Citrix Systems, Inc.

Jeffrey Dale Muir

Andrew Borzycki

Richard James Mazzaferri

Anil Roychoudhry

Lee Laborczfalvi

Huai Chin

Nicholas Alexander Bissett

Ian Pratt

Richard Jason Croft

Michael Wookey

Donovan Ross Hackett

Pierre Semaan

Huai Chiun Chin

Lee George Laborczfalvi

Andrew Gerard Borzycki

A system for optimizing a process of archiving at least one block of a virtual disk image includes a file system analysis component and an archiving component. The file system analysis component executes on a first physical computing device and identifies a plurality of blocks storing data comprising a file in a virtual disk image file. The archiving component executes on the first physical computing device, identifies a difference disk file storing an identification of a modification to the identified plurality of blocks storing data comprising the file, determines whether to archive the file, and transmits, to a second physical computing device, the plurality of blocks storing data comprising the file.

Methods and systems for optimizing a process of archiving at least one block of a virtual disk image

A method for moving an executing process from a source isolation scope to a target isolation scope includes the step of determining that the process is in a state suitable for moving. The association of the process changes from a source isolation scope to a target isolation scope. A rule loads in association with the target isolation scope.

Method and apparatus for moving processes between isolation environments

The present solution reduces the attack surface of a server by selectively opening a server port for listening when a client has been authenticated/authorized via another machine or process, and directed to connect to the server in question. When not selectively listening on a port, the server does not listen or open ports for connections or otherwise minimizes the number of open ports. By selectively listening for connections, the server reduces the opportunity for hackers to attack the server process, and improves the security of the server. The ability to selectively listen on a port at specific times may be combined with additional meta information&#x2014;like ticketing and prior authentication information to help further secure the server. The meta information may identify and ensure that only the correct remote endpoint is allowed to connect via the port. Instead of first listening for connections and then authenticate and authorize the received connection as with typical servers, the present solution first authenticates/authorizes a connection via another machine or process, then listens for an expected and authorized connection.

Systems and methods for enhancing security by selectively opening a listening port when an incoming connection is expected

A method for presenting an aggregate view of native resources includes the step of enumerating a plurality of system-scoped native resources provided by a system scope. A plurality of application-scoped native resources provided by an application isolation scope are enumerated, some of which correspond to some of the plurality of system-scoped resources. For one of the plurality of system-scoped resources, the existence of a corresponding one of the plurality of application-scoped resources is determined and the corresponding one of the plurality of application-scoped resources is included in an aggregate view of native resources.

Method and apparatus for providing an aggregate view of enumerated system resources from various isolation layers

A method for virtualizing access to named system objects includes the step of receiving a request to access a system object from a process executing in the context of a user isolation scope, the request including a virtual name for the system object. A rule associated with the request is determined and a literal name for the system object is formed in response to the determined rule. A request to access the system object is issued to the operating system. The issued request including the literal name for the system object.

System for virtualizing access to named system objects using rule action associated with request

A method for isolating access by application programs to native resources provided by an operating system redirects a request for a native resource made by an application program executing on behalf of a user to an isolation environment. The isolation environment includes a user isolation scope and an application isolation scope. An instance of the requested native resource is located in the user isolation scope corresponding to the user. The request for the native resource is fulfilled using the version of the resource located in the user isolation scope. If an instance of the requested native resource is not located in the user isolation scope, the request is redirected to an application isolation scope. The request for the native resource is fulfilled using the version of the resource located in the application isolation scope. If an instance of the requested native resource is not located in the application isolation scope, the request is redirected to a system scope.

Growing community of inventors

Logan Valley, Australia

Jeffrey Dale Muir