System and method for handling an event in a computer system

• US 20060015880A1
• Filed: 07/05/2005
• Published: 01/19/2006
• Est. Priority Date: 07/06/2004
• Status: Active Grant

• Current Assignee: Wontok, Inc. (Wontok Enterprises Pty Ltd.)
• Original Assignee: SafeCentral, Inc. (Wontok Enterprises Pty Ltd.)
• Inventors: Freericks, Helmuth, Kouznetsov, Oleg, Karlsson, Gustav
• Granted Patent: US 7,765,558 B2
• Time in Patent Office: Days
• US Class Current: 719/318
• CPC Class Codes: G06F 9/542 Event management; Broadcasting; Multicasting; Notifications

Abstract

A system for handling an event in a computer system which has a kernel-mode and a user-mode, the system comprising: a kernel part that is operable to effect a suspension of the event in the kernel-mode; and a user part that is operable to effect an occurrence of the event in the user-mode, thereby handling the event in the computer system.

Claims

1. A system for handling an event in a computer system which has a kernel-mode and a user-mode, the system comprising:

a kernel part that is operable to effect a suspension of the event in the kernel-mode; and

a user part that is operable to effect an occurrence of the event in the user-mode, thereby handling the event in the computer system.

2. The system as claimed in claim 1, wherein the user part is further operable to influence an operation of the computer system based on the occurrence of the event in the user-mode.

3. The system as claimed in claim 2, wherein the user part is operable to influence the operation of the computer system by preventing the event from occurring in the kernel-mode.

4. The system as claimed in claim 3, wherein the user part is operable to issue a request for the suspension, whilst the kernel part is operable to use the request in order to activate a provider part which is operable to effect suspension of a class of events that comprises the event.

5. The system as claimed in claim 4, wherein the provider part is operable to interact with an operating system of the computer system in order to effect the suspension.

6. The system as claimed in claim 4, wherein the kernel part is operable to issue an indication that the suspension has been effected, whilst the user part is operable to use the indication in effecting the occurrence of the event in the user-mode.

7. The system as claimed in claim 6, wherein the kernel part is operable to use an interprocess communication mechanism to transfer the indication to the user part, the user part being operable to use the interprocess communication mechanism to transfer the request to the kernel part.

8. The system as claimed in claim 7, wherein the interprocess communication mechanism uses an Internet protocol.

9. The system as claimed in claim 6, wherein the kernel part and the user part are operable to respectively format the indication and the request according to a predefined format.

10. The system as claimed in claim 9, wherein the predefined format accords with a common information model defined by a distributed management task force.

11. The system as claimed in claim 10, wherein the kernel part operates in the kernel mode, whilst the user part operates in the user-mode.

12. The system as claimed in claim 11, wherein the user part comprises an anti-virus scan engine.

13. A method of handling an event in a computer system which has a kernel-mode and a user-mode, the method comprising the steps of:

effecting a suspension of the event in the kernel-mode; and

effecting an occurrence of the event in the user-mode, thereby handling the event in the computer system.

14. The method as claimed in claim 13, wherein the method further comprises the step of influencing an operation of the computer system based on the occurrence of the event in the user-mode.

15. The method as claimed in claim 14, wherein the step of influencing the operation of the computer system comprises preventing the event from occurring in the kernel-mode.

16. The method as claimed in claim 15, further comprising the steps of

issuing a request for the suspension;

and

using the request in order to activate a provider part that is operable to effect suspension of a class of events that comprises the event.

17. The method as claimed in claim 16, further comprising the step of using the provider to interact with an operating system of the computer system in order to effect the suspension.

18. The method as claimed in claim 16, further comprising the steps of:

issuing an indication that the suspension has been effected, and using the indication in effecting the occurrence of the event in the user-mode.

19. The method as claimed in claim 18, further comprising the step of effecting a transfer of the indication to a user part for use thereby.

20. The method as claimed in claim 19, wherein the step of effecting the transfer of the indication comprises using an interprocess communication mechanism.

21. The method as claimed in claim 20, wherein the interprocess communication mechanism uses an Internet protocol.

22. The method as claimed in claim 18, further comprising the step of formatting the indication and the request according to a predefined format.

23. The method as claimed in claim 22, wherein the predefined format accords with a common information model defined by a distributed management task force.

24. Software which, when executed on a computer, allows the computer to carry out the method claimed in claim 13.

25. A computer readable medium comprising the software claimed in claim 24.

26. (canceled)

27. (canceled)