Dynamic system updates in a capability-restricted system

Abstract

Systems and methods are directed to implementing dynamic updates in a capability-restricted system. In some embodiments, application communication pathways are assigned as either restart isolated communication pathways or restart integrated communication pathways. Restart isolated communication pathways are pathways whereby a restart of an application on one end of the pathway does not require a restart of an application on the other end of the pathway. Restart integrated communication pathways are pathways whereby a restart of an application on one end of the pathway requires a restart of an application on the other end of the pathway. In some examples, the applications are assigned into one or zones, whereby restarts or other issues in one zone, such as an attack of resources, does not affect applications in other zones.

Description

DYNAMIC SYSTEM UPDATES IN A CAPABILITY-RESTRICTED SYSTEMBACKGROUND

[0001] When implementing updates to systems, there are typically two types of updates - static and dynamic. In a static update, a system receives an update, loads the updates, and is thereafter shut down. Computation restarts from the initial state after the update. On the other hand, a dynamic update is where an update is made during runtime, whereby systems are updated with a termination event. Each type of update comes with its own advantages and disadvantages. For example, while a static update often reduces the probability of conflicts and errors that an update may cause to an operating system, a disadvantage is the fact that the system is taken out of service during the shutdown and restarting process. In another example, while a dynamic update allows the system maintain operation during the update, the updates often require the system to maintain an existing configuration, receive the new configuration, authenticate / authorize the new configuration, and ensure that all policies are met. Thus, while in conventional systems dynamic updates may allow a system to continue operating, the resources that are required may reduce the performance of the system.

[0002] Aspects of the present disclosure are directed towards overcoming some of the disadvantages of conventional dynamic system updates.SUMMARY

[0003] In an aspect of the presently disclosed subject matter, a method includes instantiating, in one or more systems, a client, a message server, and a server by reading a first manifest comprising a set of instructions to instantiate the client, the server, and the message server; instantiating, by reading the first manifest, a first user application in a first zone, a second user application in the first zone, a and a third user application in a second zone; establishing, by reading the first manifest, a first one-way communication pathway from the first user application to the second user application, wherein the first one-way communication pathway is a restart integrated communication pathway; and establishing, by reading the first manifest, a second one-way communication pathway from the second user application to the third user application, wherein the second communication pathway is a restart isolated communication pathway.

[0004] In another aspect of the presently disclosed subject matter, a computer-readable storage medium having computer-executable instructions thereon, which when executed by one or more computers perform the steps of instantiating, in one or more systems, a client, a message server, and a server by reading a first manifest comprising a set of instructions to instantiate the client, the server, and the message server; instantiate, by reading the first manifest, a first user application in a first zone, a second user application in the first zone, a and a third user application in a second zone; establish, by reading the first manifest, a first one-way communication pathway from the first user application to the second user application, wherein the first one-way communication pathway is a restart integrated communication pathway; and establish, by reading the first manifest, a second one-way communication pathway from the second user application to the third user application, wherein the second communication pathway is a restart isolated communication pathway.

[0005] In a still further aspect of the presently disclosed subject matter, a system includes a memory storing computer-executable instructions; and one or more processor cores in communication with the memory, the computer-executable instructions causing the one or more processors to perform acts comprising: instantiating, in one or more systems, a client, a message server, and a server by reading a first manifest comprising a set of instructions to instantiate the client, the server, and the message server; instantiate, by reading the first manifest, a first user application in a first zone, a second user application in the first zone, a and a third user application in a second zone; establish, by reading the first manifest, a first one-way communication pathway from the first user application to the second user application, wherein the first one-way communication pathway is a restart integrated communication pathway; and establish, by reading the first manifest, a second one-way communication pathway from the second user application to the third user application, wherein the second communication pathway is a restart isolated communication pathway.BRIEF DESCRIPTION OF THE DRAWINGS

[0006] The detailed description is set forth with reference to the accompanying figures. In the figures, the left-most digit(s) of a reference number identifies the figure in which the reference2 Attorney Docket No. K122-0005PCTnumber first appears. The use of the same reference numbers in different figures indicates similar or identical items or features.

[0007] FIG. 1 is an example system for capability-restricted system capable of performing dynamic updates, in accordance with some examples of the present disclosure.

[0008] FIG. 2 illustrates an example of how a client shares capabilities with a server, in accordance with some examples of the present disclosure.

[0009] FIG. 3 is an illustration showing a message being transmitted from the client through the message server and to the server, in accordance with some examples of the present disclosure.

[0010] FIG. 4 is a computing platform showing the use of predesignated memory locations for nodes of applications, in accordance with some examples of the present disclosure.

[0011] FIG. 5 is a module diagram of a system showing the process of creating applications and the ability for those applications to communicate with each other, in accordance with some examples of the present disclosure.

[0012] FIG. 6 is an example manifest configuration showing a nested manifest, in accordance with some examples of the present disclosure.

[0013] FIG. 7 depicts a component level view of the system 400 for use with the systems and methods described herein, in accordance with some examples of the present disclosure.

[0014] FIG. 8 is an illustrative process 800 for communicating from a client to a server in a capability-restricted system, in accordance with some examples of the present disclosure.

[0015] FIG. 9 is an illustrative process 900 for communicating from a client to a server in a capability-restricted system, in accordance with some examples of the present disclosure.

[0016] FIG. 10 is an illustration showing the use of application isolation and verified flows to provide dynamic updates, in accordance with some examples of the present disclosure.

[0017] FIGS. 11-13 illustrate the implementation of application isolation and verified flows with manifest updates to provide dynamic updates to a system, in accordance with some examples of the present disclosure.DETAILED DESCRIPTION

[0018] Wherever possible, the same reference numbers will be used throughout the drawings to refer to the same or like parts. FIG. 1 is an example system 100 for capability-restricted system capable of performing dynamic updates, in accordance with some examples of the present3 Attorney Docket No. K122-0005PCTdisclosure. Aspects of the presently disclosed subject matter are described in more detail in U.S. Patent Application 17 / 814,758 fded on July 25, 2022, and is incorporated herein as if fully set forth herein. As used herein, an “entity” can be a program, module, client, hardware, software, firmware, or combinations thereof. Further, as used herein, a “requesting entity” requests some form of information or data and a “responding entity” provides some form of information or data in response to a request from a requesting entity. As used herein, a “capability” is a permission to access an entity or object in a system.

[0019] Security and operational issues often arise in systems when control of entities is taken over improperly or if a default of an entity affects that entity or other entities. In conventional systems, attacks on system capabilities can occur by using “backdoors” that can be vulnerable entry points to a system. Some of these backdoor attacks include the use of spyware, ransomware, and distributed denial of service (DDoS) attack. Because responding entities in conventional systems have their own capabilities assigned regardless of the presence of a request from a requesting entity, a malicious program or fault can use those capabilities to propagate and expand an attack on the system beyond the entry point of the attack. In the same way, a faulting entity may cause errors in other entities, resulting in a potential chain reaction and expansion of the default, potentially culminating in the complete takeover of the system or a shutdown of the system.

[0020] In a different manner, the system 100 of FIG. 1 uses a capability-restricted system control scheme. Illustrated in FIG. 1 is client 102, as well as server 104A and server 104B. Client 102 is a requesting entity in FIG. 1, whereas servers 104A and 104B are responding entities. However, it should be understood that the designation of a “requesting entity” or “responding entity” may be temporary, as a responding entity itself may become a requesting entity, and a requesting entity may become a responding entity. For example, if client 102 transmits a request to server 104 A, server 104 A may determine that the request requires at least some capabilities of server 104B, and therefore, may become a requesting entity to request capabilities of server 104B.

[0021] In FIG. 1, client 102 has client capabilities 106. Client capabilities 106 are assigned to the client 102 upon the instantiation of the client 102. Client capabilities 106 can include untyped memory assigned to the client 102 upon the instantiation of the client 102. As used herein, “untyped memory” is a block of contiguous physical memory with a specific size. As used herein, “contiguous” is used to denote memory blocks that are in well-known memory positions and donot move to other memory positions. Contiguous memory blocks may have sequential or nonsequential memory addresses, the presently disclosed subject matter is not limited to either configuration. Untyped capabilities are capabilities to untyped memory. Untyped memory can be retyped into kernel objects together with capabilities to them, or into further, usually smaller, untyped memory. In some examples, all of the capabilities of the client capabilities 106 is termed the “capability space.” If partitioned, capabilities can be associated as a capability node, which is an array of capabilities. These capabilities can be listed in a table, sometimes referred to herein as a “capability table.” These and other specific aspects of capabilities are explained in more detail in FIG. 2 and the following figures.

[0022] Returning to FIG. 1, a message server 108 coordinates communication between client 102 on client side 110 and servers 104A and 104B on server side 112. The client side 110 and the server side 112 are not logical or functional partitions within the message server 108, but rather, are used to illustrate that the message server 108 handles message requests in a manner that essentially splits the message server 108 into a part that services the clients on the client side 110 and the servers on the server side 112. To explain in more detail, an example communication process is described. In this example, client 102 is a computing process that requires data from the server 104A on a periodic or asynchronous basis. The data provided by the server 104A can be used by the client 102 for various reasons, the specifics of which are not limiting to the presently disclosed subject matter.

[0023] In conventional systems, the client 102 transmits a message 116 to the message server 108. The message server 108 in turn transmits the message to the server 104A. However, as noted above, the system 100 uses capability-restrictions to effectuate one or more security and / or system stability protocols. As explained in more detail in FIG. 3, the client 102 may be assigned a token 128 that authorizes the client 102 to communicate with the server 104A and / or 104B. Therefore, in the present example using the system 100, the client 102 determines that the client 102 requires data 114 from the server 104A. Therefore, in order to cause the server 104A to provide the data 114, the client 102 has to allocate some or all of the client capabilities 106 in order to cause the message server 108 to deliver the request for the data 114. Thus, in system 100, the client 102 assigns assigned client capabilities 118 to the message server 108. The message server 108 access a communication authorization table 120 to determine if the client 102 has been authorized by the system 100 to communicate with the server 104 A.L©c &. Hoyos’ 5 Attorney Docket No. K122-0005PCT

[0024] If the client 102 is authorized to communicate with the server 104 A, the message server 108 assigns the assigned client capabilities 118 to the server 104A. During the time that the assigned client capabilities 118 exist, e.g., during a request, the client 102 does not have the use of the assigned client capabilities 118. The assigned client capabilities 118 are still technically part of the client capabilities 106, but use of the assigned client capabilities 118 first transfers to the message server 108 and thereafter to the server 104A. Thus, while the assigned client capabilities 118 exist, the client 102 must wait until the assigned client capabilities 118 are reassigned to the client 102 or otherwise come back to the use of the client 102, e.g., a fault occurs, etc.

[0025] The removal of the assigned client capabilities 118 for use by the client 102 reduces or eliminates the potential for an attack. For example, an attacking module 122 may be a set of code that is designed to try to use the client 102 in a manner that destabilizes the system 100. If the client 102 has assigned the client capabilities 106 to the server 104A by the assigned client capabilities 118, any attack by the attacking module 122 will have to wait until the assigned client capabilities 118 returns to the use of the client 102 as its client capabilities 106. As noted above, the message server 108 does not transmit communications or requests to servers 104A and / or 104B unless the message server 108 receives the assigned client capabilities 118. Further, the extent of any attack is limited to the client capabilities 106, as the client 102 is limited in its requests to the client capabilities 106, Additionally, even if the attacking module 122 were to attack at a time that the client 102 had full access and use to the client capabilities 106, the message server 108 will still only transmit a communication that is authorized under the communication authorization table 120. Thus, in the system 100, attacks by malicious code, such as the attacking module 122, are limited in scope, time, and impact.

[0026] Returning to the prior example, once the server 104A has received the assigned client capabilities 118 from the message server 108, the server 104A can use those assigned client capabilities 118 to perform various functions, such as a reading of a sensor to determine the data 114. Unless the server 104A has the assigned client capabilities 118, the server 104A will not perform functions in response to a client request, such as the message 116. Thus, if rather than attacking the client 102, the attacking module 122 attacks the server 104A, if the server 104A does not have any client capabilities assigned to it, such as the assigned client capabilities, 118, the server 104 will remain idle and not process requests from the attacking module 122. As the server 104A can only respond if the server 104A has assigned client capabilities 118, can only act to theextent of capabilities in the assigned client capabilities 1 18, and only while the assigned client capabilities 118 are assigned to the server 104A. Thus, if attacks are attempted directly on the server 104 A, the attacks are limited in scope, time, and impact.

[0027] As noted above, the server 104A may act as both a responding entity and a requesting entity, in some examples. In the example in FIG. 1, the server 104A has received the assigned client capabilities 118 from the message server 108 in response to the message 116 from the client 102. However, in this example, the server 104A may need data 124 in order to generate the data 114 in response to the message 116. Thus, the server 104A contacts the message server 108 through message 126 and transfers some or all of the assigned client capabilities 118 to the message server 108. The message server 108 accesses a communication authorization table 120 to determine if the server 104A is authorized to make requests to the server 104B. If the message server 108 using the communication authorization table 120 determines that the server 104A is authorized to make requests to the server 104B, the message server 108 assigns the assigned client capabilities 118 assigned from the server 104A to the server 104B. The server 104B processes the message 126 and generates the data 124. The data 124 is provided to the server 104A, which in turns provides the data 114 to the client 102 through the message server 108. As noted above, the system 100 of FIG. 1 is designed to limit the ability of applications, such as the client 102, to use more capabilities than that which are assigned to it, illustrated in more detail in FIG. 2, below.

[0028] FIG. 2 illustrates an example of how the client 102 shares capabilities with the server 104A, in accordance with various aspects of the presently disclosed subject matter. In FIG. 2, the client capabilities 106 are illustrated as a node 202. The node 202 includes a block of contiguous memory in a system, illustrated as blocks in the node 202, such as memory block 204, memory block 206, and memory block 208. In FIG. 2, a message server, such as the message server 108 of FIG. 1, is not illustrated for the purposes of simplicity, but will be explained in more detail in FIG. 3, below. In FIG. 2, the node 202 is a block of untyped memory, whereby the client 102 can use the node 202. The client 102 can use blocks of the untyped memory in the node 202 to instantiate resources such as threads, pages, other nodes, and the like. For example, the client 102 can instantiate a node 210 using the memory block 208.

[0029] To facilitate communication between the client 102 and the server 104 A, the client 102 assigns use of the memory block 206 to a memory block 212 of a node 214 of the server 104A. When the client 102 assigns the use of the memory block 206 to the server 104A, the client 102maintains “ownership” of the memory block 206. Meaning, the memory block 206 is still part of the node 202 of the client 102. However, the use of the memory block 206 is now with the server 104A. Once the client 102 assigns use of the memory block 206 to the server 104 A, the client 102 is not able to access the contents of the memory block 206. It should be noted that the client 102 can assign multiple memory blocks rather than just one, as the singular memory block 206 is merely for purposes of illustration.

[0030] After being assigned use of the memory block 206 of the node 202 by the client 102A, the server 104A has use of the memory block 206 to instantiate various capabilities in order for the server 104 A to perform the request(s) that the client 102 may send through the message 116. Thus, after receiving the use of the memory block 206, the server 104A instantiates capabilities 216, 218, and 220 into the memory block 206. As discussed before, the client 102 maintains ownership of the memory block 206 but does not the ability to access what the server 104A instantiates using the memory block 206. The server 104A can use the memory block 206 to instantiate a thread, scheduling time, pagers of memory for use by the server 104 A, and the like. In sum, the server 104A uses the memory block, 206 to instantiate the capabilities the server 104 A needs to perform actions required by the client 102.

[0031] Along with the capabilities instantiated in the memory block 206, the server 104A also instantiates a shared memory block 222. The shared memory block 222 is the manner in which the server 104A communicates with the client 102. The server 104A, when processing the message 116, uses the shared memory block 222 by writing information to the shared memory block 222. The client 102 and the server 104A share the information in the shared memory block 222, though only the server 104A may write information into the shared memory block 222. It should be noted that the shared memory block 222 is part of the memory block 206, and thus, while the server 104A has control over what information is placed in the shared memory block 222, the actual ownership of the shared memory block 222 resides with the client 102.

[0032] While FIG. 2 illustrates the general technology of client / server communication, FIG. 3 is an illustration showing the message 116 being transmitted from the client 102 through the message server 108 and to the server 104 A, and the return of the data 114 relating to that message 116. In FIG. 3, illustrated are the node 202, assigned to the client 102, and the node 214, assigned to the server 104A. Further illustrated is the node 302 assigned to the message server 108. As with the node 202 and the node 214, the node 302 is a contiguous block of untyped memoryassigned to a specific application, in this instance, the node 302 being assigned to the message server 108 in the manner that the node 202 is assigned to the client 102 and the node 214 is assigned to the server 104A. The nodes 202, 214, 302, 304, and 306 are each assigned contiguous blocks of untyped memory by an application manager (not illustrated), explained in more detail in FIG. 6, below.

[0033] Returning to FIG. 3, the shared nodes 304 and 306 are nodes used to facilitate the communication between the client 102 and the message server 108, and between the message server 108 and the server 104A. In this example, the client 102 does not communicate directly with the server 104A (as was illustrated by way of example in FIG. 2). In the configuration of FIG. 3, the message server 108 acts as a broker or interface between the client 102 and the server 104A. The message server 108 acts as a broker through the use of threads, endpoints, and tokens. As used herein, a “thread” is an execution context that manages processor time. As used herein, an “endpoint” is a kernel object that acts as a communication port, whereby invocations on endpoint (objects) are used to send and receive messages. As used herein, a “token” may include various objects, including a thread or string. In some examples, a token is an integer and is assigned by the message server 108, although other variations such as assignment using a manifest may be used and are considered to be within the scope of the presently disclosed subject matter.

[0034] In FIG. 3, the node 202 has a thread 312 operating within the client 102. The node 302 has a thread 314 operating within the message server 108. The node 214 has a thread 316 operating within the server 104A. The threads 312-314, when executed, indicate that the particular object (the client 102, the message server 108, and / or the server 104A) are executing (i.e. using processor time). The threads are initiated or blocked using endpoints 318 and 320, as provided in the following example. In the present example, the client 102 creates the message 116 intended for the server 104A to act upon. The message 116 can be any type of message, such as a request for data, status, a status change, and the like. For example, the client 102 can be a flight controller of a drone, and the server 104A is a positional sensor. The client 102 may want an update as to the position of the drone, and therefore, the message 116 in this example can be a request for a position. As stated above, however, the message 116 can be of various types, of which the presently disclosed subject matter is not limited to any particular type.

[0035] Returning to the prior example, at the time of the generation of the message 116, the thread 312 is executing, while the thread 314 and the thread 316 are blocked. As used herein, ablocked thread means a particular entity is not using processor time for a particular function. However, some processor time may be used to maintain the instantiation of the entity. The client 102 transmits the message 116 to the message server 108 through the endpoint 318 and copying the message 116 into the shared memory 308. The contact through the endpoint 318 unblocks the thread 314 of the message server 108 and blocks the thread 312 of the client 102. Therefore, at this point in the process, the client 102 and the server 104A are at “rest” or are in standby, whereas the message server 108, because the thread 314 is now unblocked, is now executing. The message server 108 receives the message 116 and proceeds to verify the authority of the client 102 to send the message 116 to the server 104A. Instantiation may be executed by various entities, including through a manifest. The presently disclosed subject matter is not limited to any particular entity from which an instantiation operation is executed.

[0036] The message server 108 verifies the authority of the client 102 to send the message 116 to the server 104A by using a token table 322. It should be noted that in some examples, the message server 108 may not very the authority of the client 102, or in other examples, may verify the authority of the client 102 using other technologies. The token table 322 is merely an example. As illustrated in FIG. 3, the message 116 includes a token 324. The token 324 is a piece of data that is gives permission to make message calls as well as indicates other limitations or permissions. For example, the server 104A may have given the client 102 permission to communicate with it and set limitations on message size, the type of requests, frequency of requests, and the like. The permissions and limitations are established and set forth in a token issued by the server 104A. It should be noted, however, that the tokens in the token table 322 may be generated by other entities than the server 104A. The token 324 is saved in the token table 322.

[0037] When transmitting messages to the server 104A, the client 102 includes the token 324. The message server 108 receives the message 116 with the token 324. The message server 108 checks the token 324 and the message 116 using the token table 322 and verifies that the client 102 is authorized to communicate with the server 104A and that the message 116 is in a format (i.e. size, type, etc.) expected by the server 104A. If the message server 108 determines that the message 116 is in compliance with the token 324, the message server 108 copies the message 116 from the shared memory 308 to the shared memory 310 and sends a notice through the endpoint 320 that the message 116 is in the shared memory 310. The message server 108 also as part of the notice sends the token 326. The token 326 is used to indicate to the message server 108 that theresponse from the server 104A is in response to an action by the message server 108 and not some other process. Sending the notice through the endpoint 320 starts the thread 316 of the server 104A and stops the thread 314 on the message server 108. Therefore, at this point in the process, the threads 312 and 314 are stopped, meaning the client 102 and the message server 108 are in standby or are idle.

[0038] After receiving the notice from the message server 108, the server 104A acts on the message 116 and generates the data 114. The server 104A copies the data 114 to the shared memory 310 and transmits a response to the message server 108 through the endpoint 320. This causes the thread 316 to stop, placing the server 104A back into an idle or standby state. The thread 314 of the message server 108 is started by the communication to the endpoint 320. The message server 108 receives the data 114, which includes the token 326 issued by the message server 108 in the prior communication from the message server 108 to the server 104A. The message server 108 verifies the token 326 and the data 114 using the token table 322. Upon a verification, the message server 108 copies the data 114 from the shared memory 310 to the shared memory 308 and includes the token 324. The message server 108 sends a notice to the client 102 that the data 114 is in the shared memory 308 through the endpoint 318. Using the endpoint 318 causes the thread 314 to stop and the thread 312 to start. This places the message server 108 into an idle or standby state and the client 102 into an active state.

[0039] In some examples, the modules, operations, and the like described in FIG. 3 may be executed on different computers, processors or cores. For example, the message server 108 may communicate with a second message server (not illustrated) in a second computer, processor, or core, whereby the second message server communicates with the node 214.

[0040] As discussed above, the client 102 acts in a capability-restricted manner. Thus, several of the capabilities used by the message server 108 and the server 104A are from the node 202 of the client 102, as explained in FIG. 2. For example, if node 202 is taken down or otherwise placed out of service, the shared nodes 304 and 306, as well as the shared memory 308 and 310, may also be taken down, as they are capabilities that exist within the node 202 and are “loaned” for use by the message server 108 and the server 104A. However, in order to facilitate the use of untyped memory by the client 102 as the source of capabilities of other entities in a system, it can be important to ensure that the contiguous block of memory assigned to the client 102, i.e. the node 202, is known and certain to an operating system executing the various functions. In one example,predesignated memory locations for specific applications (such as clients, servers, etc.) are used, as explained in more detail in FIG. 4.

[0041] FIG. 4 is a system 400 showing the use of predesignated memory locations for nodes of applications. The computing system 400 of FIG. 4 includes hardware 402, a micro kernel 404, user applications 406, and an operating system core 408. The hardware 402 includes, but is not limited to or must include, a motherboard, central processing unit (CPU), memory, and an input / output interface. The system 400 includes the micro kernel 404. In some examples, the micro kernel 404 is a portion or modular part of an operating system kernel that implements basic features. In some examples of the micro kernel 404, the user services and kernel services are implemented in different address spaces. The user services are kept in user address space, and kernel services are kept under kernel address space.

[0042] As noted above with respect to FIG. 3, memory allocated to the applications, such as the client 102, the server 104A, and the message server 108, are mapped to specific locations of contiguous memory in the hardware 402, illustrated by arrows from the mapped location in the hardware 402 to respective applications. Shown in FIG. 4 are application 1 controller 410 and application 2 data aggregator 412, exposed for use in the user apps 406 space of the system 400. Further illustrated in the OS core 408 are communication 414 and drivers 416. In the hardware 402, the application 1 controller 410, the application 2 data aggregator 412, the communication 414, and the drivers 416 are illustrated with solid line borders. This is to illustrate that each of the aforementioned applications are assigned a single, contiguous block of untyped memory. No other application uses the same region of contiguous memory of the hardware 402 assigned to the application unless the hardware 402 or the system 400 in general is rebuilt, in some examples.

[0043] The assignment of contiguous blocks of memory to specific applications, without overlap or change, provides various advantages. For example, if the application 2 data aggregator 412 faults or is taken offline, the entire memory space of the application 2 data aggregator 412 can be overwritten and cleaned out, and reloaded with a new instantiation of the application 2 data aggregator 412 with little to no concern that the memory wipe will cause further issues. The damage or effect of a fault, attack, or failure of the application 2 data aggregator 412 is limited to the memory space in the hardware 402.

[0044] In another example, an application can be updated without taking the entire system 400 offline. For example, if a new version of the application 1 controller 410 is ready to be loaded, thesystem 400 takes application 1 controller 410 offline, clears the memory location of the application 1 controller 410 in the hardware, and then rewrites to that previously assigned, contiguous block of memory the new version of the application 1 controller 410. The application 1 controller 410 is reinitiated and continues to operate.

[0045] A still further example of an advantage of using specific, assigned contiguous blocks of memory for specific applications is that doing so keeps a system optimized and defragmented. As noted above with respect to FIGS. 1 and 2, when an application, such as the client 102, desires for a server, such as the server 104 A, to perform an operation on behalf of the client 102, the client 102 must assign some of its assigned memory to the message server 108 and the server 104A. Otherwise, the message server 108 and the server 104A will not perform any action. When the application stops, faults, or otherwise ceases to operate, requiring a restart of the application, the contiguous memory assigned to the application is cleared (or wiped). However, because the application would have needed to assign memory to cause other entities to operate on its behalf, those pointers from the application’s node (or memory space) are also deleted. Thus, when an application’s memory space is cleared, this also clears points from its memory space that may be used or in use by other entities. Thus, there are no memory spaces after the clearing that are fragmented or left without an application being assigned to it.

[0046] There are various technologies that may be used to generate known, assigned, and contiguous blocks of memory in the hardware 402 that are maintained and persisted throughout the operation of the system 400. One technology is to use a proven kernel or operating system. In some examples, a “proven” kernel is a kernel that has been mathematically verified as being correct against its specification, has been proved to enforce strong security properties, and if configured correctly its operations have proven safe upper bounds on their worst-case execution times. There are various levels of proof. In the current example, the micro kernel 404 is proven against its specification. This means that, during operations, the system 400 knows that the contiguous, assigned memory locations of each application will remain with each application and will not be broken up or assigned to another application.

[0047] In some examples, the user apps 406 level is untrusted. As used herein, “untrusted” means that applications running in the user apps 406 application levels only have limited, if any, access to core resources. As noted above, for example, the application 1 controller 410 has access to, at most, the memory allocated to the application 1 controller 410. In another example,applications running in the OS core 408 level are trusted, but isolated. As used herein, “trusted” means that the application has more access to resources than the untrusted application, but its reach of resources is isolated and only extends within a space assigned to it. As noted above, the micro kernel 404 is trusted. In the system 400, the message server 108 is the communication 414 module. Various capabilities may be enforced by the micro kernel 404 but are managed by the message server 108. Thus, while the message server 108 has access to capabilities, the capabilities are only managed by the message server 108, but not enforced. The creation of these capabilities and permissions are described in more detail in FIG. 5.

[0048] FIG. 5 is a module diagram of a system 500 showing the process of creating applications and the ability for those applications to communicate with each other. In FIGS. 1 and 2, it was discussed that applications (such as the client 102 and the server 104A) are assigned specific blocks of untyped memory space. FIG. 5 shows that process and others. In FIG. 5, when a machine, such as the system 400 of FIG. 4 is booted, a kernel 502 is instantiated and creates a root server 504. The kernel 502 can be part of the micro kernel 404 of FIG. 4 or may be another part of a kernel loaded into the hardware 402. The root server 504 has assigned to it all the capabilities that the system 500 will have, including all the untyped memory, endpoints, and the like. All spaces or nodes, assigned blocks of contiguous memory, pages of memory, and the like are assigned to the root server 504.

[0049] There are two main functions that are provided by the system 500: application instantiation and messaging between those applications. To provide for the instantiation and control of applications, the root server 504 creates an application manager 506. The application manager 506 is the primary resource of the system 500 used to establish and control applications. The root server 504 assigns a specific portion of its untyped memory as storage 505 to the application manager 506. In some examples, because the primary function of the root server to instantiate the application manager 506, the root server 504 assigned most of its untyped memory to the application manager 506. Once the application manager 506 is instantiated and assigned the capabilities by the root server 504, the application manager 506 commences setting up the system 500 to provide for applications. To instruct the application manager 506 on what to instantiate, the application manager 506 reads a manifest 508. The manifest 508 is a set of instructions that inform the application manager 506 of what to create, what capabilities are to be assigned to an entity when created, and the like. The manifest 508 is essentially the roadmap to create thefunctioning and operational version of the system 500. It should be noted that although the manifest 508 is shown as part of the application manager 506, like other modules described herein, the manifest 508 may be part of other systems, including part of the root server 504. The manifest 508 may include definitions of hardware and software used in the system 500. Various aspects of the manifest 508 are described in more detail in FIG. 6, below.

[0050] Returning to FIG. 5, in compliance with the manifest 508, the application manager 506 has instantiated application 510 and application 512. For example, the application 510 can be the client 102 of FIG. 1 and the application 512 can be the server 104A of FIG. 1. It should be noted that the manifest 508 may provide for fewer or more applications than the example applications 510 and 512 illustrated in FIG. 5. To provide for the capabilities of the applications 510 and 512, the storage 505 is partitioned to provide for contiguous blocks of the storage 505. In FIG. 5, untyped (UT) memory 514 is assigned to application 510, UT memory 516 is assigned to the application 512, and the UT memory 518 is assigned to an ethemet function 520.

[0051] As noted above, the other primary function of the system 500, along with use of applications, is the control of the communication between those application. Thus, when instantiating the application manager 506, the root server 504 also instantiates the message server 522. As described above, the message server facilitates communications between various applications, such as the client 102 and server 104A of FIG. 1. To facilitate that communication, applications have to make available for use part of their untyped memory. The application manager 506 requires resources from other entities in order to facilitate messages. For example, if in FIG. 5, the application 510 is the client 102 and the application 512 is the server 104A, to create the message chain of FIG. 3, the application 510 assigns the use of a portion 524 of the UT 514 of the application 510 to the message server 522. A pointer 526 is generated by the application 510 to node 528 of the message server 522. Thus, the message server 522 has access to use the portion 524. While use of the portion 524 is provided to the message server 522, the application 510 maintains the assignment of the portion 524, but cannot access or view what is written into the portion 524 by the message server 522. As shown in FIGS. 2 and 3, this portion 524 is used also by the server 104A. Thus, actions performed on behalf of the application 510 are permitted to the extent that the application 510 assigns the use of the resources needed to accomplish those tasks to the responding entities.

[0052] In FIG. 5, the root server 504 has also instantiated a manifest manager 530 and a scheduler 532. The manifest manager 530 is used by the root server 504 to update manifests, explained in more detail in FIG. 6, below. The scheduler 532 assists the application manager 506 in scheduling operations performed by various applications. As is understood, processor time, i.e. time taken by a processor to execute a thread and return a result, is a non-fungible resource. Even with multiple cores, a central processing unit only has a finite amount of time available to process threads. To facilitate the execution of threads, threads assigned to a particular application, such as the applications 510 and 512, are given a budget and / or priority by the manifest 508. For example, a thread of the application 510 may have more budget (i.e. processor time), but a thread of the application 512 may have a higher priority. Thus, the scheduler 532 may cause the thread of the application 512 to be executed first by a processor. Further, the manifest 508 may assign a particular core of the processor to which a thread is executed. For example, the thread of the application 510 may be a core 0 application, whereas the thread of the application 512 may be a core 1 application. Using the scheduler 532 in this manner increases the probability that a thread of any application will only be executed if the scheduler 532 imitates the thread. Further, because the manifest 508 has provided the time budget and priority for the various threads, the scheduler can increase the probability that the processor time is used in accordance with the manifest 508 and only as assigned to the applications 510 and 512.

[0053] The use of the scheduler 532 increases the stability of the system 500. However, the restriction of capabilities as discussed above can also increase the stability of the system. For example, the application 510 is the client 102 and the application 512 is the server 104A. In this example, when the application 510 stops, faults, or otherwise fails, a fault handler 534 receives a message from the application manager 506 that the application 510 has stopped or failed. The fault handler 534 is a thread of the application manager 506 and receives that message on an endpoint 536 assigned to the fault handler 534. The manner in which the application manager 506 handles the fault can be determined by the manifest 508. The manifest 508 may have instructions to the application manager 506 to use other untyped memory in the storage 505 to try to restart the application 510. The manifest 508 may have instructions to the application manager 506 to allow any applications handling requests by the application 510 to continue (as those responding entities are using the portion 524 that would otherwise be revoked).

[0054] If there are no fault instructions, or the fault instructions included in the manifest 508 state that the application manager 506 is to revoke the UT 514 if a fault occurs, the UT 514, including the portion 524, are erased, taking the application 510 and all of the capabilities the application 510 assigned to the application 512 and the message server 522 node 528 back to the application manager 506. The erasure may occur using various technologies, including but not limited to random data or memory zeroing. An erasing operation may also include a verification step whereby the erasing operation is verified and / or the UT 514 is verified. The contiguous memory block (UT 514) assigned to the application 510 is still assigned to the application 510. The application manager 506 receives word from the root server 504 through the fault handler 534 that the application 510 is to be restarted. The application manager 506 restarts the application 510 with the same UT 514 that the application 510 had before the application 510 stopped or faulted.

[0055] During this process, the application 512 continues to operate, essentially unaware that the application 510 stopped or faulted. Once the application manager 506 restarts the application 510 according to the manifest 508, the application manager 506 reestablishes communication connections between the application 510 and the message server 522 by assigning the use of the portion 524 to the message server 522 node 528. The message server 522 thereafter reestablishes, if lost, communications with the application 512. The storage 505 and the ethernet function 520 did not restart and were unaffected by the failure and restart of the application 510. This process can also occur system wide. For example, if a central application like the application manager 506 stops or faults, the fault handler 534 can signal that to the root server 504. The root server 504 can clear out the storage 505, essentially erasing the current instantiation of the application manager 506 and all applications instantiated by the application manager 506, and thereafter restart the application manager 506 using the manifest 508.

[0056] A similar process to how the system 500 handles an application failure can be used to update an application, maintaining the stability of the system 500. In some conventional systems, when applications are instantiated, applications are instantiated in a dependent construct, meaning, that one application builds upon the other, which in turn builds upon another application. Thus, if one application in the chain is taken down, all the other applications after the application that is taken down often must be taken down as well, as their operability depends on the operability (e.g. memory location) of the preceding applications.

[0057] However, the system 500 of FIG. 5 is not a dependent construct. Rather, because each application is assigned a known, contiguous block of the storage 505, each application can be instantiated, stopped, and updated without effecting to a great degree other applications. The manner in which this is done is the use of the manifest 508. If a new version of the application 510 is determined to be needed or desired, a new manifest, manifest 538, is downloaded into the application manager 506. The application manager 506 analyzes the manifest 538 and determines that new code or an update is required for the application 510. The application manager 506 revokes (or clears) the UT 514 to the application 510. The application manager 506 loads the new code into the UT 514, restarts the application 510 using the new code, and reestablishes connections.

[0058] In another example, the new manifest 538 may be downloaded, but instead of taking down the application 510 to update the application 510, the manifest may instruct that a new application 510, application 510A, is to be used instead of the application 510. Thus, the manifest 538 may instruct the application manager to assign a new UT, the UT 518, to the application 510A and download the new code into that new UT 518. Once downloaded, the application 510 is brought offline and the application 510A is instantiated. The new application 510A assigns the use of portion 540 of the UT 518 to the message server 522 node 528 using pointer 543. The old application 510 UT 514 is erased, ready to be used by a new application.

[0059] In some examples, the manifest 508 can provide instructions to instantiate a capabilities server 542. In some examples, the capabilities server 542 is used to control and / or assign capabilities to one or more processors or operations in the system 500. For example, the capabilities server 542 can assign capabilities to the application 510, the application 512, and / or the message server 522. Further, it should be understood that various operations of the system 500 may be located on a single computer or across multiple computers, processors, or processor cores. For example, in some examples, the application 510 and the message server 522 may be instantiated and executed by one computer, core, or processor, and the application 512 may be instantiated and executed by a second computer, second core, or second processor.

[0060] From the discussed provided above, a manifest, such as the manifest 508 and the manifest 538, can play several roles within the system 500. The manifest 508 can inform the application manager 506 which applications to instantiate and the storage 505 assigned to each. The manifest 508 can inform the application manager 506 which applications can communicatewith each other, creating the token table 322 of FIG. 3 or the communication authorization table 120 of FIG. 1. Manifests, however, can be of various types and configurations, as described in more detail in FIG. 6.

[0061] FIG. 6 is an example manifest configuration showing a nested manifest 600. The nested manifest 600, which may be stored in various locations in the storage of a computer, includes several manifests nested within the manifest 600. As used herein, “nested” means a part of a greater whole. For example, a system manifest 602 is nested within the manifest 600. The system manifest 602 can include instructions on how to turn on a computer, manage power, and the like. A business logic application manifest 604 may include instructions on which drivers to load into a machine, such as the drivers 416, and instructions on how to startup the message server 522. These applications are typically applications that are trusted but not verified. The manifest 600 further includes an application manager manifest 604, such as the manifest 508 of FIG. 5. In some examples, further manifests may be nested in other manifests that are nested themselves. For example, nested within the application manager manifest 604 are type 1 application manifest 606 and type 2 application manifest 608. These manifests 606 and 608 can be specific to certain types of applications, such as applications that may get updated on a regular basis reducing the need to update a larger manifest every time the applications need to be updated. A reason for using nested manifests may be the ability to create manifests for hardware (i.e. chips) and board support packagers. Thereafter, a third party can design manifests for applications using those known drivers, allowing a third party to only assign applications to the drivers.

[0062] Manifests, such as the manifest 600 of FIG. 6, are often signed cryptographically. In that manner, if cryptographically signed, the manifest 600 can be used to describe a computer running the manifest. The manifest 600 is the known configuration of the computer, which means a user can reason about the entire system layout. The manifest 600 gives information about the computer. Therefore, at all times, if the manifest 600 is known and signed, a computer can be described accurately. There is not entropy of the system (i.e. a continual randomization of system resources), and reducing or eliminating “bit rot,” which is the slow deterioration in the performance and integrity of data stored on storage media. As used herein, a “signature” is a code, token, key, certificate or other object that is used to verify at least an aspect of software, such as the author.L©c &. Hctyss' 19 Attorney Docket No. K122-0005PCT

[0063] The known aspect of the manifest 600 can be used when updating applications or making changes to a computer. A new manifest, such as the manifest 538, can be hashed along with all the other manifests into which the manifest 538 is nested. Once loaded into the system 500 and all updates are made, the manifest 538 that is onboard or loaded into the application manager 506 can be hashed against the hash of the manifest 538 prior to the loading to verify that the new manifest 538 matches the desired manifest 538 prior to loading. Further, hashing one or more of the manifests 600 can provide information as to the version the system 500 is operating, as each version of the manifest 600 will have a unique hash. Additionally, in the manifest 538, applications may also be downloaded with their own hashes as part of the manifest, thereby allowing applications to be verified.

[0064] FIG. 7 depicts a component level view of the system 400 for use with the systems and methods described herein. The system 400 could be any device capable of communicating using a network. The system 400 can comprise several components to execute the above-mentioned functions. As discussed below, the system 400 can comprise memory 702 including an operating system (OS) 704 and one or more standard applications 706. The standard applications 706 can include many features common to user equipment such as, for example, applications initiated using voice commands (such as Internet searches, home appliance controls, and the like), music player, Internet radio, and other such applications. The standard applications 706 can include core applications such as the kernel 502 and the root server 504, among others. The system 400 can also comprise the application manager 506, the manifest manager 530, and the scheduler 532.

[0065] The system 400 can also comprise one or more processors 710 having one or more cores and one or more of removable storage 712, non-removable storage 714, transceiver(s) 716, output device(s) 718, and input device(s) 720. The system 400 can also include one or more cores from the one or more processors 710, whereby in some examples, the one or more processors 710 can be installed on different computer systems. In various implementations, the memory 702 can be volatile (such as random access memory (RAM)), non-volatile (such as read only memory (ROM), flash memory, etc.), or some combination of the two. The applications 510 and 512 can have assigned, contiguous blocks of the non-removable storage 714, the removable storage 712, and / or the memory 702. The memory 702 can also include the OS 704. The OS 704 varies depending on the manufacturer of the system 400. The OS 704 contains the modules and softwarethat support basic functions of the system 400, such as scheduling tasks, executing applications, and controlling peripherals.

[0066] In some implementations, the processor(s) 710 can be one or more central processing units (CPUs), graphics processing units (GPUs), both CPU and GPU, or any other processing unit. The system 400 may also include additional data storage devices (removable and / or nonremovable) such as, for example, magnetic disks, optical disks, or tape. Such additional storage is illustrated in FIG. 7 by removable storage 712 and non-removable storage 714.

[0067] Non-transitory computer-readable media may include volatile and nonvolatile, removable and non-removable tangible, physical media implemented in technology for storage of information, such as computer readable instructions, data structures, program modules, or other data. The memory 702, removable storage 712, and non-removable storage 714 are all examples of non-transitory computer-readable media. Non-transitory computer-readable media include, but are not limited to, RAM, ROM, electronically erasable programmable ROM (EEPROM), flash memory or other memory technology, compact disc ROM (CD-ROM), digital versatile discs (DVD) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other tangible, physical medium which can be used to store the desired information and which can be accessed by the system 400. Any such non-transitory computer-readable media may be part of the system 400 or may be a separate database, databank, remote server, or cloud-based server.

[0068] In some implementations, the transceiver(s) 716 include any transceivers known in the art. In some examples, the transceiver(s) 716 can include wireless modem(s) to facilitate wireless connectivity with other components (e.g., between the system 400 and a wireless modem that is a gateway to the Internet), the Internet, and / or an intranet. The transceiver(s) 716 can enable the system 400 to connect to multiple networks including, but not limited to 2G, 3G, 4G, 5G, and WiFi networks. The transceiver(s) can also include one or more transceivers to enable the system 400 to connect to future (e.g., 6G) networks, Intemet-of-Things (loT), machine-to machine (M2M), and other current and future networks.

[0069] The transceiver(s) 716 may also include one or more radio transceivers that perform the function of transmitting and receiving radio frequency communications via an antenna (e.g., Wi-Fi or Bluetooth®). In other examples, the transceiver s) 716 may include wired communication components, such as a wired modem or Ethernet port, for communicating via one or more wirednetworks. The transceiver(s) 716 can enable the system 400 to make audio and video calls, download fdes, access web applications, and provide other communications associated with the systems and methods, described above.

[0070] In some implementations, the output device(s) 718 include any output devices known in the art, such as a display (e.g., a liquid crystal or thin-fdm transistor (TFT) display), a touchscreen, speakers, a vibrating mechanism, or a tactile feedback mechanism. Thus, the output device(s) can include a screen or display. The output device(s) 718 can also include speakers, or similar devices, to play sounds or ringtones when an audio call or video call is received. Output device(s) 718 can also include ports for one or more peripheral devices, such as headphones, peripheral speakers, or a peripheral display.

[0071] In various implementations, input device(s) 720 include any input devices known in the art. For example, the input device(s) 720 may include a camera, a microphone, or a keyboard / keypad. The input device(s) 720 can include a touch-sensitive display or a keyboard to enable users to enter data and make requests and receive responses via web applications (e.g., in a web browser), make audio and video calls, and use the standard applications 406, among other things. The touch-sensitive display or keyboard / keypad may be a standard push button alphanumeric multi-key keyboard (such as a conventional QWERTY keyboard), virtual controls on a touchscreen, or one or more other types of keys or buttons, and may also include a joystick, wheel, and / or designated navigation buttons, or the like. A touch sensitive display can act as both an input device 720 and an output device 718.

[0072] FIG. 8 is an illustrative process 800 for communicating in a capability-restricted system. The process 800 and other processes described herein are illustrated as example flow graphs, each operation of which may represent a sequence of operations that can be implemented in hardware, software, or a combination thereof. In the context of software, the operations represent computer-executable instructions stored on one or more computer-readable storage media that, when executed by one or more processors, perform the recited operations. Generally, computer-executable instructions include routines, programs, objects, components, data structures, and the like that perform particular functions or implement particular abstract data types. The order in which the operations are described is not intended to be construed as a limitation, and any number of the described operations can be combined in any order and / or in parallel to implement the processes.22 Atorney Docket No. K122-0005PCT

[0073] Process 800 commences at operation 802, wherein the client 102 generates the message 116 for the server 104A. The message 116 can be of various types, such as requests for information, status updates, and the like. The message 116 further includes the token 324. The token 324 represents an authorization by the application manager 506 for the client 102 to communicate with the server 104A. The application manager 506 accesses the manifest 508. The manifest 508 includes instructions to the application manager 506 as to which applications can communicate with which other applications. In one example, the application manager 506 instantiates the token table 322. The token table 322 is used by the message server 522 to authenticate the authorization of the client 102 to communicate with the server 104A.

[0074] At operation 804, the client 102 contacts the message server 522 through the endpoint 318. The endpoint 318 is a communication portal used by two entities to communicate with each other. When the client 102 contacts the message server 522 through the endpoint 318, the thread 314 commences, causing the message server 522 to go from an idle state to an active state.

[0075] At operation 806, the client 102 transfers the use of the portion 524 of the UT 514 assigned to the client 102 to the node 528 of the message server 522. As discussed above, the system 500 and other examples described herein are capability-restricted systems. Thus, entities like the message server 522 and the server 104A can only perform operations on behalf of the client 102 to the extent that the client 102 gives the capabilities (i.e. the UT portion 524) to the message server 522 and the server 104A to do so. If the client 102 does not give the portion 524, or the portion 524 is insufficient, the message server 522 either will not pass along the message or the server 104A will not respond to the message.

[0076] At operation 808, the client 102 copies the message to the shared memory 308 of the shared node 304 between the message server 522 and the client 102. At operation 808, the client 102 is also placed in an idle state.

[0077] At operation 810, if the token 324 is authenticated by the message server 522 using the token table 322, the message server 522 copies the message from the shared memory 308 to the shared memory 310 of the shared node 306 between the message server 522 and the server 104A. The shared node 306 and other capabilities are part of the UT 514 of the client 102.

[0078] At operation 812, the message server 522 contacts the server 104A through the endpoint 320. This causes the message server 522 thread 314 to stop, placing the message server 522 in an idle state, and the thread 316 of the server 104A to start, starting the server 104A.

[0079] At operation 814, the server 104A copies or accesses the message in the shared memory 310, thus receiving the communication from the client 102. An example process of responding to the message is described in FIG. 9.

[0080] FIG. 9 is an illustrative process 900 for responding to the message. From FIG. 8, the server 104A has processed the message and generated the data 114 at operation 902.

[0081] The process 900 continues to operation 904, where the server 104A contacts the message server 522 through the endpoint 320, changing the state of the message server 522 from idle to executing.

[0082] At operation 906, the server 104A copies the data 114 to the shared memory 310 of the shared node 306 between the message server 522 and the server 104A. At this point, the server 104A thread 316 enters an idle state, idling the server 104A.

[0083] At operation 908, the message server 522 copies the data 114 from the shared memory 310 of the shared node 306 between the message server 522 and the server 104A to the shared memory 308 of the shared node 304 between the message server 522 and the client 102A.

[0084] At operation 910, the message server 522 contacts the client 102 through the endpoint 318, notifying the client 102 of the presence of the data 114. The message server 522 thereafter enters an idle state and the client 102 enters from an idle state to an executing state.

[0085] At operation 912, the client 102 downloads the data 114 from the shared memory 308 to the node 202.

[0086] At operation 914, the client 102 revokes the transferred client capabilities.

[0087] FIG. 10 is an illustration showing the use of application isolation and verified flows to provide dynamic updates, in accordance with some examples of the present disclosure. In FIG. 10, a system 1000 is configured with multiple zones - zone 1 and zone 2. The zones are established to logically separate applications having different requirements affecting how updates are applied to those applications. These requirements may include, but are not limited to, safety, security, cryptographic, uptime requirements, criticality of components, and the like. For example, zone 1 may be a low tolerance zone, whereby the applications that are in the low tolerance zone may be applications that are typically not updated or have a low tolerance for updates. In another example, zone 2 may be a zone in which the applications have to have a guaranteed uptime. As noted above, the types and numbers of zones may vary depending on the system requirements. Further, it shouldL©c &. Hoyos’ 24 Attorney Docket No. K122-0005PCTbe noted that although an application may be illustrated in FIG. 10 as being in a single zone, depending on system requirements, the application may be associated with more than one zone.

[0088] To further assist in dynamic updates, communications between applications are logically controlled into full restart or partial restart upon a failure of an application. The dashed lines in FIG. 10 indicate communication pathways that when one application fails or needs to be restarted (for example, due to an update), the application to which the failed application is communicating does not need to restart, referred to herein as a “restart isolated” communication pathways. The solid communication lines indicate that when one application fails, the connected application(s) restarts with the failed (or crashed) application, referred to herein as an “restart integrated.” For example, zone 1 includes a network manager 1002, a virtual private network (VPN) 1004, a modem 1006, and a software guard 1008. Although not pertinent to the subject matter, a network manager 1002 may be an application that configures network aliases, IP addresses, static routes, DNS information, and VPN connections, as well as many connectionspecific parameters. The virtual private network 1004 may establish a connection between the system 1000 and a remote server. The modem 1006 may be the communication interface between the servers and the virtual private network 1004. The software guard 1008 is an application that establishes the security of applications. In zone 1, the communication connections between the network manager 1002, the virtual private network 1004, the modem 1006, and the software guard 1008 mean that a failure or crash of one of the applications would require the restart of its connected application. For example, if the VPN 1004 crashed, the network manager 1002 and the modem 1006 would both need to be restarted when recovering the VPN 1004 as an integrated restart.

[0089] Zone 2 has similar communication pathways indicated by a solid line whereby an integrated restart would occur. Zone 2 includes a data collector 1010 which collects data from a sensor 1012, a safety monitor 1014 that monitors various conditions, a controller 1016 used to operate a system or device, and a controller area network (CAN) bus 1018 that allows various control units (controllers) to communicate with each other. As in zone 1, it should be understood that the applications in zone 2 are only examples of the types of applications that may be used in the system 1000. As illustrated in FIG. 10, the communications between the safety monitor 1014, the controller 1016, and the CAN bus 1018 are integrated restart communications, meaning that if the CAN bus 1018 were to fail and need to be restarted, the controller 1016 would also be restarted.Similarly, if the controller 1016 were to fail and need to be restarted, the safety monitor 1014 and the CAN bus 1018 would be restarted.

[0090] However, both zone 1 and zone 2 have isolated restart communication pathways indicated by dashed lines. For example, in zone 2, if the sensor 1012, which has a one-way communication path from the sensor 1012 to the data collector 1010, were to need a restart, the data collector 1010 would not necessarily be restarted. In some examples, there may be bidirectional communication pathways, such as between the VPN 1004 and the modem 1006. As with the one-way communication pathways, the bidirectional communication pathways may be restart isolated or restart integrated. Similarly, if the CAN bus 1018, which has a one-way communication pathway from the CAN bus 1018 to the data collector 1010, were to fail, only the CAN bus 1018 would be restarted. These isolated restart communications may also be instituted between zones so that a failure of an application in one zone does not require the restart of an application in another zone (zone isolation). For example, illustrated in FIG. 10, there is a oneway communication pathway from the software guard 1008 in zone 1 to the controller 1016 in zone 2. If the software guard 1008 needs to be restarted, because the communication indicates an isolated restart between the software guard 1008 and the controller 1016, the controller 1016 would not need to be restarted. One-way communication paths may be enforced using programming or a data diode, such as the data diode 1020. The data diode 1020 is a layer of programming the allows only one-way communication between applications. For example, in FIG. 10, the data diode 1020 enforces a one-way communication pathway between the data collector 1010 and the network manager 1002. Thus, if the data collector 1010 were to be restarted, the network manager 1002 would not need to be restarted.

[0091] The use of isolated restart communication pathways provides for several benefits when updating applications. One benefit may be that an application may be updated with little to no effect on applications in communication with the updated application. For example, the data collector 1010 may be updated from one version to a newer version, requiring an application manager to be restarted (or in some examples, a new application manager to be instantiated while the prior version application manager’s communication pathways are removed). In this example, the sensor 1012, the CAN bus 1018, and the network manager 1002 may continue operating during the restart. In some examples, the sensor 1012 and / or the CAN bus 1018 may be instructed toL©c &. Hctyss' 26 Attorney Docket No. K122-0005PCTcommunicate with the updated data collector 1010 using a different port, IP address, or the like if the updated data collector 1010 uses different communication input addresses.

[0092] Another benefit may be that failures, crashes, or updates in one zone may be isolated to that zone. Referring again to FIG. 10, the communication pathways between applications in zone 1 and 2 that communicate across the zones, e.g., the software guard 1008 to the controller 1016 and the data collector 1010 to the network manager 1002 are isolated restart communication pathways. Thus, application restarts in zone 2 do not require restarts in zone 1, and similarly, application restarts in zone 1 do not require restarts in zone 2. Thus, in these examples, the zones are restart isolated from each other. Further, if one or more applications in one zone may be protected from attacks in other zones using the one-way communications and isolated restart communication pathways. Additionally, before an update is applied, the system may identify which applications will take downtime and which applications will not take downtime.

[0093] FIGS. 11-13 illustrate example updates using isolate restart communication pathways, in accordance with example of the present disclosure. FIG. 11 is a computing platform 1100 showing the use of predesignated memory locations for nodes of applications. The computing system 1100 of FIG. 11 includes hardware 1102, a micro kernel 1104, and an operating system core 1106. The hardware 1102 includes, but is not limited to or must include, a motherboard, central processing unit (CPU), memory, and an input / output interface. The computing platform 1100 includes the micro kernel 1104. In some examples, the micro kernel 1104 is a portion or modular part of an operating system kernel that implements basic features. In some examples of the micro kernel 1104, the user services and kernel services are implemented in different address spaces. The user services are kept in user address space, and kernel services are kept under kernel address space. The system 1100 may further include user applications 1107 such as a modem 1108, a virtual pic 1110, sensor in 1112, and a modbus out 1114. As noted above, the presently disclose subject matter is not limited to any particular type of application, as the user applications 1107 illustrated in this and other figures are merely examples for purposes of illustrating various aspects of the presently disclosed subject matter.

[0094] The configuration of the system 1100 may be provided by a manifest 1116. As noted above, for example in FIG. 5 above, the manifest 1116 is a set of instructions that inform an application manager of what applications including capabilities assigned to one or more entities, communication pathways, memory allocations, and the like to create. In the example illustrated27 Atorney Docket No. K122-0005PCTin FIG. 1 1, the manifest 1 116 has instructions that establish the virtual pic 1110 as an application that has restart isolated communications with other user applications 1107, shown by dashed lines. In the manner described above, that means if one of the other user applications 1107 is restarted for any reason, the manifest 1116 has caused the virtual pic 1110 to be established in such a manner that updates or additions to the user applications 1107 will not affect or cause the virtual pic 1110 to be restarted. In some examples, the virtual pic 1110 may be assigned as a “restart restricted” application, whereby restarts of one of the user applications 1107 will not result in a restart of the virtual pic 1110. Further, the virtual pic 1110 may be assigned in the manifest as a “restricted updatable resource,” whereby the virtual pic 1110 will only be updatable in specified and limited circumstances or restricted until at least one update requirement is met. For example, the virtual pic 1110 may be a critical application that should only be updated periodically or for certain, approved requirements such as meeting a level of authentication, a required testing procedure, and the like. An example of an update to the user applications 1107 is provide in FIG. 12, below.

[0095] FIG. 12 is an illustration showing an update to the user applications 1107, in accordance with various examples of the present disclosure. In FIG. 12, a new manifest, manifest 2116, has been downloaded and implemented by the system 1100. As illustrated, the manifest 2116 has instructions that has caused the instantiation of a VPN 2118, has caused the modem 1108 to communicate with the VPN 2118 rather than the virtual pic 1110, and has caused the virtual pic 1110 to communicate with the VPN 2118. In this example, because the virtual pic 1110 has been identified as a “restart restricted” application, and because the communication pathways have been established as restart isolate communications, the addition of the VPN 2118 has not required the restart of other components, such as the virtual pic 1110 and the modem 1108. In some examples, when the manifest 2116 is downloaded, the manifest 2116 will include information about which applications will take down time and which will continue operation because the manifest 2116 and / or the manifest 1116 will have information about the types of communication pathways between the user applications 1107, such as restart isolation or restart integrated.

[0096] FIG. 13 is an illustration showing an update to the user applications 1107 using data diodes, in accordance with various examples of the present disclosure. In FIG. 13, a new manifest, manifest 3116, has been downloaded and implemented by the system 1100. As illustrated, the manifest 3116 has instructions that has caused the instantiation of a maintenance Al 3118. The maintenance Al 118 may be a user application 1107 that receives information about the virtualpic 1110 and sensors in 1112 and provides information to one or more system utilities (not shown) about the operations of those applications. It should be noted, however, that the instantiation of the maintenance Al 3118 is merely an example to illustrate aspects of the presently disclosed subject matter. The manifest 3116 further includes instructions to establish the communication form the virtual pic 1110 and sensors in 1112 to the maintenance Al 3118 as a one-way communication path using data diodes 3120 and 3122. In this configuration, changes / updates / restarts / failures of the maintenance Al 3118 will not require the restart of the virtual pic 1110 or sensors in 1112.

[0097] Various aspects of the presently disclosed subject matter may be found in one or more of the following paragraphs or combinations of clauses:

[0098] Clause 1. A method, comprising: instantiating, in one or more systems, a client, a message server, and a server by reading a first manifest comprising a set of instructions to instantiate the client, the server, and the message server; instantiating, by reading the first manifest, a first user application in a first zone, a second user application in the first zone, a and a third user application in a second zone; establishing, by reading the first manifest, a first one-way communication pathway from the first user application to the second user application, wherein the first one-way communication pathway is a restart integrated communication pathway; and establishing, by reading the first manifest, a second one-way communication pathway from the second user application to the third user application, wherein the second communication pathway is a restart isolated communication pathway.

[0099] Clause 2. The method of any proceeding clause or combination of clauses, further comprising: receiving a second manifest, wherein the second manifest comprises instructions to update the second user application; updating the second user application according to the instructions received in the second manifest; restarting the second user application according to the instructions received in the second manifest; restarting the first user application pursuant to the restart integrated communication pathway between the first user application and the second user application; and maintaining the third user application as operational without a restart pursuant to the restart isolated communication pathway between the second user application and the third user application.L©c &. Hoyos’ 29 Attorney Docket No. K122-0005PCT

[0100] Clause 3. The method of any proceeding clause or combination of clauses, wherein the restart isolated communication pathway between the second user application and the third user application is implemented using a data diode.

[0101] Clause 4. The method of any proceeding clause or combination of clauses, further comprising assigning the third user application as a restart restricted application, whereby a restart of either the first user application, the second user application, or a fourth user application will not require a restart of the third user application.

[0102] Clause 5. The method of any proceeding clause or combination of clauses, further comprising assigning the third user application as a restricted updatable application, whereby an update to the third user application is restricted until at least one update requirement is met.

[0103] Clause 6. The method of any proceeding clause or combination of clauses, further comprising: receiving a third manifest, wherein the third manifest comprises instructions to: instantiate a fifth user application; and establish a bidirectional communication pathway between the first user application and the fifth user application, whereby the bidirectional communication pathway comprises a restart integrated communication pathway.

[0104] Clause 7. The method of any proceeding clause or combination of clauses, further comprising: receiving a fourth manifest, wherein the third manifest comprises instructions to: instantiate a sixth user application; and establish a one-way communication pathway from the second user application to the sixth user application, whereby the one-way communication pathway is enforced using a second data diode.

[0105] Clause 8. The method of any proceeding clause or combination of clauses, wherein at least one system of the one or more systems is mathematically verified.

[0106] Clause 9. The method of any proceeding clause or combination of clauses, wherein at least one second system of the one or more systems is not mathematically verified.

[0107] Clause 10. The method of any proceeding clause or combination of clauses, wherein a first system of the one or more systems is executed on a first core of a first processor.

[0108] Clause 11. The method of any proceeding clause or combination of clauses, wherein a second system of the one or more systems is executed on a second core of the first processor.

[0109] Clause 12. A computer-readable storage medium having computer-executable instructions thereon, which when executed by one or more computers perform the following steps: instantiating, in one or more systems, a client, a message server, and a server by reading a firstmanifest comprising a set of instructions to instantiate the client, the server, and the message server; instantiate, by reading the first manifest, a first user application in a first zone, a second user application in the first zone, a and a third user application in a second zone; establish, by reading the first manifest, a first one-way communication pathway from the first user application to the second user application, wherein the first one-way communication pathway is a restart integrated communication pathway; and establish, by reading the first manifest, a second one-way communication pathway from the second user application to the third user application, wherein the second communication pathway is a restart isolated communication pathway.

[0110] Clause 13. The computer-readable storage medium of any proceeding clause or combination of clauses, further comprising computer-executable instructions which when executed by the one or more computers perform the steps of: receiving a second manifest, wherein the second manifest comprises instructions to update the second user application; updating the second user application according to the instructions received in the second manifest; restarting the second user application according to the instructions received in the second manifest; restarting the first user application pursuant to the restart integrated communication pathway between the first user application and the second user application; and maintaining the third user application as operational without a restart pursuant to the restart isolated communication pathway between the second user application and the third user application.[0U1] Clause 14. The computer-readable storage medium of any proceeding clause or combination of clauses, further comprising computer-executable instructions which when executed by the one or more computers perform the step of assigning the third user application as a restart restricted application, whereby a restart of either the first user application, the second user application, or a fourth user application will not require a restart of the third user application.

[0112] Clause 15. The computer-readable storage medium of any proceeding clause or combination of clauses, further comprising computer-executable instructions which when executed by the one or more computers perform the step of assigning the third user application as a restart restricted application, whereby a restart of either the first user application, the second user application, or a fourth user application will not require a restart of the third user application.

[0113] Clause 16. The computer-readable storage medium of any proceeding clause or combination of clauses, further comprising computer-executable instructions which when executed by the one or more computers perform the step of assigning the third user application asa restricted updatable application, whereby an update to the third user application is restricted until at least one update requirement is met.

[0114] Clause 17. A system comprising: a memory storing computer-executable instructions; and one or more processor cores in communication with the memory, the computer-executable instructions causing the one or more processors to perform acts comprising: instantiating, in one or more systems, a client, a message server, and a server by reading a first manifest comprising a set of instructions to instantiate the client, the server, and the message server; instantiate, by reading the first manifest, a first user application in a first zone, a second user application in the first zone, a and a third user application in a second zone; establish, by reading the first manifest, a first one-way communication pathway from the first user application to the second user application, wherein the first one-way communication pathway is a restart integrated communication pathway; and establish, by reading the first manifest, a second one-way communication pathway from the second user application to the third user application, wherein the second communication pathway is a restart isolated communication pathway.

[0115] Clause 18. The system of any proceeding clause or combination of clauses, further comprising computer-executable instructions to cause the processor to perform acts comprising: receiving a second manifest, wherein the second manifest comprises instructions to update the second user application; updating the second user application according to the instructions received in the second manifest; restarting the second user application according to the instructions received in the second manifest; restarting the first user application pursuant to the restart integrated communication pathway between the first user application and the second user application; and maintaining the third user application as operational without a restart pursuant to the restart isolated communication pathway between the second user application and the third user application

[0116] Clause 19. The system of any proceeding clause or combination of clauses, further comprising computer-executable instructions to cause the processor to perform acts comprising: receiving a third manifest, wherein the third manifest comprises instructions to: instantiate a fifth user application; and establish a bidirectional communication pathway between the first user application and the fifth user application, whereby the bidirectional communication pathway comprises a restart integrated communication pathway.

[0117] Clause 20. The system of any proceeding clause or combination of clauses, further comprising computer-executable instructions to cause the processor to perform acts comprising: receiving a fourth manifest, wherein the third manifest comprises instructions to: instantiate a sixth user application; and establish a one-way communication pathway from the second user application to the sixth user application, whereby the one-way communication pathway is enforced using a second data diode.

[0118] The presently disclosed examples are considered in all respects to be illustrative and not restrictive. The scope of the disclosure is indicated by the appended claims, rather than the foregoing description, and all changes that come within the meaning and range of equivalents thereof are intended to be embraced therein.

Claims

CLAIMSWhat is claimed is:

1. A method, comprising: instantiating, in one or more systems, a client, a message server, and a server by reading a first manifest comprising a set of instructions to instantiate the client, the server, and the message server; instantiating, by reading the first manifest, a first user application in a first zone, a second user application in the first zone, a and a third user application in a second zone; establishing, by reading the first manifest, a first one-way communication pathway from the first user application to the second user application, wherein the first one-way communication pathway is a restart integrated communication pathway; and establishing, by reading the first manifest, a second one-way communication pathway from the second user application to the third user application, wherein the second communication pathway is a restart isolated communication pathway.

2. The method of claim 1, further comprising: receiving a second manifest, wherein the second manifest comprises instructions to update the second user application; updating the second user application according to the instructions received in the second manifest; restarting the second user application according to the instructions received in the second manifest; restarting the first user application pursuant to the restart integrated communication pathway between the first user application and the second user application; and maintaining the third user application as operational without a restart pursuant to the restart isolated communication pathway between the second user application and the third user application.

3. The method of claim 1, wherein the restart isolated communication pathway between the second user application and the third user application is implemented using a data diode.L©c &. Hctyss' 34 Attorney Docket No. K122-0005PCT4. The method of claim 1 , further comprising assigning the third user application as a restart restricted application, whereby a restart of either the first user application, the second user application, or a fourth user application will not require a restart of the third user application.

5. The method of claim 1, further comprising assigning the third user application as a restricted updatable application, whereby an update to the third user application is restricted until at least one update requirement is met.

6. The method of claim 1, further comprising: receiving a third manifest, wherein the third manifest comprises instructions to: instantiate a fifth user application; and establish a bidirectional communication pathway between the first user application and the fifth user application, whereby the bidirectional communication pathway comprises a restart integrated communication pathway.

7. The method of claim 1, further comprising: receiving a fourth manifest, wherein the third manifest comprises instructions to: instantiate a sixth user application; and establish a one-way communication pathway from the second user application to the sixth user application, whereby the one-way communication pathway is enforced using a second data diode.

8. The method of claim 1, wherein at least one system of the one or more systems is mathematically verified.

9. The method of claim 8, wherein at least one second system of the one or more systems is not mathematically verified.

10. The method of claim 1, wherein a first system of the one or more systems is executed on a first core of a first processor.

11. The method of claim 10, wherein a second system of the one or more systems is executed on a second core of the first processor.

12. A computer-readable storage medium having computer-executable instructions thereon, which when executed by one or more computers perform the following steps:35 Atorney Docket No. K122-0005PCTinstantiating, in one or more systems, a client, a message server, and a server by reading a first manifest comprising a set of instructions to instantiate the client, the server, and the message server; instantiate, by reading the first manifest, a first user application in a first zone, a second user application in the first zone, a and a third user application in a second zone; establish, by reading the first manifest, a first one-way communication pathway from the first user application to the second user application, wherein the first one-way communication pathway is a restart integrated communication pathway; and establish, by reading the first manifest, a second one-way communication pathway from the second user application to the third user application, wherein the second communication pathway is a restart isolated communication pathway.

13. The computer-readable storage medium of claim 12, further comprising computerexecutable instructions which when executed by the one or more computers perform the steps of: receiving a second manifest, wherein the second manifest comprises instructions to update the second user application; updating the second user application according to the instructions received in the second manifest; restarting the second user application according to the instructions received in the second manifest; restarting the first user application pursuant to the restart integrated communication pathway between the first user application and the second user application; and maintaining the third user application as operational without a restart pursuant to the restart isolated communication pathway between the second user application and the third user application.

14. The computer-readable storage medium of claim 12, further comprising computerexecutable instructions which when executed by the one or more computers perform the step of assigning the third user application as a restart restricted application, whereby a restart of either the first user application, the second user application, or a fourth user application will not require a restart of the third user application.L©c &. Hctyss' 36 Attorney Docket No. K122-0005PCT15. The computer-readable storage medium of claim 12, further comprising computerexecutable instructions which when executed by the one or more computers perform the step of assigning the third user application as a restart restricted application, whereby a restart of either the first user application, the second user application, or a fourth user application will not require a restart of the third user application.

16. The computer-readable storage medium of claim 12, further comprising computerexecutable instructions which when executed by the one or more computers perform the step of assigning the third user application as a restricted updatable application, whereby an update to the third user application is restricted until at least one update requirement is met.

17. A system comprising: a memory storing computer-executable instructions; and one or more processor cores in communication with the memory, the computerexecutable instructions causing the one or more processors to perform acts comprising: instantiating, in one or more systems, a client, a message server, and a server by reading a first manifest comprising a set of instructions to instantiate the client, the server, and the message server; instantiate, by reading the first manifest, a first user application in a first zone, a second user application in the first zone, a and a third user application in a second zone; establish, by reading the first manifest, a first one-way communication pathway from the first user application to the second user application, wherein the first one-way communication pathway is a restart integrated communication pathway; and establish, by reading the first manifest, a second one-way communication pathway from the second user application to the third user application, wherein the second communication pathway is a restart isolated communication pathway.

18. The system of claim 17, further comprising computer-executable instructions to cause the processor to perform acts comprising: receiving a second manifest, wherein the second manifest comprises instructions to update the second user application; updating the second user application according to the instructions received in the second manifest;Atorney Docket No. K122-0005PCTrestarting the second user application according to the instructions received in the second manifest; restarting the first user application pursuant to the restart integrated communication pathway between the first user application and the second user application; and maintaining the third user application as operational without a restart pursuant to the restart isolated communication pathway between the second user application and the third user application19. The system of claim 17, further comprising computer-executable instructions to cause the processor to perform acts comprising: receiving a third manifest, wherein the third manifest comprises instructions to: instantiate a fifth user application; and establish a bidirectional communication pathway between the first user application and the fifth user application, whereby the bidirectional communication pathway comprises a restart integrated communication pathway.

20. The system of claim 17, further comprising computer-executable instructions to cause the processor to perform acts comprising: receiving a fourth manifest, wherein the third manifest comprises instructions to: instantiate a sixth user application; and establish a one-way communication pathway from the second user application to the sixth user application, whereby the one-way communication pathway is enforced using a second data diode.

Images