Method for accessing, by application programs, resources residing inside an application isolation scope

• US 8,132,176 B2
• Filed: 09/19/2005
• Issued: 03/06/2012
• Est. Priority Date: 09/30/2004
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Bissett, Nicholas Alexander, Roychoudhry, Anil, Mazzaferri, Richard James
• Primary Examiner(s): Tang, Kenneth
• Application Number:
  US11/231,317
• Publication Number:
  US 20070094667A1
• Time in Patent Office: 2,360 Days
• Field of Search: 718/104
• US Class Current: 718/104
• CPC Class Codes: G06F 16/10 File systems; File servers
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 2209/542 Intercept
• CPC Class Codes: G06F 8/61 Installation
• CPC Class Codes: G06F 9/45537 Provision of facilities of other operating environments, e.g. WINE I/O emulation G06F13/105
• CPC Class Codes: G06F 9/468 Specific access rights for resources, e.g. using capability register
• CPC Class Codes: G06F 9/4856 resumption being on a different machine, e.g. task migration, virtual machine migration G06F9/5088 takes precedence
• CPC Class Codes: G06F 9/5011 the resources being hardware resources other than CPUs, Servers and Terminals
• CPC Class Codes: G06F 9/52 Program synchronisation; Mutual exclusion, e.g. by means of semaphores
• CPC Class Codes: G06F 9/541 via adapters, e.g. between incompatible applications
• CPC Class Codes: G06F 9/545 where tasks reside in different layers, e.g. user- and kernel-space
• CPC Class Codes: Y10S 707/99931 Database or file accessing

Abstract

In a method for accessing, by application programs, resources provided by an operating system, a process receives a request for a resource and an identifier associated with the resource. It is determined that the requested resource resides inside an application isolation environment. The request for the resource and the identifier associated with the resource is redirected to the application isolation environment. The request for the resource is responded to using an instance of the resource residing inside the application isolation environment.

Claims

1. A method for accessing, by application programs, resources provided by an operating system, the method comprising:

(a) receiving, by a process executing inside a first application isolation scope provided by an application isolation layer, but outside second application isolation scope provided by an application isolation layer, a request for a resource and an identifier associated with the resource from a process executing inside the second application isolation scope, wherein an application isolation layer and a user isolation layer together comprise an isolation environment;

(b) determining that the requested resource resides inside the first application isolation scope;

(c) redirecting the request for the resource and the identifier associated with the resource to the first application isolation scope; and

(d) responding to the request for the resource using an instance of the resource residing inside the first application isolation scope.

2. The method of claim 1, wherein step (b) further comprises determining, by the process executing outside the first application isolation scope, that the requested resource resides in the first application isolation scope.

3. The method of claim 1, wherein step (c) further comprises redirecting, by the process executing outside the first application isolation scope, the request for the resource and the identifier associated with the resource to the first application isolation scope.

4. The method of claim 1, wherein step (d) further comprises responding, by the process executing outside the first application isolation scope, to the request for the resource using an instance of the resource located inside the first application isolation scope.

5. The method of claim 1, wherein step (a) comprises making, by the process executing outside the first application isolation scope, a request for the resource, the request including the identifier associated with the resource.

6. The method of claim 1, wherein step (a) further comprises receiving the request for the resource and the identifier associated with the resource, the identifier comprising a class identifier identifying at least one out-of-process COM server.

7. The method of claim 1, wherein step (d) further comprises communicating with the resource over an interface provided by the process.

8. The method of claim 1, wherein step (d) further comprises modifying, by the requested resource, a window associated with the process executing outside the application isolation scope.

9. A method for accessing, by application programs, resources provided by an operating system, the method comprising:

(a) receiving a request for a resource and an identifier associated with the resource;

(b) determining, by a process executing inside a first application isolation scope provided by an application isolation layer, but outside second application isolation scope provided by an application isolation layer, that the requested resource resides inside the first application isolation scope but is requested by a process executing inside the second application isolation scope, wherein an application isolation layer and a user isolation layer together comprise an isolation environment;

(c) redirecting the request for the resource and the identifier associated with the resource to the first application isolation scope; and

(d) responding to the request for the resource using an instance of the resource residing inside the first application isolation scope.

10. The method of claim 9, wherein step (a) further comprises receiving, by the process executing outside the first application isolation scope, the request for the resource and the identifier associated with the resource.

11. The method of claim 9, wherein step (c) further comprises redirecting, by the process executing outside the first application isolation scope, the request for the resource and the identifier associated with the resource to the first application isolation scope.

12. The method of claim 9, wherein step (d) further comprises responding, by the process executing outside the first application isolation scope, to the request for the resource using an instance of the resource inside the first application isolation scope.

13. The method of claim 9, wherein step (a) comprises making the request for the resource including the identifier associated with the resource.

14. The method of claim 9, wherein step (a) further comprises receiving the request for a resource and the identifier associated with the resource, the identifier comprising a class identifier identifying at least one COM server.

15. The method of claim 9, wherein step (d) further comprises communicating with the resource over an interface provided by the process.

16. A method for accessing, by application programs, resources provided by an operating system, the method comprising:

(a) receiving a request for a resource and an identifier associated with the resource from a process executing inside a first application isolation scope provided by an application isolation layer;

(b) determining that the requested resource resides inside second application isolation scope provided by an application isolation layer, wherein the application isolation layer and a user isolation layer together comprise an isolation environment;

(c) redirecting, by a process executing inside the first application isolation scope, the request for the resource and the identifier associated with the resource to the second application isolation scope; and

(d) responding to the request for the resource using an instance of the resource residing inside the second application isolation scope.

17. The method of claim 16, wherein step (d) further comprises responding to the request for the resource, by the process executing inside the first application isolation scope, using an instance of the resource residing inside the second application isolation scope.

18. The method of claim 16, wherein step (a) comprises making the request for the resource including the identifier associated with the resource.

19. The method of claim 16, wherein step (a) further comprises receiving the request for the resource and the identifier associated with the resource, the identifier comprising a class identifier identifying at least one COM server.

20. The method of claim 16, wherein step (d) further comprises communicating with the resource over an interface provided by the process.

21. A method for accessing, by application programs, resources provided by an operating system, the method comprising:

(a) receiving a request for a resource and an identifier associated with the resource from a process executing inside a first application isolation scope provided by an application isolation layer;

(b) determining that the requested resource resides inside second application isolation scope provided by an application isolation layer, wherein the application isolation layer and a user isolation layer together comprise an isolation environment;

(c) redirecting the request for the resource and the identifier associated with the resource to the second application isolation scope; and

(d) responding, by a process executing inside the first application isolation scope, to the request for the resource using an instance of the resource residing inside the second application isolation scope.

22. The method of claim 21, wherein step (a) comprises making the request for the resource including the identifier associated with the resource.

23. The method of claim 21, wherein step (a) further comprises receiving the request for the resource and the identifier associated with the resource, the identifier comprising a class identifier, said identifier identifying at least one COM server.

24. The method of claim 21, wherein step (d) further comprises communicating, by the process executing inside the first application isolation scope, with the resource over an interface.

25. A system, comprising a computer processor, for accessing, by application programs, resources provided by an operating system comprising:

a resource provided by an operating system executing on a computer processor;

a first process, executing inside first application isolation scope provided by an application isolation layer, receiving a request for the resource and an identifier associated with the resource, wherein the application isolation layer and a user isolation layer together comprise an isolation environment;

a second process determining that the resource resides inside a second application isolation scope;

a third process redirecting the request for the resource and the identifier associated with the resource to the second application isolation scope; and

a fourth process responding to the request for the resource using an instance of the resource residing in the second application isolation scope.

26. The system of claim 25, wherein the second process executes inside the second application isolation scope.

27. The system of claim 25, wherein the second process executes outside the second application isolation scope.

28. The system of claim 25, wherein the third process executes inside the second application isolation scope.

29. The system of claim 25, wherein the third process executes outside the second application isolation scope.

30. The system of claim 25, wherein the fourth process executes inside the second application isolation scope.

31. The system of claim 25, wherein the fourth process executes outside the second application isolation scope.

32. The system of claim 25, wherein the first process and the second process are sub-processes of a single process.

33. The system of claim 25, wherein the first process and the third process are sub-processes of a single process.

34. The system of claim 25, wherein the first process and the fourth process are sub-processes of a single process.

35. The system of claim 25, wherein the first process and the second process and the third process are sub-processes of a single process.

36. The system of claim 25, wherein the first process and the second process and the fourth process are sub-processes of a single process.

37. The system of claim 25, wherein the first process and the third process and the fourth process are sub-processes of a single process.

38. The system of claim 25, wherein the first process and the second process and the third process and the fourth process are sub-processes of a single process.

39. The system of claim 25, wherein the resource further comprises a COM server.

40. The system of claim 25, wherein the resource further comprises a COM server of a different version than a second resource residing inside the second application isolation scope.

41. The system of claim 25, wherein the identifier is associated with the first resource and a second resource.

42. The system of claim 25, wherein the resource further comprises at least one registry entry in the second application isolation scope on which the resource resides.

43. The system of claim 25, wherein the first process further comprises making the request for the resource including the identifier associated with the resource.

44. The system of claim 25, wherein the first process further comprises communicating with the instance of the resource residing inside the second application isolation scope.

45. The system of claim 25, wherein the first process or the second process or the third process or the fourth process further comprise a COM Service Control Manager.

46. A system, comprising a computer processor, for accessing, by application programs, resources provided by an operating system comprising:

a resource provided by an operating system executing on a computer processor;

a first process receiving a request for the resource and an identifier associated with the resource;

a second process, executing inside first application isolation scope provided by an application isolation layer, determining that the resource resides inside a second application isolation scope provided by an application isolation layer, wherein an application isolation layer and a user isolation layer together comprise an isolation environment;

a third process redirecting the request for the resource and the identifier associated with the resource to the second application isolation scope; and

a fourth process responding to the request for the resource using an instance of the resource residing in the second application isolation scope.

47. The system of claim 46, wherein the first process executes inside the second application isolation scope.

48. The system of claim 46, wherein the first process executes inside the first application isolation scope.

49. The system of claim 46, wherein the third process executes inside the second application isolation scope.

50. The system of claim 46, wherein the third process executes inside the first application isolation scope.

51. The system of claim 46, wherein the fourth process executes inside the second application isolation scope.

52. The system of claim 46, wherein the fourth process executes inside the first application isolation scope.

53. The system of claim 46, wherein the first process and the second process are sub-processes of a single process.

54. The system of claim 46, wherein the first process and the second process and the third process are sub-processes of a single process.

55. The system of claim 46, wherein the first process and the second process and the fourth process are sub-processes of a single process.

56. The system of claim 46, wherein the first process and the second process and the third process and the fourth process are sub-processes of a single process.

57. The system of claim 46, wherein the second process and the third process are sub-processes of a single process.

58. The system of claim 46, wherein the second process and the fourth process are sub-processes of a single process.

59. The system of claim 46, wherein the second process and the third process and the fourth process are sub-processes of a single process.

60. The system of claim 46, wherein the resource further comprises a COM server.

61. The system of claim 46, wherein the resource further comprises a COM server of a different version than a second resource residing in the second application isolation scope.

62. The system of claim 46, wherein the identifier is associated with the first resource and a second resource.

63. The system of claim 46, wherein the resource further comprises at least one registry entry in the second application isolation scope on which the resource resides.

64. The system of claim 46, wherein the first process further comprises making the request for the resource including the identifier associated with the resource.

65. The system of claim 46, wherein the first process further comprises communicating with the instance of the resource located inside the second application isolation scope.

66. The system of claim 46, wherein the first process or the second process or the third process or the fourth process further comprise a COM Service Control Manager.

67. A system, comprising a computer processor, for accessing, by application programs, resources provided by an operating system comprising:

a resource provided by an operating system executing on a computer processor;

a first process receiving, from a process executing in a first application isolation scope provided by an application isolation layer, a request for the resource and an identifier associated with the resource;

a second process determining that the resource resides inside second application isolation scope provided by an application isolation layer, wherein the application isolation layer and a user isolation layer together comprise an isolation environment;

a third process, executing outside the second application isolation scope, redirecting the request for the resource and the identifier associated with the resource to the second application isolation scope; and

a fourth process responding to the request for the resource using an instance of the resource residing in the second application isolation scope.

68. The system of claim 67, wherein the first process executes inside the second application isolation scope.

69. The system of claim 67, wherein the first process executes outside the second application isolation scope.

70. The system of claim 67, wherein the second process executes inside the second application isolation scope.

71. The system of claim 67, wherein the second process executes outside the second application isolation scope.

72. The system of claim 67, wherein the fourth process executes inside the second application isolation scope.

73. The system of claim 67, wherein the fourth process executes outside the second application isolation scope.

74. The system of claim 67, wherein the first process and the third process are sub-processes of a single process.

75. The system of claim 67, wherein the first process and the second process and the third process are sub-processes of a single process.

76. The system of claim 67, wherein the first process and the third process and the fourth process are sub-processes of a single process.

77. The system of claim 67, wherein the first process and the second process and the third process and the fourth process are sub-processes of a single process.

78. The system of claim 67, wherein the second process and the third process are sub-processes of a single process.

79. The system of claim 67, wherein the second process and the third process and the fourth process are sub-processes of a single process.

80. The system of claim 67, wherein the third process and the fourth process are sub-processes of a single process.

81. The system of claim 67, wherein the resource further comprises a COM server.

82. The system of claim 67, wherein the resource further comprises a COM server of a different version than a second resource residing on the second application isolation scope.

83. The system of claim 67, wherein the identifier is associated with the first resource and a second resource.

84. The system of claim 67, wherein the resource further comprises at least one registry entry in the application isolation scope on which the resource resides.

85. The system of claim 67, wherein the first process further comprises making the request for the resource including the identifier associated with the resource.

86. The system of claim 67, wherein the first process further comprises communicating with the instance of the resource residing inside the application isolation scope.

87. The system of claim 67, wherein the first process or the second process or the third process or the fourth process further comprises a COM Service Control Manager.

88. A system, comprising a computer processor, for accessing, by application programs, resources provided by an operating system comprising:

a resource provided by an operating system executing on a computer processor;

a first process receiving, from a process executing in a first application isolation scope provided by an application isolation layer, a request for the resource and an identifier associated with the resource;

a second process determining that the resource resides inside second application isolation scope provided by an application isolation layer, wherein the application isolation layer and a user isolation layer together comprise an isolation environment;

a third process redirecting the request for the resource and the identifier associated with the resource to the second application isolation scope; and

a fourth process, executing outside the second application isolation scope, responding to the request for the resource using an instance of the resource residing in the second application isolation scope.

89. The system of claim 88, wherein the first process executes inside the second application isolation scope.

90. The system of claim 88, wherein the first process executes outside the second application isolation scope.

91. The system of claim 88, wherein the second process executes inside the second application isolation scope.

92. The system of claim 88, wherein the second process executes outside the second application isolation scope.

93. The system of claim 88, wherein the third process executes inside the second application isolation scope.

94. The system of claim 88, wherein the third process executes outside the second application isolation scope.

95. The system of claim 88, wherein the first process and the fourth process are sub-processes of a single process.

96. The system of claim 88, wherein the first process and the second process and the fourth process are sub-processes of a single process.

97. The system of claim 88, wherein the first process and the third process and the fourth process are sub-processes of a single process.

98. The system of claim 88, wherein the first process and the second process and the third process and the fourth process are sub-processes of a single process.

99. The system of claim 88, wherein the second process and the fourth process are sub-processes of a single process.

100. The system of claim 88, wherein the second process and the third process and the fourth process are sub-processes of a single process.

101. The system of claim 88, wherein the third process and the fourth process are sub-processes of a single process.

102. The system of claim 88, wherein the resource further comprises a COM server.

103. The system of claim 88, wherein the resource further comprises a COM server of a different version than a second resource residing inside the second application isolation scope.

104. The system of claim 88, wherein the identifier is associated with the first resource and a second resource.

105. The system of claim 88, wherein the resource further comprises at least one registry entry inside the application isolation scope on which the resource resides.

106. The system of claim 88, wherein the first process further comprises making the request for the resource including the identifier associated with the resource.

107. The system of claim 88, wherein the first process further comprises communicating with the instance of the resource located inside the second application isolation scope.

108. The system of claim 88, wherein the first process or the second process or the third process or the fourth process further comprises a COM Service Control Manager.