OS Silo Mechanism for Application Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current systems lack a robust and efficient mechanism for isolating applications running on the same machine while allowing controlled sharing of resources, leading to application conflicts, security issues, and management challenges.
Innovation Solution
The introduction of a silo mechanism within a single operating system instance, which creates isolated application environments (server silos) with a subset view of the system name space, enabling controlled resource sharing and management, allowing multiple applications to run without conflicts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If applications are run on different virtual machines to achieve isolation, then application isolation is improved, but system complexity and resource overhead increase
Solution Approach 1:
The patent segments the system namespace into multiple isolated namespaces, each accessible to specific applications. This allows applications to be isolated from each other without requiring separate virtual machine instances, thereby maintaining isolation while reducing system complexity and resource overhead.
Solution Approach 2:
Instead of isolating applications in separate virtual machine instances (spatial dimension), the patent introduces a new dimension of isolation through namespace segmentation. Applications share the same system but operate in different namespace contexts, achieving isolation without the overhead of multiple VM instances.
2Reliability
If hardware partitioning is used to isolate applications, then application isolation is improved, but resource sharing capability deteriorates
Solution Approach 1:
The patent applies local quality by allowing different namespace visibility and access rights for different applications. Each application can have its own customized namespace view, enabling selective resource sharing while maintaining isolation. This resolves the contradiction by allowing resource sharing at the namespace level without compromising application isolation.
3Ease of operation
If access control is based on user identity rather than application, then system flexibility is improved, but application security deteriorates
Solution Approach 1:
The patent introduces namespace as an intermediary layer between user identity and resource access. Instead of directly controlling access based on user identity, the system uses namespace segmentation to mediate resource visibility and access rights, providing both flexibility in user management and enhanced security through application-specific namespace controls.
Data Source
AI summary
An intra-operating system isolation mechanism called a silo provides for the grouping and isolation of processes running on a single computer using a single instance of the operating system. The operating system enables the controlled sharing of resources by providing a view of a system name space to processes executing within an isolated application called a server silo. A server silo is created by performing a separate “mini-boot” of user-level services within the server silo. The single OS image serving the computer employs the mechanism of name space containment to constrain which server silos can use which resource(s). Restricting access to resources is therefore directly based on the process or application placed in the server silo rather than who is running the application because if a process or application is unable to resolve a name used to access a resource, it will be unable to use the resource.