摘要:
A method for moving an executing process from a source isolation scope to a target isolation scope includes the step of determining that the process is in a state suitable for moving. The association of the process changes from a source isolation scope to a target isolation scope. A rule loads in association with the target isolation scope.
摘要:
In a method for accessing, by application programs, resources provided by an operating system, a process receives a request for a resource and an identifier associated with the resource. It is determined that the requested resource resides inside an application isolation environment. The request for the resource and the identifier associated with the resource is redirected to the application isolation environment. The request for the resource is responded to using an instance of the resource residing inside the application isolation environment.
摘要:
In a method for accessing resources provided by an operating system, a request for a resource is received by an application program executing inside an environment. A first identifier associated with the resource is acquired. A registry is consulted, responsive to an association between a first identifier associated with the resource and a second identifier associated with the resource, the association associated with the environment. The resource and an environment on which to launch the resource are identified, responsive to consulting the registry. The second identifier is associated with the resource, with the environment, and with the environment on which to launch the resource. A registry key for the resource is stored in the registry, the registry key comprising the second identifier. The request for the resource is redirected to the identified instance of the resource, responsive to the second identifier. The request for the resource is responded to using the instance of the resource located in the environment on which the resource resides. The requested resource is launched in the identified environment, responsive to the second identifier.
摘要:
A method for moving an executing process from a source isolation scope to a target isolation scope includes the step of determining that the process is in a state suitable for moving. The association of the process changes from a source isolation scope to a target isolation scope. A rule loads in association with the target isolation scope.
摘要:
In a method for accessing, by application programs, resources provided by an operating system, a process receives a request for a resource and an identifier associated with the resource. It is determined that the requested resource resides in a location outside the application isolation environment. The request for the resource and the identifier associated with the resource is redirected to the determined location. The request for the resource is responded to using an instance of the resource residing in the determined location.
摘要:
A method for moving an executing process from a source isolation scope to a target isolation scope includes the step of determining that the process is in a state suitable for moving. The association of the process changes from a source isolation scope to a target isolation scope. A rule loads in association with the target isolation scope.
摘要:
The present solution reduces the attack surface of a server by selectively opening a server port for listening when a client has been authenticated/authorized via another machine or process, and directed to connect to the server in question. When not selectively listening on a port, the server does not listen or open ports for connections or otherwise minimizes the number of open ports. By selectively listening for connections, the server reduces the opportunity for hackers to attack the server process, and improves the security of the server. The ability to selectively listen on a port at specific times may be combined with additional meta information—like ticketing and prior authentication information to help further secure the server. The meta information may identify and ensure that only the correct remote endpoint is allowed to connect via the port. Instead of first listening for connections and then authenticate and authorize the received connection as with typical servers, the present solution first authenticates/authorizes a connection via another machine or process, then listens for an expected and authorized connection.
摘要:
A method for providing access to a computing environment includes the step of receiving, by a broker machine, a request from a client machine for access to a computing environment, the request including an identification of a user of the client machine. One of a plurality of virtual machines is identified by a session management component, the identified virtual machine providing the requested computing environment. One of a plurality of execution machines is identified, the identified execution machine providing a terminal services session in which a hypervisor executes to provide access to hardware resources required by the identified virtual machine. The hypervisor launches the identified virtual machine. A connection is established between the client machine and the identified virtual machine, via the terminal services session.
摘要:
The present solution reduces the attack surface of a server by selectively opening a server port for listening when a client has been authenticated/authorized via another machine or process, and directed to connect to the server in question. When not selectively listening on a port, the server does not listen or open ports for connections or otherwise minimizes the number of open ports. By selectively listening for connections, the server reduces the opportunity for hackers to attack the server process, and improves the security of the server. The ability to selectively listen on a port at specific times may be combined with additional meta information—like ticketing and prior authentication information to help further secure the server. The meta information may identify and ensure that only the correct remote endpoint is allowed to connect via the port. Instead of first listening for connections and then authenticate and authorize the received connection as with typical servers, the present solution first authenticates/authorizes a connection via another machine or process, then listens for an expected and authorized connection.