Citrix Systems, Inc.

Microsoft Technology Licensing, LLC

Yashabh Sethi

Michael Kevin Larkin

Hirofumi Yamamoto

Sheldon Lachambre

James Yarbrough

Mohit Dhawan

Aman Sethi

Firdosh Kersy Bhesania

Richard Bruce Ward

Alain L Michaud

Nathan C Sherman

Mohamed E Fathalla

Steve Wright

Alain Michaud

Methods, systems, and computer-readable media for optimizing and enhancing delivery of application virtualization layers to client computing devices are described herein. In various embodiments, an application virtualization layer optimization service may identify a first and a second application virtualization layer to be delivered to one or more client computing devices. Each application virtualization layer may represent a package of one or more applications. A layer analysis service may analyze the first and second application virtualization layers to determine conflicts between the layers, using predetermined conflict analysis rules, and generate an actionable conflict resolution report based on the analysis. Based on the actionable conflict resolution report, the application virtualization layer optimization service may resolve conflicts between the first and second application virtualization layers, order the first and application virtualization layers, and deliver the ordered layers to the one or more client computing devices.

Optimizations and enhancements of application virtualization layers

A computing system is configured to use a trampoline to isolate sensitive code in a virtual environment and in other applications. An import table may describe the entry points of a privileged code module or driver that generates privileged code. A system and method loads a shadow kernel to facilitate isolating the linkage between drivers and the rest of the system. The shadow kernel may be a copy of the operating system kernel that does not have the same integral position in the operation of the computing device. The shadow kernel may be used as a template for creating a jump table to redirect more critical privileged resource access requests from specially loaded kernel mode drivers to the PVM. All requests may pass through the PVM, which redirects non-critical functions to the original kernel. Multiple copies of a given driver or code module may be loaded in a given session.

System and method for managing code isolation

Computer-readable media, computerized methods, and computer systems for alerting a user that an operating system has entered a secure mode is provided. Initially, inputs are received at an operating system residing in a default mode. Typically, the default mode allows applications running on the operating system to access the inputs. If the inputs are identified as a call to perform a protected operation, the operating system is transitioned from the default mode to the secure mode. Typically, the secure mode restricts the applications from intercepting the inputs. The transition to the secure mode is automatically communicated to the user via an indicator device. Generally, automatic communication includes providing a message from the operating system to the indicator device over a secure pathway that triggers the indicator device to generate a user-perceivable output. Accordingly, the operating system exerts exclusive control over the operation of the indicator device.

User indicator signifying a secure mode

In aspects, interactions between processes of a desktop are allowed or denied based on security data. The security data may comprise a first bitmap that indicates whether a requesting process is allowed to cause an action to occur, a second bitmap that indicates whether a process is protected from having an action occur, and a third bitmap that indicates whether the requesting process may override protection, if any, in causing the action to occur.

Desktop security

Growing community of inventors

Mountain View, CA, United States of America

Yashabh Sethi