Mapping process changes

• US 9,600,682 B2
• Filed: 08/28/2015
• Issued: 03/21/2017
• Est. Priority Date: 06/08/2015
• Status: Active Grant

• Current Assignee: Accenture Global Services Limited (Accenture PLC)
• Original Assignee: Accenture Global Services Limited (Accenture PLC)
• Inventors: Hassanzadeh, Amin
• Primary Examiner(s): CERVETTI, DAVID GARCIA
• Application Number:
  US14/839,238
• Publication Number:
  US 20160357982A1
• Time in Patent Office: 571 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database

Abstract

In one implementation, a computer-implemented method includes receiving a request to run a particular process; determining whether the particular process is to be run in isolation on the computer system; selecting a particular permission scheme from among a plurality of permission schemes based, at least in part, on one or more characteristics of the particular process; fetching, according to the particular permission scheme, a copy object that corresponds to an actual object for the particular process, wherein the copy object is instantiated in an isolated environment; running the particular process is isolation on the computer system by executing the copy object in the isolated environment; applying, according to the particular permission scheme, one or more changes to the copy object; and mapping, according to the particular permission scheme, the one or more changes in the copy object to the actual object.

Claims

1. A computer-implemented method comprising:

receiving, at a process manager running on a computer system, a request to run a particular process on the computer system;

determining, by the process manager, whether the particular process is to be run in isolation on the computer system;

selecting, by the process manager and in response to determining that the particular process is to be run in isolation, a particular permission scheme from among a plurality of permission schemes based, at least in part, on one or more characteristics of the particular process, wherein each of the plurality of permission schemes defines a different set of permission requirements for applying changes to a process being run in isolation;

fetching, by the process manager and according to the particular permission scheme, a copy object that corresponds to an actual object for the particular process, wherein the copy object is instantiated in an isolated environment on the computer system;

running the particular process in isolation on the computer system by executing the copy object in the isolated environment;

applying, by the process manager and according to the particular permission scheme, one or more changes to the copy object;

obtaining, by the process manager, an indication that another version of the actual object is running as part of another process on the computer system; and

in response to obtaining the indication that another version of the actual object is running as part of another process on the computer system, mapping, by the process manager and according to the particular permission scheme, the one or more changes in the copy object to the actual object.

2. The computer-implemented method of claim 1, wherein the plurality of permission schemes include, at least, (i) a proactive permission scheme in which user permission is obtained in advance of all changes being received for the copy object, and (ii) a reactive permission scheme in which user permission is obtained in response to each change that is received for the copy object, and (iii) a reactive batching permission scheme in which user permission is obtained in response to a batched group of changes that are received for the copy object.

3. The computer-implemented method of claim 2, wherein the particular permission scheme comprises the proactive permission scheme.

4. The computer-implemented method of claim 3, further comprising:

outputting, by the computer system and before fetching the copy object, information to prompt a user to provide permission for changes to the copy object in advance of any changes being made; and

receiving, at the computer system and before fetching the copy object, user input comprising permission for changes to the copy object,

wherein the copy object is fetched in response to the user input being received.

5. The computer-implemented method of claim 2, wherein the particular permission scheme comprises the reactive permission scheme.

6. The computer-implemented method of claim 5, further comprising:

outputting, by the computer system after fetching the copy object and before applying the one or more changes to the copy object, information to prompt a user to provide permission for each of the one or more changes to the copy object; and

receiving, at the computer system and before applying the one or more changes to the copy object, user input comprising permission for each of the one or more changes to the copy object,

wherein the one or more changes are applied to the copy object in response to the user input being received.

7. The computer-implemented method of claim 5, further comprising:

outputting, by the computer system after applying the one or more changes to the copy object and before mapping the one or more changes to the actual object, information to prompt a user to provide permission for each of the one or more changes to the copy object; and

receiving, at the computer system and before mapping the one or more changes to the actual object, user input comprising permission for each of the one or more changes to the copy object,

wherein the one or more changes are mapped to the copy object in response to the user input being received.

8. A computer-implemented method comprising:

receiving, at a process manager running on a computer system, a request to run a particular process on the computer system;

determining, by the process manager, whether the particular process is to be run in isolation on the computer system;

selecting, by the process manager and in response to determining that the particular process is to be run in isolation, a particular permission scheme from among a plurality of permission schemes based, at least in part, on one or more characteristics of the particular process, wherein each of the plurality of permission schemes defines a different set of permission requirements for applying changes to a process being run in isolation;

fetching, by the process manager and according to the particular permission scheme, a copy object that corresponds to an actual object for the particular process, wherein the copy object is instantiated in an isolated environment on the computer system;

running the particular process in isolation on the computer system by executing the copy object in the isolated environment;

applying, by the process manager and according to the particular permission scheme, one or more changes to the copy object;

mapping, by the process manager and according to the particular permission scheme, the one or more changes in the copy object to the actual object;

determining a likelihood that the copy object will require multiple mappings to the actual object within a threshold period of time;

selecting a particular isolated storage scheme from among a plurality of isolated storage schemes based, at least in part, on the likelihood that the copy object will required multiple mappings within the threshold period of time; and

storing the copy object and the one or more changes in the isolated environment according to the particular isolated storage scheme.

9. The computer-implemented method of claim 8, wherein the plurality of isolated storage schemes include, at least, (i) a first isolated storage scheme in which the copy object and the one or more changes are stored in an isolated space in non-volatile memory, and (ii) a second isolates storage scheme in which the copy object and the one or more changes are stored in an isolated space in volatile memory.

10. The computer-implemented method of claim 9, wherein:

the particular isolated storage scheme comprises the first isolated storage scheme when the copy object is determined to have less than a threshold likelihood of requiring multiple mappings within the threshold period of time,

the copy object and the one or more changes are stored in the isolated space in non-volatile memory until being mapped to the actual object.

11. The computer-implemented method of claim 9, wherein:

the particular isolated storage scheme comprises the second isolated storage scheme when the copy object is determined to have at least a threshold likelihood of requiring multiple mappings within the threshold period of time,

the copy object and the one or more changes are stored in the isolated space in volatile memory until being mapped to the actual object.

12. The computer-implemented method of claim 11, further comprising:

determining whether one or more limits on storage in the isolated space in volatile memory has been reached,

wherein the copy object and the one or more changes are flushed from the isolated space in volatile memory and mapped to the actual object in response to determining that the one or more limits have been reached.

13. The computer-implemented method of claim 12, wherein the one or more limits include an upper limit on a number of objects stored in the isolated space in volatile memory.

14. The computer-implemented method of claim 12, wherein the one or more limits include an upper limit on a number of isolated processes working on the copy object.

15. The computer-implemented method of claim 12, wherein the one or more limits include an upper limit on a number of changes applied to the copy object while in the isolated space in volatile memory.

16. The computer-implemented method of claim 12, wherein the one or more limits include an upper limit on a length of time that the copy object is permitted to be stored in the isolated space in volatile memory before being mapped to the actual object.

17. The computer-implemented method of claim 9, wherein the volatile memory comprises main memory for the computer system.

18. The computer-implemented method of claim 9, wherein the non-volatile memory comprises one or more storage devices for the computer system.

19. A system comprising:

one or more processors and one or more computer storage media storing instructions that are operable, when executed by the one or more processors, to cause the one or more processors to perform operations comprising;

receiving, at a process manager running on a computer system, a request to run a particular process on the computer system;

determining, by the process manager, whether the particular process is to be run in isolation on the computer system;

selecting, by the process manager and in response to determining that the particular process is to be run in isolation, a particular permission scheme from among a plurality of permission schemes based, at least in part, on one or more characteristics of the particular process, wherein each of the plurality of permission schemes defines a different set of permission requirements for applying changes to a process being run in isolation;

fetching, by the process manager and according to the particular permission scheme, a copy object that corresponds to an actual object for the particular process, wherein the copy object is instantiated in an isolated environment on the computer system;

running the particular process in isolation on the computer system by executing the copy object in the isolated environment;

applying, by the process manager and according to the particular permission scheme, one or more changes to the copy object;

mapping, by the process manager and according to the particular permission scheme, the one or more changes in the copy object to the actual object;

determining a likelihood that the copy object will require multiple mappings to the actual object within a threshold period of time;

selecting a particular isolated storage scheme from among a plurality of isolated storage schemes based, at least in part, on the likelihood that the copy object will required multiple mappings within the threshold period of time; and

storing the copy object and the one or more changes in the isolated environment according to the particular isolated storage scheme.

20. A system comprising:

one or more processors and one or more computer storage media storing instructions that are operable, when executed by the one or more processors, to cause the one or more processors to perform operations comprising;

receiving, at a process manager running on a computer system, a request to run a particular process on the computer system;

determining, by the process manager, whether the particular process is to be run in isolation on the computer system;

selecting, by the process manager and in response to determining that the particular process is to be run in isolation, a particular permission scheme from among a plurality of permission schemes based, at least in part, on one or more characteristics of the particular process, wherein each of the plurality of permission schemes defines a different set of permission requirements for applying changes to a process being run in isolation;

fetching, by the process manager and according to the particular permission scheme, a copy object that corresponds to an actual object for the particular process, wherein the copy object is instantiated in an isolated environment on the computer system;

running the particular process in isolation on the computer system by executing the copy object in the isolated environment;

applying, by the process manager and according to the particular permission scheme, one or more changes to the copy object;

obtaining, by the process manager, an indication that another version of the actual object is running as part of another process on the computer system; and

in response to obtaining the indication that another version of the actual object is running as part of another process on the computer system, mapping, by the process manager and according to the particular permission scheme, the one or more changes in the copy object to the actual object.

21. A non-transitory computer-readable medium having stored thereon instructions, which, when executed by one or more computers, cause the one or more computers to perform operations comprising:

receiving, at a process manager running on a computer system, a request to run a particular process on the computer system;

determining, by the process manager, whether the particular process is to be run in isolation on the computer system;

selecting, by the process manager and in response to determining that the particular process is to be run in isolation, a particular permission scheme from among a plurality of permission schemes based, at least in part, on one or more characteristics of the particular process, wherein each of the plurality of permission schemes defines a different set of permission requirements for applying changes to a process being run in isolation;

fetching, by the process manager and according to the particular permission scheme, a copy object that corresponds to an actual object for the particular process, wherein the copy object is instantiated in an isolated environment on the computer system;

running the particular process in isolation on the computer system by executing the copy object in the isolated environment;

applying, by the process manager and according to the particular permission scheme, one or more changes to the copy object;

mapping, by the process manager and according to the particular permission scheme, the one or more changes in the copy object to the actual object;

determining a likelihood that the copy object will require multiple mappings to the actual object within a threshold period of time;

selecting a particular isolated storage scheme from among a plurality of isolated storage schemes based, at least in part, on the likelihood that the copy object will required multiple mappings within the threshold period of time; and

storing the copy object and the one or more changes in the isolated environment according to the particular isolated storage scheme.

22. A non-transitory computer-readable medium having stored thereon instructions, which, when executed by one or more computers, cause the one or more computers to perform operations comprising:

receiving, at a process manager running on a computer system, a request to run a particular process on the computer system;

determining, by the process manager, whether the particular process is to be run in isolation on the computer system;

selecting, by the process manager and in response to determining that the particular process is to be run in isolation, a particular permission scheme from among a plurality of permission schemes based, at least in part, on one or more characteristics of the particular process, wherein each of the plurality of permission schemes defines a different set of permission requirements for applying changes to a process being run in isolation;

fetching, by the process manager and according to the particular permission scheme, a copy object that corresponds to an actual object for the particular process, wherein the copy object is instantiated in an isolated environment on the computer system;

running the particular process in isolation on the computer system by executing the copy object in the isolated environment;

applying, by the process manager and according to the particular permission scheme, one or more changes to the copy object;

obtaining, by the process manager, an indication that another version of the actual object is running as part of another process on the computer system; and

in response to obtaining the indication that another version of the actual object is running as part of another process on the computer system, mapping, by the process manager and according to the particular permission scheme, the one or more changes in the copy object to the actual object.