Systems and methods for service isolation
The present invention is directed towards systems and methods of streaming an application from a remote location to a local machine system, and using local machine system resources in executing that application. In various embodiments, services needed by a streamed application may be started with high local system privileges in their own isolation environment. These service may be started, stopped, and otherwise managed by a Service Control Manager. In order for an application to both access services that operate at high local system privileges and the network so that it can access remotely stored, streaming, information; a streaming application may rely on privileges of the user when accessing network information rather than the higher privileges of the services running in isolation.
1. A method, comprising:
sending, by a local machine, a request to stream an application;
receiving, by the local machine, an access information file including access information for accessing a plurality of application files and for executing a first client;
retrieving an identification of the plurality of application files, responsive to the access information file;
receiving, by the local machine, information identifying whether the application requires the use of a service with greater security privilege levels than those available to the user of the local machine;
determining that the application requires use of the service and that the service needs to be isolated;
creating, by the local machine responsive to the determination, an isolation environment with security privilege levels greater than those available to the application; and
starting the service as an isolated service in the isolation environment with security privilege levels greater than those available to the application.
2. The method of claim 1 , further comprising the step of using credentials or a token with a different security privilege level than that of the isolation environment for isolated services to access information unavailable to services running with security privilege levels of the isolation environment for isolated services.
3. The method of claim 1 , wherein receiving information identifying whether the application requires the use of services with greater security privilege levels than those available to the user of the local machine includes receiving at least one of mapping information, profiling information, or information identifying services as isolated services.
4. The method of claim 1 , where the starting of isolated services occurs after an application is launched and the application requests a service that is determined to be an isolated service.
5. The method of claim 1 , further comprising the step of deleting all the isolated services.
6. The method of claim 1 , wherein starting an isolated service occurs upon startup or reboot of the local machine.
7. The method of claim 1 , wherein an isolated service is started in its own sandbox.
8. The method of claim 1 , where creating an isolation environment is accomplished through the use of a Service Control Manager.
9. The method of claim 8 , wherein the Service Control Manager initiates, manages, starts, stops, pauses, or deletes an isolated service.
10. The method of claim 8 , wherein the Service Control Manager determines whether a particular service should be isolated.
11. A system comprising:
a local machine communicatively connected to a network;
an environment on the local machine configured to run a streamed application from the network; and
a Service Control Manager (SCM) configured to determine that the streamed application requires use of a service that requires greater security privilege levels than those available and needs to be isolated, wherein the SCM creates, responsive to the determination, an isolation environment on the local machine with security privilege levels greater than those available to the environment running the streamed application and starts the service as an isolated service in the isolation environment.
12. The system of claim 11 , further comprising storage on the network for information identifying whether an application requires the use of services with greater security privilege levels than those available to the user of a local machine.
13. The system of claim 11 , wherein the isolation environment further comprises sandboxes for each isolated service.
14. The system of claim 11 , wherein the local machine comprises storage for isolated services information.
15. A system comprising:
means for sending, by a local machine, a request to stream an application;
means for receiving, by the local machine, an access information file including access information for accessing a plurality of application files and for executing a first client;
means for retrieving an identification of the plurality of application files, responsive to the access information file;
means for receiving, by the local machine, information identifying whether the application requires the use of a service with greater security privilege levels than those available to the user of the local machine;
means for determining that the application requires use of the service and that the service needs to be isolated;
means for creating, by the local machine responsive to the determination, an isolation environment with security privilege levels greater than those available to the application; and
means for starting the service as an isolated service in the isolation environment with security privilege levels greater than those available to the application.
16. The system of claim 15 , further comprising means for using credentials or a token with a different security privilege level than that of the isolation environment for isolated services to access information unavailable to services running with security privilege levels of the isolation environment for isolated services.
17. The system of claim 15 , further comprising means for receiving information identifying whether the application requires the use of services with greater security privilege levels than those available to the user of the local machine where said information includes receiving at least one of mapping information, profiling information, or information identifying services as isolated services.
18. The system of claim 15 , further comprising means for starting isolated services after an application has launched and the application requests a service that is determined to be an isolated service.
19. The system of claim 15 , further comprising means for deleting all the isolated services.