin client
• CPC Class Codes: A63F 13/71 using secure communication between game devices and game servers, e.g. by encrypting game data or authenticating players
• CPC Class Codes: A63F 2300/402 Communication between platforms, i.e. physical link to protocol
• CPC Class Codes: A63F 2300/407 Data transfer via internet
• CPC Class Codes: A63F 2300/534 for network load management, e.g. bandwidth optimization, latency reduction
• CPC Class Codes: A63F 2300/552 for downloading to client devices, e.g. using OS version, hardware or software profile of the client device
• CPC Class Codes: A63F 2300/554 by saving game or status data
• CPC Class Codes: A63F 2300/556 Player lists, e.g. online players, buddy list, black list
• CPC Class Codes: A63F 2300/572 Communication between players during game play of non game information, e.g. e-mail, chat, file transfer, streaming of audio and streaming of video
• CPC Class Codes: A63F 2300/577 for watching a game played by other players
• CPC Class Codes: A63F 2300/636 involving process of starting or resuming a game
• CPC Class Codes: A63F 2300/69 Involving elements of the real world in the game world, e.g. measurement in live races, real video
• CPC Class Codes: H04L 65/403 Arrangements for multi-party communication, e.g. for conferences data switching systems for conference H04L12/18; arrangements for connecting several subscribers to a common circuit, i.e. affording conference facilities H04M3/56; television conferencing systems H04N7/15
• CPC Class Codes: H04L 65/611 for multicast or broadcast systems for broadcast or conference H04L12/18; arrangements for broadcast or distribution combined with broadcast H04H20/00; arrangements for broadcast applications with a direct linkage to broadcast information or to broadcast space-time H04H60/00; selective distribution of broadcast services, e.g. multimedia broadcast multicast service [MBMS], H04W4/06
• CPC Class Codes: H04L 65/765 intermediate
• CPC Class Codes: H04L 67/131 Protocols for games, networked simulations or virtual reality
• CPC Class Codes: H04N 19/107 between spatial and temporal predictive coding, e.g. picture refresh
• CPC Class Codes: H04N 19/132 Sampling, masking or truncation of coding units, e.g. adaptive resampling, frame skipping, frame interpolation or high-frequency transform coefficient masking
• CPC Class Codes: H04N 19/146 Data rate or code amount at the encoder output
• CPC Class Codes: H04N 19/164 Feedback from the receiver or from the transmission channel
• CPC Class Codes: H04N 19/172 : the region being a picture, frame or field
• CPC Class Codes: H04N 19/188 : the unit being a video data packet, e.g. a network abstraction layer [NAL] unit
• CPC Class Codes: H04N 19/436 : using parallelised computational arrangements
• CPC Class Codes: H04N 19/61 : in combination with predictive coding
• CPC Class Codes: H04N 21/233 : Processing of audio elementary streams monitoring, identification or recognition of audio in broadcast systems H04H60/58
• CPC Class Codes: H04N 21/2343 : involving reformatting operations of video signals for distribution or compliance with end-user requests or end-user device requirements video transcoding H04N19/40; media packet handling at the source H04L65/762
• CPC Class Codes: H04N 21/2381 : Adapting the multiplex stream to a specific network, e.g. an Internet Protocol [IP] network transmission of MPEG streams over ATM H04L12/5601
• CPC Class Codes: H04N 21/26613 : for generating or managing keys in general key distribution for secret or secure communication involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP] H04L9/083; network support of key management H04L63/06; key management for network security in communication control or processing H04W12/04
• CPC Class Codes: H04N 21/4781 : Games
• CPC Class Codes: H04N 21/6125 : involving transmission via Internet transmission by internet of broadcast information H04H60/82
• CPC Class Codes: H04N 21/6377 : directed to server one-way streaming services wherein the source is controlled by the destination H04L65/613
• CPC Class Codes: H04N 21/6405 : Multicasting data broadcast and multicast in packet switching networks H04L12/18
• CPC Class Codes: H04N 21/658 : Transmission by the client directed to the server
• CPC Class Codes: H04N 21/6587 : Control parameters, e.g. trick play commands, viewpoint selection

Abstract

A computer-implemented system for providing a virtualized application hosting environment comprising: a plurality of application/game servers each having a memory for storing application program code and data and a processor for executing the application program code and processing the data on behalf of a client; a virtualization service executed on each of the application/game servers, the virtualization service comprising a file redirection module for redirecting file read/write operations generated by the application program code to one or more virtualized file locations; and a registry redirection module for intercepting registry operations generated by the application program code and executing the registry operations on behalf of the application program code at one or more virtualized registry locations.

Claims

1. A computer-implemented method for securely loading application program code in an application hosting service comprising:

installing an application on the application hosting service;

generating a process/thread map of processes/threads included in the application, the map including an identification of each process/thread and the hierarchical relationships between the processes/threads;

receiving a request to execute processes/threads of an application;

comparing the processes/threads to be executed with the process map to determine whether each process/thread to be executed is included in the map and that each process/thread is to be executed at a correct position in the hierarchy; and

executing the processes/threads of the application if the processes/threads to be executed are found within the process/thread map at a correct position in the hierarchy specified in the process/thread map; and

if the processes/threads to be executed are not found within the process/thread map at a correct position in the hierarchy specified in the process/thread map, then refraining from executing the application.

2. The method as in claim 1 wherein if the processes/threads to be executed are not found within the process/thread map at a correct position in the hierarchy specified in the process/thread map, then rebooting a computer on which the application is attempting to be executed.

3. The method as in claim 1 further comprising:

executing a virtual machine on which the application is to be executed, the virtual machine including a virtual file system, the method further comprising redirecting file and registry requests of the application to a virtual location in the virtual file system.

4. The method as in claim 3 further comprising:

determining whether any open handles exist prior to executing the application; and

only executing the application if no open handles exist.

5. The method as in claim 1 wherein installing the application comprises:

storing application binaries and registry entries for the application within an encrypted container; and

loading the container into memory and decrypting the container only if the processes/threads to be executed are found within the process/thread map at a correct position in the hierarchy specified in the process/thread map.

6. The method as in claim 1 wherein the process/thread map further includes contextual information such that different maps can be derived for use in different contexts.

7. The method as in claim 1 further comprising:

receiving a request during system runtime to switch the process/thread map that are allowed to execute; and

responsively switching the process/thread map with a new process/thread map.

8. A system for securely loading application program code in an application hosting service, the system including a memory for storing program code and a processor for processing the program code to perform the operations of:

installing an application on the application hosting service;

generating a process/thread map of processes/threads included in the application, the map including an identification of each process/thread and the hierarchical relationships between the processes/threads;

receiving a request to execute processes/threads of an application;

comparing the processes/threads to be executed with the process map to determine whether each process/thread to be executed is included in the map and that each process/thread is to be executed at a correct position in the hierarchy; and

executing the processes/threads of the application if the processes/threads to be executed are found within the process/thread map at a correct position in the hierarchy specified in the process/thread map; and

if the processes/threads to be executed are not found within the process/thread map at a correct position in the hierarchy specified in the process/thread map, then refraining from executing the application.

9. The system as in claim 8 wherein if the processes/threads to be executed are not found within the process/thread map at a correct position in the hierarchy specified in the process/thread map, then rebooting a computer on which the application is attempting to be executed.

10. The system as in claim 8 further comprising program code to perform the operations of:

executing a virtual machine on which the application is to be executed, the virtual machine including a virtual file system, the system further comprising program code for redirecting file and registry requests of the application to a virtual location in the virtual file system.

11. The system as in claim 10 further comprising program code to perform the operations of:

determining whether any open handles exist prior to executing the application; and

only executing the application if no open handles exist.

12. The system as in claim 8 wherein installing the application comprises:

storing application binaries and registry entries for the application within an encrypted container; and

loading the container into memory and decrypting the container only if the processes/threads to be executed are found within the process/thread map at a correct position in the hierarchy specified in the process/thread map.

13. The system as in claim 8 wherein the process/thread map further includes contextual information such that different maps can be derived for use in different contexts.

14. The system as in claim 8 further comprising program code to perform the operations of:

receiving a request during system runtime to switch the process/thread map that are allowed to execute; and

responsively switching the process/thread map with a new process/thread map.

15. A machine-readable medium for securely loading application program code in an application hosting service, the machine-readable medium having program code stored thereon which, when executed by a machine, causes the machine to perform the operations of:

installing an application on the application hosting service;

generating a process/thread map of processes/threads included in the application, the map including an identification of each process/thread and the hierarchical relationships between the processes/threads;

receiving a request to execute processes/threads of an application;

comparing the processes/threads to be executed with the process map to determine whether each process/thread to be executed is included in the map and that each process/thread is to be executed at a correct position in the hierarchy; and

executing the processes/threads of the application if the processes/threads to be executed are found within the process/thread map at a correct position in the hierarchy specified in the process/thread map; and

if the processes/threads to be executed are not found within the process/thread map at a correct position in the hierarchy specified in the process/thread map, then refraining from executing the application.

16. The machine-readable medium as in claim 15 wherein if the processes/threads to be executed are not found within the process/thread map at a correct position in the hierarchy specified in the process/thread map, then rebooting a computer on which the application is attempting to be executed.

17. The machine-readable medium as in claim 15 further comprising program code to perform the operations of:

executing a virtual machine on which the application is to be executed, the virtual machine including a virtual file system, the machine-readable medium further comprising program code for redirecting file and registry requests of the application to a virtual location in the virtual file system.

18. The machine-readable medium as in claim 17 further comprising program code to perform the operations of:

determining whether any open handles exist prior to executing the application; and

only executing the application if no open handles exist.

19. The machine-readable medium as in claim 15 wherein installing the application comprises:

storing application binaries and registry entries for the application within an encrypted container; and

loading the container into memory and decrypting the container only if the processes/threads to be executed are found within the process/thread map at a correct position in the hierarchy specified in the process/thread map.

20. The machine-readable medium as in claim 15 wherein the process/thread map further includes contextual information such that different maps can be derived for use in different contexts.

21. The machine-readable medium as in claim 15 further comprising program code to perform the operations of:

receiving a request during system runtime to switch the process/thread map that are allowed to execute; and

responsively switching the process/thread map with a new process/thread map.