Resource management in a processor

Patent metadata

Field	Value
Publication number	US-9552477-B2
Application number	US-201414218467-A
Country	US
Kind code	B2
Filing date	Mar 18, 2014
Priority date	Mar 19, 2013
Publication date	Jan 24, 2017
Grant date	Jan 24, 2017

Abstract

A processor system is arranged to execute user selected applications. A manager module is configured to detect a user selection of an application and configured to initiate a launch process. A supervisor module is configured to intercept the launch process initiated by the manager module and detect whether the application is a trusted application or an untrusted application. Trusted applications have a privilege to access resources without authorization, and untrusted applications do not have the privilege. The supervisor module has the privilege to access the resources. When the application is untrusted, the application is launched in a container, and at least one of the resources is delivered to the untrusted application in the container.

First claim

The invention claimed is:

1. A resource management system arranged to execute a plurality of user selected applications, each application including a computer program executable by a processor, the resource management system comprising:
a manager programmed to detect a user selection of an application and configured to initiate a launch process for the selected applications;
a supervisor, the supervisor having a privilege to access resources, the supervisor configured to be executed by the processor to:
intercept the launch process initiated by the manager;
determine whether the application is a trusted application or an untrusted application, trusted applications having a privilege to access the resources without authorization, untrusted applications not having the privilege to access the resources without authorization;
wherein the processor is configured to execute the supervisor and the manager to:
place the untrusted application into a container;
access substantially simultaneously a first application in a first container and a second application in a second container;
prohibit a launch of the second application in the second container until a launch of the first application in the first container is completed;
respond to a launch command for the first application, to capture a first process identifier value, and update an application manager with the first process identifier and a first unique application ID, wherein the first unique application ID may be used for subsequent reference as the identifier of the first application;
assign resources to the first application and completing launch of the first application; and
terminate the launch of the first application in the first container and launch the second application in the second container in response to the first application in the first container failing to launch within a specified time period.

2. A resource management system according to claim 1 , wherein the specified period of time to launch the first application in the first container is ten seconds.

3. A resource management system according to claim 1 , wherein the application is a browser and the at least one of the resources is an Internet Protocol (IP) address to establish a connection with the application.

4. A resource management system according to claim 3 , wherein the supervisor dynamically allocates IP addresses, and wherein the container of the untrusted application is statically configured with an IP address obtained by the supervisor.

5. A method to manage resources for a plurality of user-selected applications executable by a processor, wherein each application includes a computer program, the method comprising:
receiving, by one or more computing devices, a user selection of an application;
initiating, using the one or more computing devices, a launch process based on the selected application;
intercepting, using the one or more computing devices, the launch process for the selected application;
determining, using the one or more computing devices, whether the application is trusted or untrusted and placing the untrusted application into a container;
accessing substantially simultaneously, using the one or more computing devices, a first application in a first container and a second application in a second container and launching the first application in the first container while preventing a launch of the second application in the second container;
using the one or more computing devices to capture a process identifier for the first application in the first container and updating an application manager with the captured process identifier and a unique ID, wherein the unique ID may be used with subsequent reference to the first application;
assigning, using the one or more computing devices, resources to the first application to complete the launch of the first application;
launching, using the one or more computing devices, the second application after launch of the first application is completed; and
terminating, using the one or more computing devices, the launch of the first application in the first container if launch of the first application is not successful within a specified period of time.

6. A method according to claim 5 comprising:
launching, using the one or more computing devices, the application with privileges to access resources and without a corresponding container when the application is trusted.

7. A method according to claim 5 , wherein a resource manager, using the one or more computing devices, allocates first resources to trusted applications directly, and the resource manager allocates second resources to applications executing in containers only via a supervisor.

8. A method according to claim 5 , wherein the assigning of resources, is performed by a supervisor, and is carried out prior to executing the application.

9. A method according to claim 5 , wherein the application is a browser and the at least one of the resources is an Internet Protocol (IP) address to establish a connection with the application.

10. A method according to claim 5 , comprising:
dynamically allocating, by a supervisor, IP addresses; and
statically configuring the container with the IP address obtained by the supervisor.

11. A non-transitory computer program product having stored thereon a set of computer instructions, the computer instructions configured to carry out a method to manage resources for a plurality of user-selected applications, the method comprising:
receiving, using one or more computing devices, a user selection of an application;
initiating, using the one or more computing devices, a launch process based on the selected application;
intercepting, using the one or more computing devices, the launch process;
determining, using the one or more computing devices, whether the application is trusted or untrusted and placing the untrusted application into a container;
accessing substantially simultaneously, using the one or more computing devices, a first application in a first container and a second application in a second container and launching the first application in the first container while preventing a launch of the second application in the second container;
using the one or more computing devices to capture a process identifier for the first application in the first container and updating an application manager with the captured process identifier and a unique ID, wherein the unique ID may be used with subsequent reference to the first application;
assigning, using the one or more computing devices, resources to the first application to complete the launch of the first application;
launching, using the one or more computing devices, the second application after launch of the first application is completed;
terminating, using the one or more computing devices, the launch of the first application in the first container if launch of the first application is not successful within a specified period of time; and
delivering, by a supervisor, at least one of the resources to the container.

12. A computer program product according to claim 11 having stored thereon a set of computer instructions, the computer instructions configured to carry out a method further comprising:
launching, using the one or more computing devices, the application with privileges to access resources and without a corresponding container when the application is trusted.

13. A computer program product according to claim 11 , wherein a resource manager, using the one or more computing devices, allocates first resources to trusted applications directly, and the resource manager allocates second re

Assignees

• Stmicroelectronics (Grenoble 2) Sas
• St Microelectronics Asia Pacific Pte Ltd
• St Microelectronics Asia Pacific Pte Ltd

Inventors

• Collado Raphael
• Tan Cheeseng

Classifications

• G06F9/445

  Program loading or initiating (bootstrapping G06F9/4401; security arrangements for program loading or initiating G06F21/57) · CPC title

• G06F21/53 Primary

  by executing in a restricted environment, e.g. sandbox or secure virtual machine · CPC title

• G06F9/468

  Specific access rights for resources, e.g. using capability register · CPC title

• G06F21/44 Primary

  Program or device authentication · CPC title