System and method for on-line and off-line streaming application isolation

Abstract

Providing streaming of applications from streaming servers onto clients. The applications are contained within isolated environments, and the isolated environments are streamed from the servers onto clients. The system may include the option of running both in on-line and off-line. When on-line, the system may include authentication of the streaming servers and authentication of clients and credentialing of the isolated environments and applications the clients are configured to run. The system may further include encrypted communication between the streaming servers and the clients. When off-line, the system may include the ability to run already installed isolated environments without requiring credentialing. The system may further include a management interface where administrators may add, remove and configure isolated environments, configure client policies and credentials, and force upgrades.

Claims

1. A system, comprising: a host server with one or more memory locations configured to store isolated environments each comprised of one or more applications; one or more clients each comprising one or more memory locations configured to store the one or more isolated environments and one or more Central Processing Units (CPUs) operatively connected to the one or more memory locations and configured to execute the applications and the isolated environments on a client operating system and each configured to determine if said each client is off-line or on-line; and a credentialing server configured to store client credentials, authenticate clients, and validate client credentials; wherein said one or more clients, when executing on-line, validates client credentials with said credentialing server and streams one or more isolated environments from said host server before executing said isolated environments; wherein when operating off-line, the one or more clients are presented with a list of already installed isolated environments, and are permitted to select which isolated environments to run; wherein when operating on-line, the one or more clients may request a list of credentialed isolated environments and select which one to run; wherein said one or more client, when executing off-line, executes previously streamed isolated environments without validating credentials with said credentialing server.

2. The system according to claim 1, wherein the one or more clients operate on-line if a network connection is detected, and the one or more clients operate off-line if no network connection is detected.

3. The system according to claim 1, wherein a user manually selects to operate said one or more clients on-line or off-line.

4. The system according to claim 1, wherein when operating off-line, the one or more clients access applications within already installed isolated environments.

5. The system according to claim 1, wherein when operating off-line, the one or more clients may access already installed isolated environments without requiring credentialing by the host server.

6. The system according to claim 1, wherein when operating on-line, the one or more clients are credentialed by the host server.

7. The system according to claim 1, wherein said one or more clients, when executing on-line, validates client credentials with said credentialing server and updates previously streamed isolated environments before executing said previously streamed isolated environments.

8. The system according to claim 1, wherein when operating on-line, the one or more clients may select to switch to off-line.

9. The system according to claim 2, wherein a valid hypertext transfer protocol (HTTP) connection to a predetermined website is used to determine if a network connection is functional.

10. The system according to 1, wherein when operating on-line, the one or more clients receive streaming updates automatically.

11. The system according to claim 1, wherein, by default, the one or more clients are operating on-line unless otherwise specified by the one or more clients.

12. The system according to claim 9, wherein if no valid HTTP connection can be established to the predetermined website, the one or more clients' connections are set to operate off-line.

13. The system according to claim 9, wherein if a valid HTTP connection can be established to the predetermined website, and the host server is unreachable then the one or more clients' connections are set to operate off-line.

14. The system according to claim 1, wherein the host server operates on a central server.

15. The system according to claim 14, further comprising at least one application server configured to stream applications from the central server to the one or more clients.

16. The system according to claim 14, wherein the one or more clients access the host server over the Internet from at least one of a personal computer and a cellular phone.

17. The system according to claim 1, wherein each of the one or more clients connects to the host server via a client policy manager.

18. The system according to claim 17, wherein the client policy manager performs at least one of validating client credentials and maintaining accounts for each credentialed client.

19. The system according to claim 1, wherein each of the one or more clients has at least one update-cache per credentialed isolated environment that each of the one or more clients is permitted to access.

Description

BRIEF DESCRIPTION OF THE SEVERAL VIEWS OF THE DRAWING(S)

(1) The invention will be more fully understood by reference to the following drawings which are for illustrative purposes only:

(2) FIG. 1 is a block diagram of the core system architecture showing three clients and the IE Streaming Server.

(3) FIG. 2 is a block diagram illustrating the Isolated Environment Streaming Server.

(4) FIG. 3 is a block diagram illustrating Client Systems.

(5) FIG. 4 is a block diagram illustrating establishing a secure and credentialed connection between a client and the IESS.

(6) FIG. 5 is a block diagram illustrating establishing client credentials.

(7) FIG. 6 is a block diagram illustrating creating the list of credentialed IEs for a client.

(8) FIG. 7. is a block diagram illustrating the client policy manager.

(9) FIG. 8. is a block diagram illustrating client synchronization against the IESS.

(10) FIG. 9 is a block diagram illustrating client operation in off-line and on-line modes.

(11) FIG. 10 is a block diagram illustrating administration.

(12) FIG. 11 is a block diagram illustrating various deployment scenarios.

DETAILED DESCRIPTION OF THE INVENTION

(13) Referring more specifically to the drawings, for illustrative purposes the present invention will be disclosed in relation to FIG. 1 through FIG. 11. It will be appreciated that the system and apparatus of the invention may vary as to configuration and as to details of the constituent components, and that the method may vary as to the specific steps and sequence, without departing from the basic concepts as disclosed herein.

0. Introduction

(14) The context in which this invention is disclosed is one or more applications installed inside isolated environments and hosted on an “Isolated Environment Streaming Server (IESS)” with the isolated environments being streamed to one or more clients. The Havemose reference cited above, included in its entirety by reference, teaches the creation and maintenance of the isolated environments. Without affecting the general case of multiple applications, the following scenarios often depict and describe one or two applications as applicable. Multiple applications are handled in a similar manner. Similarly the following scenarios often depict one or two clients; multiple clients are handled in a similar manner. Similarly, the following scenarios often depict one isolated environment per client; multiple isolated environments are handled in a similar manner. Similarly, the following scenarios often depict one IESS; multiple IESSes are handled in a similar manner.

1. Overview

(15) FIG. 1 illustrates by way of example embodiment 1 the overall structure of the present invention. The following brief overview illustrates the high-level relationship between the various components; further details on the inner workings and interdependencies are provided in the following sections. FIG. 1. Illustrates by way of example embodiment three client systems 10, 20, 30 and the Isolated Environment Streaming Server (IESS) 40. The client systems contain isolated environments (IE) and the “Client Credentials (CC)” governing the IESS access privileges for the particular client on the IESS. Also present on each client is the core Isolated Environment Infrastructure (IEI) and operating system and libraries. Specifically, Client-1 10 contains isolated environment IE-1 12 with update-cache 13 and client credentials (CC) 18, Isolated Environment Infrastructure (IEI) 14 and operating system and libraries 16. Client-2 20 contains IE-2 22 with update-cache 23 and CC 28, IEI 24 and operating system and libraries 26, while Client-3 30 contains IE-3 32 with update-cache 33 and CC 38, IEI 34 and operating system and libraries 36.

(16) Each client connects to the IESS 40 via the Client Policy Manager (CPM) 42. The CPM validates the credentials and maintains an Account for each credentialed client. Associated with each Client Account is an update-cache used to optimize access to isolated environments enabled for the particular client. Each client has one update-cache per credentialed IE. If a client account has access to two IEs, there are thus two update-caches for that particular client.

(17) FIG. 1 illustrates by way of example the Client Policy Manager (CPM) 42 with three client accounts: Account Client-1 44 with associated update-caches 46, Account Client-2 48 with associated update-cache 50, and Account Client-3 52 with associated update-cache 54. By way of example, Client 1 is credentialed to use isolated environment IE-1 56 and IE-2 58 and therefore has two update-caches 46, while Client 2 is credentialed to use isolated environment 2 IE-2 58, and Client 3 is credentialed to use isolated environment ‘n’ 62. It is readily apparent to someone skilled in the art that the architecture extends to any number of clients, any number of isolated environments on any one client, and to any number of pre-configured isolated environments on the IESS.

2. IE Streaming Server (IESS)

(18) FIG. 2 illustrate by way of example embodiment 80, the key functional elements of the Isolated Environment Streaming Server IESS 82. The following brief overview only illustrate the key components, further details are given below. Loaded in memory 84 are the Client Policy Manager (CPM) 86 and the accounts and update-caches for active clients 90. The isolated environments 92 available for streaming to client are loaded from either local disk 100 or networked storage 102, and delivered to clients over the network 104 as determined by the update-caches 90

(19) System resources, such as CPUs 98, I/O devices 96, Network interfaces 94 and storage 100, 102 are accessed using the operating system 88. Devices accessing remote resources use some form of transport network 104. By way of example, system networking 104 may use TCP/IP over Ethernet transport, Storage 100, 102 may use Fibre Channel or Ethernet transport, and I/O may use USB.

3. Client Architecture

(20) FIG. 3 illustrate by way of example embodiment 120, the key functional elements of a client system 122 within the context of the present invention. The following brief overview only illustrates the key components; further details are given below. Loaded in memory 124 are the applications within the isolated environments, IE-A 130 with update-cache 131, IE-B 132 with update-cache 133, and the Client Credentials 134. The core Isolated Environment Infrastructure (IE1) as defined above and in Havemose, is also loaded in memory.

(21) System resources, such as CPUs 142, I/O devices 140, Network interfaces 138 and storage 136 are accessed using the operating system 128. Devices accessing remote resources use some form of transport network 144. By way of example, system networking 144 may use TCP/IP over Ethernet transport, Storage 136 may use Fibre Channel or Ethernet transport, and I/O 140 may use USB.

4. IE Stream Server Credentials and Secure Communication

(22) To ensure secure and private communication the IESS most be properly credentialed. By way of example, if personnel in HR want to interact with the payroll system on the IESS and upload payroll information, the client system used by the HR employee validates the credentials of the IESS before uploading sensitive payroll information. If the IESS credential validation fails, the client system disconnects and stops interacting with the IESS.

(23) A related issue is security; ensuring that no malware of spyware gets downloaded into the clients isolated environments. By requiring a credentialed IESS, there a no risks of connecting to a malware site by mistake as such connections would be refused by the isolated environment infrastructure without establishing any connection beyond the initial attempt to validate credentials.

(24) Full IESS credentials are provided by a standard SSL certificate issued by either a certificate authority or generated in-house. If the IESS is accessed over the internet, a preferred implementation uses a certificate issued by a Certificate Authority. If the IESS only is accessed via a private LAN, WAN or VPN, an in-house generated certificate would suffice, but a certificates issued by a Certificate Authority equally works.

(25) The present invention establishes the initial secure communication using Secure Sockets Layer (SSL), a standardized technology widely available in modern operating systems such as Windows and Linux. Open source implementations of SSL include OpenSSL (www.openssl.org).

(26) FIG. 4 illustrates by way of example embodiment 160 the initial steps needed to set up secure communication between a client and an IESS.

(27) First a certificate for the IESS is generated. Generation of the IESS certificate only is needed when creating a new certificate, or when a certificate has expired. Generally, a certificate is valid for one or more years if generated by a certificate authority. First a private and public key pair is generated 164. This is accomplished using commonly available tools, such as ‘makekey’ provided by OpenSSL. In a preferred implementation, the a certificate request is prepared (‘certreq’ in OpenSSL) with the public key and transmitted to the Certificate Authority 162 together with information confirming the senders identity. The Certificate Authority generates a certificate 168 and delivers it back to the originator 166 and the certificate is installed on the IESS. In an alternate implementation, the certificate is self-generated using one of the available tools, such as ‘testreq’ from OpenSSL. The certificate 168 is used to establish the credentials of the IESS by clients.

(28) FIG. 4 further illustrates by way of example embodiment the establishment of secure and encrypted communication between a client 170 and the IESS.

(29) The client initiates communication 174 with the IESS using SSL. In response to the initial contact, the IESS 172 accepts the request for the certificate 176 and delivers the certificate to the client. The client validates the certificate 180. Validation can take one of two forms: in a preferred implementation the certificate is compared against a local copy provided by the administrator as part of present invention, in an alternate implementation the certificate is validated against known and pre-approved certificate authorities. Modern operating systems, such as Linux and Windows, provide a mechanism to store pre-approved certificates. If the validation fails 182 the client disconnects 184 as the IESS is rogue, mis-configured, or has an invalid certificate. If the certificate validates 183, the client proceeds 186 and using SSL establishes secure and encrypted communication 188 with the IESS.

(30) The client is now ready to have its client credentials validated 190 by the Client Policy Manager (CPM) within the IESS.

5. Validating Client Credentials with the Client Policy Manager

(31) With possibly multiple isolated environments hosted on an IESS, proper authentication of clients is important. By way of example, if a particular isolated environment contains a payroll software application, only clients with the proper credentials (generally personnel in human resources) should have access to the payroll application. The Client Policy Manager (CPM) running on the IESS governs which clients have access to which isolated environment. The specific client privileges are set by the system administrator and are implemented by the CPM.

(32) The connection between client and IESS, as describe above, is established using SSL, and is therefore secure and encrypted. The client only needs the client account as its credentials. All IEs available to a particular client are managed by the CPM and the key-pair needed for encryption is managed by SSL.

(33) When a client wishes to use a particular application within an isolated environment; the client makes a request to the Client Policy Manager (CPM) for access to the requested IE. The CPM validates the client credentials at two levels: first the client is validated as having access to the IESS services, followed by validation of the client's credentials for the requested IE.

(34) FIG. 5 illustrates by way of example embodiment 200 a client 202 making a request to run a particular IE. The CPM first validates 204 that the user has access to the IESS, by consulting its built-in database of approved clients 206. The result of the client validation by CPM is returned 207 to the client. If the client has invalid credentials 208, the session is terminated 224 and no further action is taken. If the client has valid credentials 210, the credentials to access the particular IE are validated 212. If the client is not credentialed to access the IE any future access attempts to the IE are eliminated 214. If the IE is installed on the client system, it is removed 218 and the session is terminated 224. If the IE is not installed on the client, the session terminates as there is no data or IE to remove. The IE is removed for reasons of security and access control: if a credentialed user has the rights to use a particular IE revoked, the possibility to run the IE must be removed. In continuation of the example, if the employee in the payroll department transfers to benefits, the employee is still credentialed, but should no longer have access to the payroll application.

(35) If the client is credentialed to run the particular IE 216, the IE needs to be either installed or potentially updated. If the IE is not installed on the client 220, it is copied to the client environment, and the IESS update-caches are updated to reflect the current state of the client copy. If the IE already is installed on the client 222, the update-caches on IESS are queried and updates propagated as necessary. The caching and installation are described in more detail below.

(36) When a client starts the present invention he is presented with a list of available IEs based on his credentials. FIG. 6 illustrates by way of example embodiment 240, a client obtaining the list of credentialed applications and launching a chosen application. First the client is credentialed 242 as described above. The client requests a list of credentialed IEs 244 and the CPM 246 responds with a list of IEs available and credentialed for the particular client. The list is presented to the client 250. In a preferred embodiment the client is presented with a graphical user interface 252 allowing the client to choose from a list of credentialed applications 254 and starting the application directly by clicking either on the application name 254 or OK 260. The launch can be cancelled by selecting “Cancel” 258. The client can also force a refresh 256 of available IEs, thereby updating the IE list 254. In a preferred embodiment the most recently chosen application is automatically highlighted. By way of example, FIG. 6 illustrates the scenario 254 with two credentialed applications (“Payroll” and “Benefits”) and one application no longer credentialed (“Investor Relations”). By selecting “Off-line” 257 the user indicates no synchronization against the IESS and that the local already-installed IE should be run.

6. Client Policy Manager Architecture

(37) The Client Policy Manager (CPM) within the IESS is the main contact point between clients and the IESS. The functionality of the CPM fall in several broad categories: 1) delivery of certificates to clients and establishment of SSL, 2) general client account access, 3) administration, and 4) management and implementation of the caching subsystem. FIG. 7 illustrates by way of example embodiment 240, the architectural blocks of the CPM 242.

(38) 6.1 Certificates and SSL:

(39) As disclosed previously, the IESS is credentialed by clients using a SSL certificate. The certificate serves dual roles, as a mechanism for the clients to validate the identity of the IESS and by providing keys for secure encrypted communication over SSL. Referring to FIG. 7 for illustrative purposes, the IESS certificate interface 244 is responsible for responding to certificate requests and to deliver them. The SSL interface 246 is responsible for the IESS end of SSL. In modern operating systems SSL is in general pre-defined to use certain ports such as 443 and 442 for SSL certificates and https respectively. In a preferred implementation, the present invention uses different ports that the default ports to avoid conflicts with web browsing and to minimize attacks. In an alternate implementation, the standard ports are used.

(40) 6.2 General Account Access:

(41) As previously disclosed, the CPM 242 provides a number of client services. Referring to FIG. 7 for illustrative purposes: The validation of clients 250 as disclosed in section 5, the enumeration of available IEs given the clients credentials 252 (section 5), and the general client account and credentials subsystem 254 containing an account database 255 with account info for each valid client account

(42) Associated with each client account 256 is a record in the account database 257 containing specific information about the account, and subsystems 258 for cache management 260 and billing/logging 262. Each client account record 257 in the database 255 contains at least the following fields: Client login Account Holder Name Status of account List of credentialed IEs

(43) The “client login” is the “user-id” used to validate the client account, while the “account holder name”, is the actual name of the person to which the account is assigned. The “status of account” indicates if the account is valid and credentialed. Finally, the database maintains a list of isolated environments to which the user is credentialed. This list is presented to the user when requesting Client IE enumeration 252 as disclosed in section 5.

(44) Associated with the client account are also the caching subsystem 260 and the billing and logging subsystem 262.

(45) 6.3 Update-Cache Subsystem for Isolated Environments.

(46) When a client requests access to a credentialed isolated environment, the IE is streamed in its entirety if not already present on the client system, or the client IE is selectively updated with changes as appropriate. In the following, the details on these steps are disclosed.

(47) By way of example, a typical Microsoft Office 2003 installation consists of approximately 1800 files with a combined size of about 315 MB. Some of the largest files are Word at 12 MB, Excel at 10 MB and PowerPoint at 6 MB. On a typical 1 Gbit/sec corporate network a typical good transmission rate is about 100 MB/sec, but can be significantly less. A typical ADSL connection runs at 1.5 Mbit/sec or 150 kB/sec and can be less.

(48) The one-time installation of the entire environment with Office 2003 therefore typically takes about 3.1 sec or longer over corporate network. Over ADSL the Office IE takes 35 min or longer. While the 3.5 seconds on the office network is acceptable, the 35 minutes for ADSL access is not practical. The present invention includes an update-caching subsystem ensuring that only changed files are streamed to the client, and furthermore, that the streaming is compressed when appropriate.

(49) FIG. 7 illustrates by way of example embodiment the update-cache management and its relation to the isolated environments. For each client account 256 in the client database 255, the present invention manages 260 the IE update-caches. Each IE credentialed for a particular user, has an update-cache associated with it for that user. Referring to FIG. 7, for client ‘m’ IE-1 266 is streamed subject to its update-cache 264, while IE-2 270 is streamed subject to its update-cache 268. If a particular IE is used by multiple clients, each client account 256 maintains its own update-cache for the particular IE.

(50) To reduce the need to stream files already present on the client computer an update-cache is employed for each IE. The update-cache contains pre-computed information assisting in quickly indentifying which files have changed since last time the IE was accessed; thereby reducing unnecessary streaming of IE files.

(51) The update-cache for a particular IE is comprised of a list of records, called “CacheLine”, where each record corresponds to one file within the isolated environment. The data structure for “CacheLine” in pseudo code:

(52) Class CacheLine { String m_FileName; String m_Directory; Time m_LastChangeTime; long m_FileSize; int[MD_SIZE] m_MessageDigest; boolean m_CompressionOn; int m_MessageDigestAlgorithm; int m_CompressionAlgorithm;

(53) };

(54) The field “m_FileName” is the name of the file, and m_Directory the directory location of the file. The combination of “m_FileName” and “m_Directory” uniquely identifies the file. The field “m_LastChangeTime” is the time at which the particular file was most recently changed, updated or created, and “m_FileSize” is the size of the file.

(55) To make the update-cache efficient, the present invention pre-computes a “m_MessageDigest” representing the file. The message digest is a 128 bit or longer integer calculated in a manner to ensure that two different files have different message digests. Message Digests are well known within the art. Commonly deployed digests are MD5 (“Message-Digest algorithm 5” of size 128 bit), MD6 (Message-Digest algorithm 6 with sizes up to 512 bits), and SHA-n (Secure Hash Algorithm ‘n’ with sizes up to 1024 bits). The message digest is used as part of the validation to see if a particular file should be streamed to the client. A practical issue is hash collision, where two different files produce the same hash value. SHA-2 has no known hash collisions and is the default in a preferred embodiment. To further reduce the risk of a hash-collision possibly affecting the update-caches, the size of the file (m_FileSize) and the time stamp of the most recent file change (m_LastChangeTime) are also used in the comparing against the update-cache.

(56) All supported Message Digests Algorithms are predefined as integers and the one used encoded in the field ‘m_MessageDigestAlgorithm”.

(57) Another field “m_CompressionOn” determines if compression is used for the particular file corresponding to the CacheLine. Depending on file size, network bandwidth and available CPU cycles, files may selectively be compressed prior to being streamed to the client. All supported compression algorithms are pre-defined as integers and the one used encoded in the field “m_CompressionAlgorithm”. Compression algorithms are provided as part of modern operating systems such as Windows and Linux. In a preferred embodiment, the operating systems default compression algorithm is used. In an alternate embodiment a customized compression algorithm is used. A wide selection of open source and commercial no-loss compression algorithms exists, including but not limited to LZ, LZR, LZX, PKZIP, GZIP and ZIP. In a preferred embodiment, files are automatically compressed if the network operates at less than 1.5 mbit/sec and the file size is greater than 1 MB. In an alternate embodiment every file is compressed. In another alternate embodiment no files are compressed.

(58) Creating and Updating the Update-Cache:

(59) The Havemose reference cited above and included in its entirety, teach creation and updating of isolated environments. The IE's associated update-cache is generated after install/update as follows (in pseudo code)

(60) For each file in the isolated environment

(61) { Identify CacheLine corresponding to file or create a new CacheLine Update CacheLine with { FileName, m_Directory, m_LastChangeTime, m_FileSize Compute message digest: set m_MessageDigest set m_MessageDigestAlgorithm Compute if the file should be compressed: set m_CompressionOn set m_CompressionAlgorithm } Remove any CacheLine entries no longer used

(62) }

(63) When creating a new Isolated Environment and installing applications within the IE, all CacheLines in the update-cache are new. The above listed set of instructions thus creates the update-cache with all new elements.

(64) By way of example, after applying a software patch, the update-cache needs to be updated. A software patch generally modifies, adds and removes files, and the update-cache is updated to reflect the changes. Referring to the pseudo code above: CacheLines corresponding to new files are added, CacheLines corresponding to modified files are re-computed and updated, and CacheLines corresponding to now-deleted files are removed. Files unaffected by the software patch are left unchanged in the update-cache. Similarly the update-caches are updated after a patch to the operating system.

(65) Client Synchronization with the Update-Cache.-Optimized Streaming

(66) Optimized streaming, where the fewest possible files are streamed from the IESS to a client requesting the use or update of a particular isolated environment, is achieved by using of the update-caches on both the client and the IESS

(67) FIG. 8 illustrates by way of example embodiment 280 the optimized streaming process. A client 282 with one IE 284 and its associated update cache 286 (named u-cache on the diagram) is connecting to the IESS with a CPM 288. The client account 290 within the account database contains, as previously disclosed, the account record 290 and the cache management 294 for the update-cache 296 associated with the client account 290 and the particular IE 298

(68) To determine which files within the IE 298 on the IESS have been modified since the client last connected, the Cache Mgr 294 compares the client's u-cache 286 with the corresponding update-cache 296 on the IESS. The entire process is as follows:

(69) Initially, the client and the IE are credentialed against the CPM as previously disclosed 300. The client 302 requests an update of the IE and transmits the client's u-cache to the CPMs cache mgr 304. The CacheMgr's traverses the update-cache one CacheLine at a time 306 and comparing against the u-cache received from the client 302. First test 308 is to see if the current CacheLine is present in the client's u-cache. If the CacheLine is not in the u-cache, it signifies a new file in the IE, and the file corresponding to the CacheLine is prepared to be transmitted to the client 312. If the CacheLine exists in the u-cache, a second test is performed. The second test 310 is to see if the CacheLine entry has been updated when compared to the corresponding u-cache CacheLine. If the IESS CacheLine indicates a change has been made, the file corresponding to the CacheLine is prepared to be transmitted 312 to the client. If the CacheLines are identical in the update cache and u-cache, no further steps on this CacheLine are necessary.

(70) The second test 310 to see if two CacheLine Entries are identical is performed as follows: The client u-cache and the update-cache CacheLines are considered identical if all of the following are identical: m_FileName, m_Directory, m_LastChangeTime, m_FileSize, and m_MessageDigest. If one or more of said fields are different, the entry is deemed not too match.

(71) The final step after identifying a file for transmittal to the client 312 is to test if the file should be compressed 314 per the field in the CacheLine. If the file is to be compressed 316, it's compressed 316 and transmitted 318. If compression is not activated, the file is transmitted 318.

(72) Upon completing the comparison of the client's u-cache with the update-cache 304, the update-cache is sent to the client 320

(73) On the client, all new files are received 322 and copied into the environment 324. Finally, the u-cache is replaced with the update-cache corresponding to the just-completed update 326. The final step is to synchronize the client's new u-cache against the client's IE and remove files no longer included in the u-cache 326. If the client immediately reconnected 300,302 the update process 304 would detect no new files and the update process would be instantaneous.

(74) In continuation of the example above, a typical Microsoft Office security patch modifies few of the 1800 files in full installation of Office. By way of example, if 50 files are modified only those 50 files need to be streamed to the client, corresponding to less than 3% of the total installation. This reduces the ADLS update from 35 minutes to 1 minute, which is a practical delay to install a patch over a slower network.

7. Online and Off-Line Client Operation

(75) The present invention supports two modes of operation: an “off-line” mode of operation where the client runs an already-installed isolated environment without connecting to the IESS, and an “on-line” mode where the client is fully validated and updates automatically are streamed.

(76) By way of example, a user connects with the present invention while at the office, retrieves and updates all credentialed IEs and works with the applications within the IE as if they were locally installed. Later the user is travelling and loads the present invention again. This time the user selects the “off line” mode of operation. In stead of getting credentialed by the IESS, the user simply runs the applications within the already installed IEs. No updates are forced and no changes are streamed. The “off-line” mode allows the user to work without needing network access.

(77) FIG. 6 illustrates by way of example embodiment the user-settings for off-line and on-line operation. If the user checks the “off-line” checkbox 257, the system defaults to off-line mode, while de-selecting the “off-line” checkbox leaves the present invention in on-line mode. Using the underlying operating system, it is easy to detect if there is a network connection available. By way of example this can be achieved by attempting to open an http: connection to a well known web site such as www.yahoo.com or www.whitehouse.gov and process any error messages. If no network connection is found, the IEI is set to “off-line” and the “off-line” checkbox is automatically set. Furthermore, if a network connection is found, but the IESS is unreachable, the off-line mode and the “off-line” checkbox are likewise automatically set.

(78) FIG. 9 illustrates by way of example embodiment 340 the launch procedures for both off-line and on-line modes. The user starts the isolated environment 342 on the client computer. The IEI auto-detects network availability 344 followed by testing the outcome of the auto-detection 346. If no network is available, the IEI enters off-line mode 348 and presents the user with already credentialed IEs available to run 350. The user chooses an IE 351 (also FIG. 6 252) and runs the chosen IE. When finished, the IE terminates 352.

(79) If the network is available on-line mode is enabled 354 and the user can choose to operate in on-line or off-line mode 356. If the user chooses off-line, the user is presented with the list of already credentialed IEs 350 available to run 351. The user chooses an IE 351 and the IE is run. If the user chooses to proceed in on-line mode, the steps outlined in section 5 and FIG. 5 are followed 358, 360. Upon finishing, the IEI exits the IE 352

8. Administration

(80) The present invention provides administration for both clients and the IESS. Administration on the client is a matter of installing the IEI and the user account name; all other administrative options are contained and controlled on the IESS.

(81) FIG. 10 illustrates by way of example embodiment 380 a flow chart of the various administrative options. Administration 382 falls in two broad categories: administration of settings related to a particular user and administrative settings related to all isolated environments. First step is to choose 384 between administration of client settings and the general IESS settings. For client administration 386. If the IEI is not installed on the client device 388, it is installed and the user account info is provided 390. If the client IEI is installed, any updates to the IEI infrastructure is performed 392. This is followed for both cases by general client account administration 394. All information provided in this step is stored in the record for the particular account. For a particular client the administrative options include but are not limited to:

(82) 1. add a new client

(83) 2. remove an existing client

(84) 2. add credentialed IEs for use by the client

(85) 3. remove credentialed IEs for use by the client

(86) 4. force a rebuild of update-cache for one or more of the clients IEs

(87) 5. set client login and account holder name

(88) 6. set status of account (active, not active)

(89) The account information govern the client credentialing processed disclosed above

(90) For general IESS administration 396 the administrative options 398 include but are not limited to:

(91) 1. creation and installation of an isolated environment

(92) 2. removal of an isolated environment

(93) 3. updated/patch software within an isolated environment

(94) 4. rebuild one or more of the update-caches

(95) 5. set the default compression algorithm

(96) 6. set the default message digest algorithm

(97) In a preferred embodiment the administration is performed using a graphical user interface. In an alternate embodiment, as software application programming interface (API) is used.

9. Deployment Scenarios

(98) FIG. 11 illustrates by way of example embodiment 400 a variety of ways the invention can be configured to operate. In one embodiment, the invention is configured with the IESS on a central server 402. Two application servers 404, 406 stream their application from the IESS 402 over the LAN 408. In another embodiment the invention is configured to run on a PC 412 over the LAN 408 streaming IEs from the IESS 402. In a third embodiment, the invention is configured to run on a PC 414 connected via the internet 416 streaming IEs from IESS 402. In a fourth embodiment the invention is configured to stream applications from the IESS 402 onto a cell phone 410 over wireless 418 internet 416. In a firth embodiment a PC 412 on the LAN is running an enterprise application on an application server 404, which is providing the application in an isolated environment streamed from the IESS 402. The invention runs on one or more of the devices, can be distributed across two or more of these elements, and allows for running the invention on any number of the devices (402,404,406,410,412,414) at the same time and without interfering with each other.

(99) The just illustrated example embodiments should not be construed as limiting the scope of the invention but as merely providing illustrations of some of the exemplary embodiments of this invention

10. Conclusion

(100) In the embodiments described herein, an example programming environment was disclosed for which an embodiment of programming according to the invention was taught. It should be appreciated that the present invention can be implemented by one of ordinary skill in the art using different program organizations and structures, different data structures, and of course any desired naming conventions without departing from the teachings herein. In addition, the invention can be ported, or otherwise configured for, use across a wide-range of operating system environments.

(101) Although the description above contains many details, these should not be construed as limiting the scope of the invention but as merely providing illustrations of some of the exemplary embodiments of this invention. Therefore, it will be appreciated that the scope of the present invention fully encompasses other embodiments which may become obvious to those skilled in the art, and that the scope of the present invention is accordingly to be limited by nothing other than the appended claims, in which reference to an element in the singular is not intended to mean “one and only one” unless explicitly so stated, but rather “one or more.” All structural and functional equivalents to the elements of the above-described preferred embodiment that are known to those of ordinary skill in the art are expressly incorporated herein by reference and are intended to be encompassed by the present claims. Moreover, it is not necessary for a device or method to address each and every problem sought to be solved by the present invention, for it to be encompassed by the present claims. Furthermore, no element, component, or method step in the present disclosure is intended to be dedicated to the public regardless of whether the element, component, or method step is explicitly recited in the claims. No claim element herein is to be construed under the provisions of 35 U.S.C. 112, sixth paragraph, unless the element is expressly recited using the phrase “means for.”