Bromium, Inc.

Advanced Micro Devices Corporation

Globalfoundries Inc.

Hewlett-packard Development Company, L.p.

Lenovo (singapore) Pte. Ltd.

Lenovo (beijing) Limited

Kiran Bondalapati

Vikram Kapoor

Gaurav Banga

Ian Pratt

Prakash Buddhiraja

William Alexander Hughes

Vydhyanathan Kalyanasundharam

Jacob Gorm Hansen

Krzysztof Uchronski

Martin O'Brien

Samuel D Naffziger

John P Petry

Philip Enrique Madrid

Stephen C Ennis

Ajay Gulati

Deepak Khajuria

Benjamin Tsien

Kevin Michael Lepak

Benjamin T Sander

Eric M Rentschler

Aaron Joseph Grenat

Magiting M Talisayon

Simon Crosby

Mom-Eng Ng

Hao Huang

Jeremy Schreiber

Vadim Dmitriev

Stephen Rice

One or more non-transitory machine-readable storage mediums storing program instructions for operating a first cluster of servers. The program instructions are configured to be executable by one or more processors of the first cluster of servers to perform various operations. The operations may include storing a user interface of a cloud service consumer and receiving, from a user, a request to access services of the cloud service consumer. The operations may further include retrieving, from a second cluster of servers maintained by the cloud service consumer, user data required in response to the request and providing the user interface and the user data to the user.

Highly available private cloud service

A first cluster of servers maintains a shared database that stores, for each of a plurality of cloud service consumers, user interface data for the cloud service consumer, wherein each server in the first cluster can read and write to the shared database. The first cluster further receives, from a customer computer, a request to access services of an identified cloud service consumer among the plurality of cloud service consumers, wherein the customer computer is associated with a customer of the identified cloud service consumer. Still further, the first cluster retrieves the user interface data of the identified cloud service consumer from the shared database; retrieves, from a second cluster of servers maintained by the identified cloud service consumer, user data required in response to the request; and provides the user interface data of the identified cloud service consumer and the user data to the customer computer.

Approaches for composing the display of a virtualized web browser. Upon a host module, executing in a host operating system, of a virtualized web browser being instructed to display a new web page, policy data is consulted to determine if one or more trigger conditions are satisfied. Upon determining that at least one of the one or more trigger conditions is satisfied, the virtualized web browser, transparently to a user, retrieving and rendering the new web page in a location different than where the previous web page was retrieved and rendered by the virtualized web browser. After the new web page has been retrieved and rendered at the location specified by the policy data, the host module displays the new web page. The policy data may operate to specify the behavior of individual tabs of the virtualized web browser.

Composing the display of a virtualized web browser

Embodiments of the invention enable any request to download data to a computer system to be performed such that the requested data is stored in a dedicated virtual machine. A request to transfer data from an external location to the computer system is received. The request may originate from a process in a virtual machine or a host operating system. A connection with the external location using parameters identified in the request. The request is performed by transferring the data from the external location to a dedicated virtual machine which does not have access to the file system and cannot persistently store data on the computer system. One or more dedicated virtual machines may be instantiated as needed. A single dedicated virtual machine may accommodate multiple downloads concurrently.

Downloading data in a dedicated virtual machine

Approaches for automated provisioning of a private cloud infrastructure. A cloud service provider maintains a first cluster of servers which stores a set of user interfaces. Each first cluster node comprises a first distributed management layer that manages, monitors, and self-heals first cluster nodes and facilitates communication with nodes of a second cluster of servers. A cloud service consumer maintains the second cluster which stores sets of user data. Second cluster nodes comprise a second distributed management layer that manages, monitors, and self-heals second cluster nodes and facilitates communication with first cluster nodes. When a first node in the first cluster receives a request from an end-user of a cloud-based service, the first node (a) communicates with the second distributed management layer to obtain a required set of user data and (b) prepares and transmits, to the end-user, a response that comprises the appropriate user interface and required user data.

Migrating support for a web browsing session between a virtual machine and a host operating system. A web session is supported by a first virtual machine which executes on a computer system. Upon receiving a request for the web session to enter an unprotected mode, support for the web session is migrated from the first virtual machine to a host operating system of the computer system. In unprotected mode, web sessions are supported by the host operating system rather than by a virtual machine. After migrating support for the web session to the host operating system, a visual cue indicating that the unprotected mode is active is displayed. After receiving a request to exit the unprotected mode, support for the web session is migrated from the host operating system to a second virtual machine executing on the computer system and the visual cue is removed.

On-demand unprotected mode access

Approaches for synchronizing resources of a virtualized web browser. When a virtualized web browser is instructed to display a web page, a host module executing within a host operating instructs retrieves, from each of one or more virtual machines, contents for a portion of the web page. The virtualized web browser assembles the contents and displays the web page. A web browser executing in the host operating system may, but need not, retrieve any of the content displayed thereby. Instead, the content retrieved by the web browser executing in the host operating system may be retrieved by and rendered within a virtual machine. The behavior of the virtualized web browser may be configured using policy data.

Synchronizing resources of a virtualized browser

Approaches for creating a template virtual machine. An in-memory state of a virtual machine and/or a set of applications executing within the virtual machine are adjusted and/or configured based on the intended use of the template virtual machine. Thereafter, the virtual machine is established as a template virtual machine. The template virtual machine may be used to create one or more virtual machines using a copy-on-write memory process.

Preparing a virtual machine for template creation

Approaches for providing a guest operating system to a virtual machine. A read-only copy of one or more disk volumes, including a boot volume, is created. A copy of a master boot record (MBR) for the one or more disk volumes is also stored. The read-only copy may be, but need not be, made using a Volume Shadow Copy Service (VSS). A virtual disk, for use by the virtual machine, is created based on the read-only copy of the one or more disk volumes and the copy of the master boot record (MBR), wherein the virtual disk comprises the guest operating system used by the virtual machine. In this way, a single installed operating system may provide both the host operating system and the guest operating system.

Approaches for efficient physical to virtual disk conversion

Approaches for synchronizing history data across a virtualized web browser. When a user instructs a virtualized web browser, executing on a host operating system, to display a web page, a host module executing on the host operating system may instruct a guest module executing within a particular virtual machine to retrieve the web page. The host module may provide to the guest module history data for the virtualized web browser. History data describes browsing history for the virtualized web browser, either in the current instance or for previous instances. The guest module performs operations in accordance with the history data. When the host module receives the screen data content from the guest module, the host module instructs the virtualized web browser to display the web page using the screen data content.

Synchronizing history data across a virtualized web browser

Approaches for synchronizing cookie data across a virtualized web browser. When a user instructs a virtualized web browser, executing on a host operating system, to display a web page, a host module executing on the host operating system instructs a particular virtual machine to retrieve the web page within the particular virtual machine. The host module provides cookie data for the user to the guest module. The cookie data identifies one or more cookies deemed to be pertinent to the retrieval of the web page. The guest module provides, to the host module, screen data content for use in displaying the web page.

Synchronizing cookie data using a virtualized browser

Approaches for executing untrusted software on a client without compromising the client using micro-virtualization to execute untrusted software in isolated contexts. In response to receiving a request to perform an action, an isolated environment (such as but not limited to a virtual machine) is instantiated without receiving an explicit user instruction to do so. To instantiate the isolated environment, one or more templates for use in instantiating the isolated environment are identified using a policy. The one or more templates describe isolated environment characteristics for different types of activity. After the isolated environment has been instantiated using one or more identified templates, the action may be performed in the isolated environment.

Automated provisioning of secure virtual execution environment using virtual machine templates based on source code origin

Approaches for selectively sharing cookies between virtual machines responsible for retrieving web content. A request to display a web page is received. The web page includes top-level content served by a top-level domain and secondary content served by one or more other domains. A determination that at least a portion of the web page should be retrieved from within a virtual machine is made. A policy is consulted to identify a set of cookies to inject into the virtual machine. The policy considers whether the virtual machine is responsible for retrieving one or more of top-level content and secondary content in identifying the set of cookies to inject into the virtual machine. After injecting the set of cookies into the virtual machine, the portion of the web page is retrieved from within the virtual machine.

Sharing and injecting cookies into virtual machines for retrieving requested web pages

Managing the guest operating system's eviction of memory pages from a virtual machine. A guest operating system or a hypervisor may cause one or more memory pages within a guest physical frame to become unlikely or ineligible for selection as a candidate for eviction by the guest operating system. Each of the one or more memory pages may also reside, or be intended to reside, in the memory of one or more other virtual machines. In this way, memory pages that are shared across multiple virtual machines may become less likely to be evicted, thereby using memory more efficiently.

Managing the eviction process

Approaches for transferring a file using a virtualized application. A virtualized application executes within a virtual machine residing on a physical machine. When the virtualized application is instructed to download a file stored external to the physical machine, the virtualized application displays an interface which enables at least a portion of a file system, maintained by a host OS, to be browsed while preventing files stored within the virtual machine to be browsed. Upon the virtualized application receiving input identifying a target location within the file system, the virtualized application stores the file at the target location. The virtualized application may also upload a file stored on the physical machine using an interface which enables at least a portion of a file system of a host OS to be browsed while preventing files in the virtual machine to be browsed.

Growing community of inventors

Los Altos, CA, United States of America

Kiran Bondalapati