Distribution and management of services in virtual environments

Patent metadata

Field	Value
Publication number	US-12225050-B2
Application number	US-202217706567-A
Country	US
Kind code	B2
Filing date	Mar 28, 2022
Priority date	Jan 9, 2017
Publication date	Feb 11, 2025
Grant date	Feb 11, 2025

Abstract

Distribution and management of services in virtual environments is described herein. In one or more implementations, a service distribution and management model is implemented in which system services and applications are seamlessly distributed across multiple containers which each implement a different runtime environment. In one or more implementations, a system for distributing access to services in a host operating system of a computing device includes a host operating system configured to implement a host runtime environment, and one or more services implemented by the host operating system. The system further includes a service control manager configured to enable communication between a client stub of a service implemented in a client runtime environment and a service provider of the service that is implemented in a service runtime environment that is separate from the first client runtime environment.

First claim

What is claimed is:

1. One or more computing devices, in aggregate comprising:
processing hardware; and
storage hardware storing instructions configured to cause the processing hardware to perform steps comprising:
execute a host runtime environment provided by an operating system of the one or more computing devices;
execute a service within a first runtime environment, the first runtime environment either being the host runtime environment or being hosted by the host runtime environment;
execute a client stub of the service within a second runtime environment, the second runtime environment being a separate, isolated execution environment from the first runtime environment, the second runtime environment being hosted by the host runtime environment;
establish inter-process communication (IPC) between the client stub executing within the second runtime environment and the service executing within the first runtime environment based on provided communication parameters; and
responsive to a request to access the service from an application executing on the host runtime environment, executing a virtual version of the application within the second runtime environment, the virtual version of the application directing the request to the client stub.

2. The one or more computing devices of claim 1 , wherein the storage hardware stores further instructions configured to cause the processing hardware to:
remotely display, through the second runtime environment, a graphical user interface of the service executing within the first runtime environment.

3. The one or more computing devices of claim 1 , wherein the provided communication parameters are specific to the IPC establishing between the client stub and the service and are provided by the application.

4. The one or more computing devices of claim 1 , wherein the provided communication parameters are universal between multiple client stubs and corresponding multiple services and are provided by a centralized host service control manager.

5. The one or more computing devices of claim 1 , wherein the request to access the service from the application is a standard name query that is directed by the application to a service endpoint that is implemented as a standard name.

6. The one or more computing devices of claim 1 , wherein the second runtime environment comprises a second registration database that is separate from a first registration database that is part of the first runtime environment, the second registration database comprising information for establishing the IPC with the client stub, the first registration database comprising information for establishing the IPC with the service.

7. The one or more computing devices of claim 1 , wherein the second runtime environment comprises a different operating system than the operating system of the one or more computing devices.

8. The one or more computing devices of claim 1 , wherein the second runtime environment is a container that shares aspects of the operating system of the one or more computing devices.

9. The one or more computing devices of claim 8 , wherein the container is a process container, the operating system implementing namespace isolation such that processes executing within the container can access shared parts of the operating system, while isolated parts of the operating system are independently established for the container.

10. The one or more computing devices of claim 1 , wherein the storage hardware stores further instructions configured to cause the processing hardware to:
copy changes in the second runtime environment back to the operating system of the one or more computing devices.

11. The one or more computing devices of claim 1 , wherein the storage hardware stores further instructions configured to cause the processing hardware to:
responsive to an update to the operating system of the one or more computing devices, re-instantiate the second runtime environment.

12. The one or more computing devices of claim 1 , wherein the storage hardware stores further instructions configured to cause the processing hardware to:
determine, prior to executing the virtual version of the application within the second runtime environment, whether the request to access the service comprises a request to access an untrusted resource; and
executing the virtual version of the application within the second runtime environment and directing the request to the client stub only in response to the determining that the request comprises the request to access the untrusted resource.

13. The one or more computing devices of claim 12 , wherein the storage hardware stores further instructions configured to cause the processing hardware to:
responsive to determining that the request to access the service comprises a request to access a trusted resource, executing the application within the host runtime environment.

14. The one or more computing devices of claim 1 , wherein the storage hardware stores further instructions configured to cause the processing hardware to:
execute a network filter, the network filter blocking network communications between an untrusted resource and the first runtime environment and allowing network communications between the untrusted resource and the second runtime environment.

15. The one or more computing devices of claim 14 , wherein the network filter further blocks network communications between a trusted resource and the second runtime environment and allows network communications between the trusted resource and the first runtime environment.

16. The one or more computing devices of claim 14 , wherein the network filter comprises a network address translator.

17. The one or more computing devices of claim 14 , wherein the allowing the network communications between the untrusted resource and the second runtime environment comprises modifying the network communications between the untrusted resource and the second runtime environment with dummy credential data created by the network filter.

18. The one or more computing devices of claim 1 , wherein the service is a Domain Name Service (DNS).

19. Storage hardware storing instructions configured to cause a computing device to perform steps comprising:
execute a host runtime environment provided by an operating system of the computing device;
execute a service within a first runtime environment, the first runtime environment either being the host runtime environment or being hosted by the host runtime environment;
execute a client stub of the service within a second runtime environment, the second runtime environment being a separate, isolated execution environment from the first runtime environment, the second runtime environment being hosted by the host runtime environment;
establish inter-process communication (IPC) between the client stub executing within the second runtime environment and the service executing within the first runtime environment based on provided communication parameters; and
responsive to a request to access the service from an application executing on the host runtime environment, executing a virtual version of the application within the second runtime environment, the virtual version of the application directing the request to the client stub.

20. A method of providing, to an application executing on a computing device, isolated access to a computer-executed service process, the method comprising:
execute a host runtime environment provided by an operating system of the computing device;
exe

Assignees

• Microsoft Technology Licensing Llc

Inventors

• Pulapaka Hari R
• Chenchev Margarit Simeonov
• Schultz Benjamin M
• Wiswall Jonathan David
• Smith Frederick Justus
• Starks John A
• Wolcott Richard O
• Ebersol Michael Bishop

Classifications

• G06F21/53

  by executing in a restricted environment, e.g. sandbox or secure virtual machine · CPC title

• G06F9/45558

  Hypervisor-specific management and integration aspects · CPC title

• G06F2009/45587

  Isolation or security of virtual machine instances · CPC title

• H04L41/5009

  Determining service level performance parameters or violations of service level contracts, e.g. violations of agreed response time or mean time between failures [MTBF] · CPC title

• H04L41/5025

  by proactively reacting to service quality change, e.g. by reconfiguration after service quality degradation or upgrade · CPC title