Snapshot Manager Application Isolation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Computer systems face issues with applications interfering with each other, incomplete uninstallation, and security risks due to inadequate memory protection, leading to file system conflicts and malware introduction.

Innovation Solution

Implementing a snapshot manager that creates snapshot tables to manage and restrict memory access for applications, allowing only permitted access to specific memory blocks and enabling complete uninstallation of applications without file system conflicts.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If applications are allowed to access memory without restriction, then application functionality is maintained, but memory protection and system security deteriorate

Engineering Contradiction:

Improvememory protectionVSAvoidapplication access

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The patent segments memory access permissions by creating snapshot tables that divide the file system into isolated portions. Each application is mapped to a specific snapshot table containing only the memory blocks it needs, effectively segmenting the address space and preventing unauthorized access to other applications' memory regions while maintaining necessary access to permitted blocks.

Inventive Principle:

Principle #1Segmentation

2Reliability

If applications are isolated using snapshot tables, then memory protection is improved, but system complexity increases

Engineering Contradiction:

Improveapplication isolationVSAvoidsnapshot management

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The snapshot manager acts as an intermediary component between applications and the file system. It handles the complexity of creating, maintaining, and managing snapshot tables, translating high-level application needs into low-level memory access control. This intermediary absorbs the system complexity rather than distributing it throughout the entire system.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Productivity

If multiple applications share the file system, then system resource utilization is improved, but file system conflicts and interference increase

Engineering Contradiction:

Improveresource utilizationVSAvoidapplication interference

Core Design Contradiction:

ProductivityVSObject-generated harmful factors

Solution Approach 1:

The patent applies local quality by giving each application a customized view of the file system through its dedicated snapshot table. Each snapshot table contains pointers to specific memory blocks relevant to that application, creating localized access permissions. This allows applications to share the physical file system resources while each application experiences a tailored, conflict-free view of the file system structure.

Inventive Principle:

Principle #3Local quality

Data Source

PatentUS10417142B2Operating system integrated application isolation

Publication Date: 2019.09.17 RED HAT ISRAEL

AI summary

A system, method, and apparatus for operating system integrated application isolation. A snapshot manager creates a snapshot table including one or more pointers to a file system storage. Then an application is installed on an operating system and mapped to a snapshot table. The snapshot manager receives a request by the application to access a memory block. The snapshot manager determines whether the application has permission to access the memory block. Responsive to a determination that the application has permission to access the memory block, the snapshot manager permits access to the memory block.