Through the extended application mechanism of the in-process operating system

Abstract

The present disclosure relates to computer-implemented methods, software, and systems for providing an extended application mechanism. Memory is allocated to a virtual environment to run in an application address space, and the application will be extended with extended logic in a secure manner. The virtual environment is configured to run commands related to extended functions of the application. A virtual processor for running commands in the commands related to the extended functions of the application is initialized in the virtual environment. The virtual processor is operable to manage one or more client operating systems (OS). A first client OS is loaded into the allocated memory, and the application logic of the extended function is copied into the allocated memory. The virtual environment is started to run the first client OS and the application logic of the extended function related to the data associated with the application in the allocated memory.

Description

Technical Field

[0001] The present disclosure relates to computer-implemented methods, software, and systems for extending application functionality in a secure manner by running the extended application logic in a virtual environment at the application address space. Background Art

[0002] Software complexity is increasing and causing changes in software product cycles, requirements, and possibilities for delivering software applications and platform systems. Customer needs are shifting to require flexibility in processes, landscapes, and software components. The development of new software applications often relies on existing, previously developed functionality, or relies on integration between software applications to perform more complex use cases. In many cases, software components or entire applications are provided for reuse by customers, partners, developers, consultants, or other end users. For example, software platforms can provide extensible functionality, and thus new applications can be built on top of them.

[0003] Applications can be run as Software-as-a-Service (SaaS) solutions and provide various services when requested by end users (e.g., customers). In this way, customers of on-demand applications do not need to purchase and maintain the hardware and software required to run the application. Cloud applications can be implemented as a set of application services that provide functionality to end users in different scenarios. Summary of the invention

[0004] The present disclosure relates to systems, software, and computer-implemented methods for extending the functionality of an application in a secure manner by running extended application logic in a virtual environment at an allocated memory in an application address space. An example method may include operations such as: allocating memory for a virtual environment to run in an application address space, wherein the virtual environment is configured to run commands related to extended functionality of an application; initializing a virtual processor to run commands from the command in the virtual environment, the virtual processor being operable to manage one or more client operating systems (OS); loading a first client OS of one or more client OSs, the first client OS being loaded in the allocated memory and copying application logic of the extended functionality into the allocated memory; and starting the virtual environment to run the first client OS and application logic of the extended functionality related to data associated with the application in the allocated memory.

[0005] Embodiments may optionally include one or more of the following features. In some cases, a hypervisor is provided as a compiled library that interfaces with an application associated with the operation of the extended function, and the hypervisor is associated with one or more client OSs and the application logic of the extended function. In addition, these and other embodiments may also optionally include: launching an application to run a command at a host system; identifying a command associated with the extended function of the application during the operation of the application; and in response to determining that a virtual processor is to be initialized to run the command, initializing the virtual processor to run the command. In addition, these and other embodiments may also optionally include: providing application data associated with the extended function as read-only data to a memory of a virtual environment; and running a command in a virtual environment based on application data stored in the memory; and in response to completing the execution of the command, stopping the virtual environment to release memory.

[0006] In some cases, the hypervisor manages a virtual environment that includes one or more virtual machines and their corresponding virtual processors. In addition, these and other embodiments may optionally include that the virtual processor included in the virtual environment managed by the hypervisor is initialized, and the initialization includes establishing registers for the virtual processor. In addition, these and other embodiments may optionally include that the client OS includes the minimum viable code required to run commands and extended functions of the application, and wherein the client OS is compiled into a library and linked with the extended functions. In addition, these and other embodiments may optionally include: in response to identifying a command to be run, creating a first thread for running the command in the virtual environment; and in response to identifying a second command, creating a second thread separate from the first thread, the second thread running in parallel with the first thread in the virtual environment.

[0007] Similar operations and processes can be performed in a system including at least one processor and a memory communicatively coupled to the at least one processor, wherein the memory stores instructions that, when executed, cause the at least one processor to perform these operations. In addition, non-transitory computer-readable media storing instructions can also be considered, which, when executed, cause at least one processor to perform these operations. In other words, although it is generally described as a computer-implemented software for processing and converting corresponding data embodied in a tangible non-transitory medium, some or all aspects may be computer-implemented methods, or further included in a corresponding system or other device for performing the described functions. Details of these and other aspects and embodiments of the present disclosure are set forth in the accompanying drawings and the following description. Other features, objects, and advantages of the present disclosure will become apparent from the specification and drawings and the claims. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] Figure 1 An example computer system architecture is shown that may be used to run embodiments of the present disclosure.

[0009] Figure 2 is a flow chart of an example method for running extended application logic in a virtual environment running in allocated memory at an application address space according to an embodiment of the present disclosure.

[0010] Figure 3 is a block diagram of an example computer system architecture of a host system providing applications associated with extended functionality provided by a hypervisor according to an embodiment of the present disclosure.

[0011] Figure 4 is a flowchart of an example method for running an application associated with an extended function according to an embodiment of the present disclosure, the extended function being run in a virtual environment in a secure manner based on application data in a memory. DETAILED DESCRIPTION

[0012] The present disclosure describes various tools and techniques for extending the functionality of an application in a secure manner by running extended application logic in a virtual environment at an allocated memory in an application address space. A software application can use custom code to extend its functionality and provide additional services and functions implemented in the custom code. For example, a database system can be extended by a user (e.g., a developer) with statistical analysis capabilities. Additional functions such as statistical analysis capabilities can be provided by a software provider different from the database system, or by the same provider, but as separate software components. In this way, an extended database system can serve requests associated with performing statistical analysis on data within a database. However, the use of custom code in an existing binary file of an application may be associated with adverse effects on the performance, reliability, and stability of the host system running the application.

[0013] There are different ways to extend an application or system with custom functionality. In some cases, when an application must be extended, the functionality may be rebuilt in the application. In the example of a database system, the external statistical analysis function may be rebuilt as a Structured Query Language (SQL) function in the database. In another case, the data associated with the external custom function can be extracted from the system. In the external environment, the custom logic can be run as a separate system to maintain the integrity of the entire data of the application, and then the externally processed data and results can be reinserted into the host system of the application. In yet another case, the code of the entire application may be changed (e.g., rewritten) and new functionality may be added to the pre-existing code or its modified lines. In this case, the changed code may be recompiled into a new binary file with the extended functionality.

[0014] In some cases, extending the functionality of an application with custom code using one of the above methods may be associated with limited expressiveness, restrictions on programming languages ​​(e.g., SQL), reduced performance due to the potential need for multiple additional processing steps, and unavailability of source code (e.g., extended custom code). The solution described herein attempts to overcome these limitations and provides a solution that can include extended functionality defined based on a technology with full-featured programming language expressiveness associated with the extended functionality. The solution described herein provides for running the extended functionality in a virtual environment that runs in an allocated memory of the application address space. The application can be configured to launch a virtual environment to run commands for the application associated with the extended functionality.

[0015] According to an embodiment of the present disclosure, an application can be extended with customized functions by recompiling an existing binary file of an application with the ability to run commands in a virtual environment. In this way, an executable application can be linked to a hypervisor library. The hypervisor library can provide extended functions for running extended application logic in a virtual environment managed by a hypervisor. A hypervisor can be software that runs on a host system and manages multiple virtual machines (VMs) that provide virtual processor resources and are associated with allocated memory. A virtual environment can be initiated within an application address space on a host system. A hypervisor can emulate instructions that will run in a virtual environment.

[0016] In addition, according to an embodiment of the present disclosure, an application configured to run an extended function in a secure virtual manner can be run within an application address space. Both the extended logic and the application to be extended are run at the same address space, and no separate different address space is allocated for running the extended component in the associated virtual environment. Therefore, when running a scenario associated with the extended logic, context switching between address spaces is reduced, and as a whole, the performance of the application is improved because the process runs faster at one address space of the application.

[0017] According to an embodiment of the present disclosure, when a new extension function is integrated, an application that is configured to be extendable and to run the extension code in a secure virtual environment at the same address space may not need to change the code. The application can be modified to communicate with the external function once in advance, and if different extension logic is to be called and run, it does not need to be modified because the application is integrated with a reference to a management program library that manages the running of the extension logic in the virtual environment.

[0018] In some aspects, when an application is recompiled to have the ability to run extended functions in a virtual environment, the application can be independent of the implementation code of the extended functions. The extended functions can be provided as blocks that are not integrated in the source code of the application. Therefore, according to an embodiment of the present disclosure, the proposed solution provides better application performance and a safe way to run external custom code as a separate logic block that processes related data in the memory in a virtual environment. The extended functions can be provided as compiled executable blocks that can be run in a virtual environment. In some other aspects, the extended functions can be added as modifications to the source code of the application, and thus the extension can be integrated in the application.

[0019] An operating system (OS) can provide a minimum viable code for starting and running an application. The OS can be compiled into a software library and linked with an application (e.g., a web server, a chat application, an image recognition program, etc.). The OS and extended application code can be compiled together to form an executable file associated with an application configured to run extended functions in a virtual environment. The compiled OS and extended application code can be started on hardware or in a virtual environment provided by a VM, where the VM can simulate the performance of a computer system.

[0020] In some cases, the hypervisor manages a virtual environment, where the OS image includes the minimum viable code required to run the loaded extended functions, such as necessary components, libraries, binary files, etc., and the extended code can be run. The OS image is relatively small and lightweight, so it can be quickly started in the virtual environment. The hypervisor includes a list of all started VMs associated with the application. When the application is notified that an extended function is required during the operation of the application, the hypervisor receives the notification and starts a new VM. When the new VM is started, it will be added to the list structure maintained by the hypervisor including the running VM. In some cases, if a different extended function is requested while the application is running, a new VM can be started to run the corresponding extended function. In other cases, a VM that has been created but not used may be reused for the requested extended function to improve and speed up the operation process because the time to initialize the VM can be saved.

[0021] According to an embodiment of the present disclosure, when an application is linked to a hypervisor library to run an extended function in a virtual environment in a safe manner, a virtual environment is established at the allocated memory of the application, and a client OS (guest system) and the application logic of the extended function are loaded in the memory. The client OS runs on a VM that provides a virtual environment. The client OS can provide a minimum viable code for running applications and / or extended applications. The client OS may include providing necessary components, libraries, binary files, and other resources related to running application functions (such as extended functions). The application logic of the extended function is a computer program including instructions that will be run in a virtual environment when the application is running. For example, there may be different client OSs, such as IncludeOS, rumpkernel, MirageOS, OSv, etc., which can be used in combination with specific extended application logic. The client OS can be determined to correspond to requirements and compatibility with extended functions and implementation methods. The client OS can support applications that are limited to a specific platform, such as when the extended source code is lost.

[0022] In some cases, when an application according to an embodiment of the present disclosure is run at a host system, an extended function is called. For example, a statistical function can be called from a database system, wherein the statistical function can be consumed by the host system. In order to protect the operation of the extended function from the impact of the operation of other application logic parts of the application of the host, the virtual processor supporting the virtual machine can be limited to a predefined part of the memory address space of the host process of the host application running at the host OS. The information and data exchange between the host process of the application and the process in the virtual environment is configured based on the definition interface provided by the hypervisor library. In this way, the host process can provide input data related to the extended function running at the client OS, and receive output / result data. However, the extended logic related to the request from the host process running at the client OS cannot access the memory of the host process, nor can it access the data of the application. Therefore, data isolation between the host system and the virtual environment is provided to maintain the integrity of the host system and improve the security of the data at the host system, which can be unaffected by the operation of the extended function.

[0023] Figure 1 An example computer system architecture 100 that can be used to run embodiments of the present disclosure is shown. In the depicted example, the example computer system architecture 100 includes a client device 102, a network 106, and a host system 104. The host system 104 may include one or more server devices and databases, processors, and memory. In the depicted example, a user 112 interacts with the client device 102.

[0024] In some examples, client device 102 can communicate with host system 104 via network 106. In some examples, client device 102 includes any suitable type of computing device, such as a desktop computer, a laptop computer, a handheld computer, a tablet computer, a personal digital assistant (PDA), a cellular phone, a web appliance, a camera, a smart phone, an Enhanced General Packet Radio Service (EGPRS) mobile phone, a media player, a navigation device, an email device, a game console, or a suitable combination of any two or more of these devices or other data processing devices. In some implementations, network 106 may include a large computer network, such as a local area network (LAN), a wide area network (WAN), the Internet, a cellular network, a telephone network (e.g., PSTN), or a suitable combination thereof, that connects any number of communication devices, mobile computing devices, fixed computing devices, and server systems.

[0025] In some implementations, the host system 104 includes at least one server and at least one data storage device. Figure 1 In the example of , host system 104 is intended to represent various forms of servers, including but not limited to web servers, application servers, proxy servers, network servers, and / or server pools. Typically, a server system accepts requests for application services and provides such services to any number of client devices (e.g., client devices 102 on network 106).

[0026] According to an embodiment of the present disclosure, and as described above, the host system 104 may host an application 130 (e.g., one or more computer executable programs provided to be executed by one or more computing devices) running at an "address space 1" 120 of the physical memory 108. The host system 104 includes a physical memory 108, an operating system 110 is loaded in the physical memory 108, and the application 130 runs in the physical memory 108. The application 130 runs at an address space defined at the physical memory 108 - "address space 1" 120.

[0027] Application 130 can provide functions and serve end-user requests. For example, application 130 is a database system in which data is processed and stored. In some cases, it may be required to run untrusted external code in the same address space as application 130. In order to protect the application's code from the influence of the extension code, the virtual environment process operation of the extension code can be embedded in the process operation of application 130. In this way, the isolation provided by the virtual environment provides additional security. Application 130 can be configured to have the ability to utilize external function extensions, and run a VM that can provide a virtual environment for running the extension code. In this way, application 130 can provide extended functions that run in a secure manner to serve requests received at application 130.

[0028] According to an embodiment of the present disclosure, external extension functions can be implemented and provided to application 130. The OS can be compiled as a library, and the extension functions can be associated with application 130. The client OS and the extension can be compiled into a single binary code. They may have different sources, and when built, they form a single executable program.

[0029] The application 130 has executable code that can be linked to the hypervisor 140 associated with the extended function. The implemented application 130 can be modified and configured to communicate with the external function by interfacing with the hypervisor 140. Therefore, when the application 130 is started at the host system 104, it can run the extended function through the hypervisor 140, and the hypervisor 140 manages the virtual environment in which the client OS such as "client OS1" 150 can run with the extended code. The client OS and the extended function can be compiled together to generate executable code that can be started in a hardware or virtual environment. The client OS can be a lightweight software-form OS that only includes the minimum viable code required to start the software application. The minimum viable code may be related to the technology used to implement the extended function. In some cases, additional code may also be included. The client OS may be, such as an implementation method corresponding to the extended function. When implementing the extended function, the OS can be selected to correspond to the requirements and technologies for implementing the extended function. In some cases, the host operating system 110 running the hypervisor 140 (and the application 130 linked to the hypervisor 140) may be different from the client OS running in the virtual environment. In some cases, more than one OS may be loaded in a virtual environment, e.g., Client OS 2, Client OS 3, etc. “Client OS 1” 150 is compiled as a library and linked with extended functionality, and when called by application 130, it may run in a virtual environment within the running process of application 130. A client OS, such as “Client OS 1”, may run as an embedded operating system with hypervisor 140 providing an extension mechanism to application 130.

[0030] In some cases, the hypervisor 140 is software running on the host operating system 110. The hypervisor 140 manages multiple VMs that provide a virtual environment for running extended functions. The hypervisor 140 provides memory to the virtual environment. The VM and the respective virtual environment are managed by the hypervisor. The VM requires memory and central processing unit (CPU) resources. When the VM starts, it simulates the hardware and performance of the computing system. The hypervisor can put the processor into a special mode, in which if a special instruction is run, the special instruction will be captured by the central processor, and the special instruction will notify the hypervisor 140 to provide and establish a virtual environment. When a special instruction is run, the hypervisor 140 is notified and simulates the instruction in the virtual environment.

[0031] Hypervisor 140 ensures that memory and processor resources are provided to the VM. In some cases, hypervisor 140 can be implemented independently of host operating system 110. Hypervisor 140 includes a list of all initialized VMs. When application 130 is running and is notified that extended functionality is required, application 130 communicates with hypervisor 140 to start a new VM. In this way, hypervisor 140 is notified to establish a virtual environment and emulate instructions received from application 130 into the virtual environment. New VMs can be added to the list maintained by hypervisor 140. Therefore, when a new extended functionality is requested by application 130, hypervisor 140 starts a new VM.

[0032] In some cases, a VM may include one or more threads that act as a virtual processor to be run and allocated memory. The VMs forming a virtual environment may be arranged to work within a common address space, but will not see each other's operation. The memory is allocated in the "address space 1" 120 of the application 130 for the virtual environment associated with the command associated with the extended function. The memory allocated to the virtual environment includes two parts. The memory includes a memory for managing the virtual environment (such as register values ​​of the virtual processor and other data required to describe the VM). In addition, the memory includes a main memory used by the extended function to store data and results. For example, the stored data may include executable binary code. When the hypervisor 140 runs the virtual environment at the "address space 1" 120 allocated to the application 130, the application 130 can communicate with the virtual environment in the memory. The application 130 can access all the memory owned by the VM, but not vice versa. In this way, the extended code running in the virtual environment can access the data within the boundaries of the virtual environment provided by (multiple) VMs.

[0033] Once the virtual environment is initialized, the hypervisor 140 can identify instructions associated with extended functions. In some embodiments of the present disclosure, the hypervisor 140 can identify multiple instructions associated with extended functions. Based on the identified instructions, the hypervisor 140 can determine the extended function associated with the instruction and simulate the extended function in the virtual environment. When the application 130 is running, the application 130 is the owner of the process associated with the operation of the request initiated from the application 130. When the process is associated with extended logic, it also includes the operation executed at the VM. Such a process can be run as a single process supported (leverage) within the public address space extended in the virtual environment. A hypervisor, i.e., the hypervisor 140, can work with all client OS loaded in the virtual environment. The hypervisor 140 can be internally configured to communicate with different client OS.

[0034] In the initialized virtual environment, a client OS, such as "client OS1" 150, is loaded. The client OS is loaded together with the extension logic, which is extracted and copied at the allocated memory of the virtual environment. Therefore, commands that are run during the execution of the application 130 at the host system 104 are processed. When a command is associated with a startup VM, the command is run at the started VM that is running the client OS and the extension logic. Once a command is run in the virtual environment, the VM can be stored. VMs that are not running commands can be cleared from the memory allocated to the virtual environment. In some cases, when the virtual environment stops and is ready to release memory, the organization of the virtual environment for running extended functions can be enhanced by providing the ability to reuse a portion of the virtual environment including the complete code of the extension logic in another virtual environment or the same virtual environment. For example, it can be reused for another command execution.

[0035] Figure 2 is a flow chart of an example method 200 for running extended application logic in a virtual environment that runs in allocated memory at an application address space according to an embodiment of the present disclosure. It should be understood that method 200 and related methods can be performed, for example, by any suitable system, environment, software and hardware, or a combination of suitable systems, environments, software and hardware. In some embodiments, example method 200 and related methods are implemented by the above-mentioned Figure 1 One or more components of system 100 are described as operating.

[0036] At 205, an application is started. The application may be such as Figure 1 The application 130 in the example. The application can be launched by a customer, end user, etc. through the interface of the application. The application can be implemented as a link to an extended function that can run securely in a virtual environment managed by a hypervisor, such as related to the above description, for example, Figure 1 The hypervisor and virtual environment described in the related description. The application may include a command for starting a virtual environment for extended functions. The hypervisor may be provided as a compiled library for an application interface related to the execution of commands associated with the extended functions. The client OS may be defined as linked to the extended functions. The client OS and the implemented extended functions are provided to the application. The application includes a command for starting a virtual environment for the extended functions. At 210, during the execution of the application, the commands are executed sequentially. At 215, the commands are evaluated to determine whether a VM is required for the execution of a given command. When the command is related to an extended function associated with the application 130, the application 130 is enhanced to interface with the hypervisor.

[0037] At 220, when it is determined that the evaluated command is not associated with an extended function that needs to be run in a virtual environment, the command is run in the computing environment of the application. Once the command begins to run, the application can run the next subsequent command, wherein the commands of the application are evaluated sequentially at 210. In addition, commands can also be evaluated in parallel. At 225, the evaluated command is associated with an extended function to be provided by the application, so memory is allocated for initializing a virtual environment for running the extended function. In such a virtual environment, the identified command will be run. The allocated memory is defined in the application address space. For example, in Figure 1 In the context of , memory for the virtual environment is allocated by the hypervisor 140 at “address space 1 ” 120 of the application 130 .

[0038] At 230, the virtual environment is initialized, which includes initializing the virtual processor. One or more registers may be set for the virtual processor to define initial values ​​of specific memory locations in the virtual environment and the internal state of the virtual processor. The hypervisor may communicate with an operating system running on a host system running an application and restrict visible accessible memory of the virtual processor to the main memory defined in the virtual environment.

[0039] At 235, when the virtual processor is initialized, the client OS is loaded into the memory allocated for the virtual environment together with the logic for implementing the extended function. In an alternative embodiment, the client OS can be first loaded into the allocated memory together with the extended logic, and then the virtual processor can be initialized. In this way, 230 is performed after 235. At 240, the virtual environment is started by starting the VM defined by the hypervisor. The virtual environment is started to run the client OS and the application logic of the extended function. At 245, the command identified at 210 is run in the virtual environment. The execution of the command can be associated with the data of the application started in the allocated memory. This data can be transferred from the memory of the application to the allocated memory of the virtual environment. In this way, the extended application logic works in the memory together with the relevant data of the extended function. In some cases, the data can be provided to the memory of the virtual environment as read-only data and / or read-write data.

[0040] At 250, once the execution of the command is complete, the virtual environment is stopped. At 260, the memory allocated for the virtual environment to execute the identified command is cleaned up, and the memory is released for use in other virtual environments initialized for other commands identified at 210. In some cases, only a portion of the memory may be cleaned up, i.e., the portion containing sensitive data for the execution of the function. The portion included in the implemented extension logic may be reused to execute the same extension function. Therefore, the runtime will be improved because the time to initialize and start a new virtual machine can be saved.

[0041] In some embodiments according to the present disclosure, once a command associated with a VM is identified at 215, a first thread for running the command in a virtual environment may be created. If commands are evaluated in parallel, multiple threads may be created in parallel. The application may continue to launch commands even if the previous command has not yet completed. In response to identifying a second command also associated with a VM, a second thread separate from the first thread may be created in the virtual environment. The second thread may run in parallel with the first thread to improve application performance.

[0042] Figure 3 is a block diagram of an example computer system architecture 300 of a host system 310 according to an embodiment of the present disclosure, wherein applications associated with extended functionality provided by a hypervisor 335 are provided. In some embodiments, the host system 310 may be a Figure 1 The host system 104. The host system 310 is provided to run and provide hardware resources 325 and computer memory 320 that can be consumed by software applications running on the host system 310.

[0043] According to an embodiment of the present disclosure, an application 340 may be launched to run on the host system 315. The application may be, for example, Figure 1 Application 130, or Figure 2 In some cases, application 340 may be built on top of an existing application that is enhanced to perform extended functionality in a secure manner. Application 340 may include logic 345 implemented to provide services and functionality. Application 340 also includes data 355. Application 340 may be linked to extended functionality via extension link 350 by interfacing with hypervisor 335. Hypervisor 335 may be such as Figure 1 Management program 140. Figure 1 and Figure 2 As described, the extended function may be the source code of an application provided externally, which is compiled together with an OS (such as a client OS). The extended function may be run in a virtual environment (such as virtual environments 361, 362, 363). The virtual environment may be established at the same address space (address space A 330) where the application 340 is running. The memory in the address space A 330 of the application 340 may be allocated for running the virtual environment associated with running commands associated with the extended function of the application 340.

[0044] As shown, application 340 can interface with management program 335. Management program 335 manages virtual environments 361, 362 and 363, and starts one or more VMs related to the operation of the extended function of application 340. Start virtual environments 361, 362 and 363 to run the application logic of client OS and extended functions accordingly. In order to start the virtual environment, the virtual processor is initialized to run commands in the virtual environment. Management program 335 can load client OS-client OS1 370, client OS2375 and client OS3 380, and can also copy the application logic of the extended function to the memory allocated for running in the corresponding virtual environment 361, 362 and 363. Client OS and extended functions are provided as a single compiled entity. Client OS is uploaded to the address space memory allocated by the application together with the extended implementation code. In this way, client OS and extended implementation code are extracted and copied to the memory space and the allocated memory. Then load the client OS and start the virtual processor, the purpose of which is to start the client OS and implement the extended logic.

[0045] In some cases, some data from the application may be placed into the virtual environment, for example as read-only data, or as read-write data. As a result, instructions associated with the data run faster because it is stored in memory, and thus provide improved application operation. Virtual environments 361, 362, and 363 are initialized and can be started to support the execution of commands associated with the extended functionality of application 340. Once the calculations and / or operations of the extended functionality are performed in the virtual environment (e.g., in virtual environment 361), the output of the functionality may be provided to application 340 and stored in the application data storage device, for example as part of data 355. Once the extended functionality has completed its execution, the started VM is stopped, and the memory allocated for the virtual environment may be released or cleaned up in whole or in part.

[0046] The computations performed in the virtual environment may not affect the data stored in data 355 because the portion of data 355 associated with the extended functionality is copied and transferred in the allocated memory space. The virtual processor of the virtual environment may not read memory outside the memory allocated for the virtual environment. Therefore, the operation of the extended functionality may only operate on data within the allocated memory for the virtual environment at the address space A 330 of the application 340. The hypervisor 335 may be configured to monitor whether the virtual processor wants to execute or access data outside the allocated range, and if so, the hypervisor may terminate the VM before the VM performs any action.

[0047] Figure 4 is a flowchart of an example method 400 for running an application associated with an extended function in a secure manner in a virtual environment based on application data in memory according to an embodiment of the present disclosure. The process 400 may be implemented in a server system, such as Figure 1 host system 104, or Figure 3 The host system 310. The example process 400 may be implemented as a computer-implemented process executed by one or more processors.

[0048] At 405, the application is started to run on the host system. The host system may be such as Figure 1 The host system 104 and / or Figure 3 The host system 310 of the present disclosure. According to an embodiment of the present disclosure, the application can be configured to run the extended functionality in a secure manner in a virtual environment running in the application address space. The application can be implemented as a cloud application. The application can be linked to a hypervisor that provides a client OS and extended code related to providing extended functionality in a virtual environment. The hypervisor, the provided client OS, and the extended code can be such as those described above with respect to the embodiments of the present disclosure.

[0049] At 410, during the execution of the application, a command is identified as being associated with an extended functionality of the application. The hypervisor may be provided as a compiled library that interfaces with the application associated with the execution of the identified command, the identified command being associated with the extended functionality. At 415, memory is allocated for executing the virtual environment. The allocated memory is located in the address space of the application at the host system. At 420, a virtual processor is initialized to execute the identified command.

[0050] At 425, the client OS is loaded and the application logic of the extended function is copied into the allocated memory. In some cases, more than one client OS can be loaded. The implementation code of the extended function is copied into the allocated memory in the virtual environment.

[0051] At 430, the virtual environment is started to run the application logic of the extended function. Data associated with the extended logic and stored in the application can be transferred to the memory of the virtual environment for in-memory processing at the client OS.

[0052] At 435, the identified command is executed in the virtual environment based on the in-memory application data. The output of the command executed in the virtual environment can be provided to the application. In some cases, the output can be stored at the data storage device of the application and the host system, or can be directly provided to the end user, such as at the user interface of the application. At 440, based on the command execution, the virtual environment is stopped. The VMs defined for the virtual environment can be stopped and cleaned up to free up memory for these VMs for other VMs that may need to be associated with other identified commands.

[0053] The foregoing figures and accompanying descriptions illustrate example processes and computer-implemented techniques. However, system 100 (or its software or other components) contemplates the use, implementation, or operation of any suitable techniques to operate these and other tasks. It should be understood that these processes are for illustrative purposes only, and that the described or similar techniques may be performed at any suitable time, including simultaneous, separate, or combined execution. In addition, many of the operations in these processes may occur simultaneously, concurrently, and / or in a different order than shown. In addition, the described systems and processes may use processes and / or components having or performing additional operations, fewer operations, and / or different operations, as long as the methods and systems remain appropriate.

[0054] In other words, although the present disclosure has been described according to certain embodiments and generally associated methods, the changes and permutations of these embodiments and methods are obvious to those skilled in the art. Therefore, the above description of the exemplary embodiments does not limit or constrain the present disclosure. Other changes, substitutions and variations are also possible without departing from the spirit and scope of the present disclosure.

Claims

1. A computer-implemented method comprising: allocating memory to a virtual environment to run in an application address space, wherein the virtual environment is configured to run commands associated with extended functionality of the application, wherein during execution of the application, the commands are identified as being associated with the extended functionality; initializing a virtual processor to execute a first of the commands in a virtual environment, the virtual processor being operable to manage one or more guest operating systems (OS), wherein the virtual processor is restricted to a predefined portion of an address space of an application; loading a first client OS among the one or more client OSs, the first client OS being loaded into the allocated memory, and copying the application logic of the extended function into the allocated memory; and A virtual environment is started to run the first guest OS and the application logic of the extended function to embed the execution of the application logic of the extended function into the execution of the host process running at the application, wherein the virtual environment is started in association with the execution of a first command recognized during the execution of the host process at the application to request the execution of the extended code of the extended function, wherein the execution of the application logic of the extended function is performed in the allocated memory for the extended function on the data directly provided by the host process for the execution of the extended function of the application, wherein the application logic of the extended function has restricted access to the memory of the host process.

2. The computer-implemented method of claim 1 , further comprising: A hypervisor is provided as a compiled library that interfaces with applications related to the execution of the extended functions, the hypervisor being associated with the one or more client OSs and the application logic of the extended functions.

3. The computer-implemented method of claim 1 , further comprising: launching an application to run the command at the host system; identifying the first command during the running of the application, the first command being related to an extended function of the application; as well as In response to determining that the virtual processor is to be initialized to run the first command, the virtual processor is initialized to run the first command.

4. The computer-implemented method of claim 1 , further comprising: providing application data related to the extended function as read-only data into a memory of the virtual environment; executing the first command in a virtual environment based on application data stored in the memory; as well as In response to completing the execution of the first command, stopping the virtual environment to release memory. 5 . The computer-implemented method of claim 1 , wherein a hypervisor manages a virtual environment including one or more virtual machines and their corresponding virtual processors.

6. The computer-implemented method of claim 5, wherein initializing the virtual processor comprises setting up registers for the virtual processor.

7. The computer-implemented method of claim 1, wherein the client OS includes minimum viable code required to run the first command and extended functionality of the application, and wherein the client OS is compiled as a library and linked with the extended functionality.

8. The computer-implemented method of claim 1 , further comprising: In response to identifying the first command to be executed, creating a first thread for executing the first command in a virtual environment; as well as In response to identifying the second command, a second thread separate from the first thread is created, the second thread being configured to run in parallel with the first thread in the virtual environment.

9. A non-transitory computer-readable medium storing computer-readable instructions executable by a computer and configured to: Allocating memory for a virtual environment to run in an application address space, wherein the virtual environment is configured to run commands associated with extended functionality of the application, wherein: During the application runtime, the command is identified as being related to the extended functionality; initializing a virtual processor to execute a first of the commands in a virtual environment, the virtual processor being operable to manage one or more guest operating systems (OS), wherein the virtual processor is restricted to a predefined portion of an address space of an application; loading a first client OS among the one or more client OSs, the first client OS being loaded into the allocated memory, and copying the application logic of the extended function into the allocated memory; and A virtual environment is started to run the first guest OS and the application logic of the extended function to embed the execution of the application logic of the extended function into the execution of the host process running at the application, wherein the virtual environment is started in association with the execution of a first command recognized during the execution of the host process at the application to request the execution of the extended code of the extended function, wherein the execution of the application logic of the extended function is performed in the allocated memory for the extended function on the data directly provided by the host process for the execution of the extended function of the application, wherein the application logic of the extended function has restricted access to the memory of the host process.

10. The computer-readable medium of claim 9, further storing instructions configured to: A hypervisor is provided as a compiled library that interfaces with applications related to the execution of the extended functions, the hypervisor being associated with the one or more client OSs and the application logic of the extended functions.

11. The computer-readable medium of claim 10, further storing instructions configured to: launching an application to run the command at the host system; identifying the first command during the running of the application, the first command being related to an extended function of the application; and In response to determining that the virtual processor is to be initialized to run the first command, the virtual processor is initialized to run the first command.

12. The computer-readable medium of claim 9, further storing instructions configured to: providing application data related to the extended function as read-only data into a memory of the virtual environment; Executing the first command in a virtual environment based on application data stored in the memory; and In response to completing the execution of the first command, stopping the virtual environment to release memory.

13. The computer-readable medium of claim 9, wherein the hypervisor manages a virtual environment including one or more virtual machines and their corresponding virtual processors, and wherein initializing the virtual processor comprises establishing registers for the virtual processor.

14. The computer-readable medium of claim 9, wherein the client OS includes minimum viable code required to run the first command and the extended functionality of the application, and wherein the client OS is compiled as a library and linked with the extended functionality.

15. The computer-readable medium of claim 9, further storing instructions configured to: In response to identifying the first command to be executed, creating a first thread for executing the first command in a virtual environment; and In response to identifying the second command, a second thread separate from the first thread is created, the second thread being configured to run in parallel with the first thread in the virtual environment.

16. A system comprising: Computing equipment; and A computer-readable storage device coupled to the computing device and having instructions stored thereon, which, when executed by the computing device, cause the computing device to perform operations, the operations comprising: allocating memory to a virtual environment to run in an application address space, wherein the virtual environment is configured to run commands associated with extended functionality of the application, wherein during execution of the application, the commands are identified as being associated with the extended functionality; initializing a virtual processor to execute a first of the commands in a virtual environment, the virtual processor being operable to manage one or more guest operating systems (OS), wherein the virtual processor is restricted to a predefined portion of an address space of an application; loading a first client OS among the one or more client OSs, the first client OS being loaded into the allocated memory, and copying the application logic of the extended function into the allocated memory; and A virtual environment is started to run the first guest OS and the application logic of the extended function to embed the execution of the application logic of the extended function into the execution of the host process running at the application, wherein the virtual environment is started in association with the execution of a first command recognized during the execution of the host process at the application to request the execution of the extended code of the extended function, wherein the execution of the application logic of the extended function is performed in the allocated memory for the extended function on the data directly provided by the host process for the execution of the extended function of the application, wherein the application logic of the extended function has restricted access to the memory of the host process.

17. The system of claim 16, wherein: The computer readable storage device includes further instructions that, when executed by the computing device, cause the computing device to perform operations including: A hypervisor is provided as a compiled library that interfaces with applications related to the execution of the extended functions, the hypervisor being associated with the one or more client OSs and the application logic of the extended functions.

18. The system of claim 16, wherein: The computer readable storage device includes further instructions that, when executed by the computing device, cause the computing device to perform operations including: launching an application to run the command at the host system; identifying the first command during the running of the application, the first command being related to an extended function of the application; as well as In response to determining that the virtual processor is to be initialized to run the first command, the virtual processor is initialized to run the first command.

19. The system of claim 16, wherein: The computer readable storage device includes further instructions that, when executed by the computing device, cause the computing device to perform operations including: providing application data related to the extended function as read-only data into a memory of the virtual environment; executing the first command in a virtual environment based on application data stored in the memory; as well as In response to completing the execution of the first command, stopping the virtual environment to release memory.

20. The system of claim 16, wherein a hypervisor manages a virtual environment including one or more virtual machines and their corresponding virtual processors, wherein initializing the virtual processor includes establishing registers for the virtual processor, wherein a client OS includes a minimum viable code required to run the first command and the extended functionality of the application, and wherein the client OS is compiled into a library and linked to the extended functionality.

Images