On-demand disposable virtual work system
An on-demand disposable virtual work system that includes: a virtual machine monitor to host virtual machines, a virtual machine pool manager, a host operating system, a host program permissions list, and a request handler module. The virtual machine pool manager manages virtual machine resources. The host operating system interfaces with a user and virtual machines created with an image of a reference operating system. The host program permissions list may be a black list and/or a white list used to indicate allowable programs. The request handler module allows execution of the program if the program is allowable. If the program is not allowable, the host request handler module: denies program execution and urges a virtual machine specified by the virtual machine pool manager to execute the program. The virtual machine is terminated when the program closes.
1. A non-transitory processor-readable medium storing code representing instructions to be executed by a processor, the code comprising code to cause the processor to:
intercept, at a host request handler, an execution request to execute an application on a host operating system;
redirect the execution request to a dispatcher;
compare, using the dispatcher, the execution request with a permissions list;
determine, using the dispatcher and in response to receiving the execution request, that the application does not have permission to execute on the host operating system without isolation and that the application is required to run on a virtual machine remote from the processor, based on the comparing; and
send, in response to the determining, an invocation call to a guest operating system within a virtual machine remote from the processor to initiate execution of the application in the virtual machine if a guest program permissions list unique to the virtual machine indicates that the application has permission to execute in the virtual machine.
2. The non-transitory processor-readable medium of claim 1 , further comprising code to cause the processor to:
send a signal to the guest operating system to deny execution of the application in the virtual machine if the guest program permissions list indicates that the application does not have permission to execute in the virtual machine.
3. The non-transitory processor-readable medium of claim 1 , further comprising code to cause the processor to:
send the execution request to a guest request handler implemented in the virtual machine, the code to cause the processor to send the invocation call to the guest operating system includes code to cause the processor to send the invocation call from the guest request handler.
4. The non-transitory processor-readable medium of claim 1 , wherein the permissions list includes applications that are not capable of accessing a network.
5. The non-transitory processor-readable medium of claim 1 , wherein the guest program permissions list is a first guest program permissions list, and the virtual machine is a first virtual machine remote from the processor, the code further comprising code to cause the processor to:
select, in response to the application not having permission to execute on the host operating system without isolation, the first virtual machine for execution of the application based on a second guest program permissions list unique to a second virtual machine remote from the processor not indicating that the application has permission to execute in the second virtual machine.
6. An apparatus, comprising:
a memory; and
a processor operatively coupled to the memory,
the processor configured to intercept an execution request to execute an application on a host operating system, the processor configured to determine, in response to the execution request, that the application is a protected application and does not have permission to execute on the host operating system without isolation,
the processor configured to initiate the application within a virtual machine remote from the processor in response to an identifier of the application being included on a list unique to the virtual machine indicating which applications are allowed to operate within the virtual machine.
7. The apparatus of claim 6 , wherein the processor is configured to compare the execution request with a permissions list, and the initiation of the application within the virtual machine is based on the comparing.
8. The apparatus of claim 6 , wherein the processor is configured to determine that the application is a protected application based on the application requesting network access.
9. The apparatus of claim 6 , wherein the processor is configured to determine that the application is a protected application based on an identifier of the application not being included on a list indicating which applications are allowed to operate on the host operating system without isolation.
10. The apparatus of claim 6 , wherein the host operating system is a first type of operating system, the processor is configured to initiate the application within the virtual machine such that the virtual machine executes the application within a guest operating system, the guest operating system is a second type of operating system different from the first type of operating system.
11. The apparatus of claim 6 , wherein the processor is configured to determine that the application is a protected application based on an identifier of the application being included on a list indicating which applications are not allowed to operate on the host operating system without isolation.
12. The apparatus of claim 6 , wherein the processor is configured to determine that the application is a protected application based on a type of the application.
13. The apparatus of claim 6 , wherein the processor is configured to select the virtual machine from a plurality of virtual machines remote from the processor based on a type associated with the application.
14. The apparatus of claim 6 , wherein the application is a first application and the virtual machine is a first virtual machine remote from the processor,
the processor is configured to intercept a request to execute a second application on the host operating system,
the processor configured to determine, in response to the request to execute the second application, that the second application is a protected application and does not have permission to execute on the host operating system without isolation,
the processor configured to initiate the second application within a second virtual machine remote from the processor in response to an identifier of the second application not being on the list unique to the first virtual machine indicating which applications are allowed to operate within the first virtual machine.
15. The apparatus of claim 6 , wherein the list is a first list and the virtual machine is a first virtual machine remote from the processor, the processor configured to:
determine that the application is a protected application based on an identifier of the application not being included on a host list indicating which applications are allowed to operate on the host operating system without isolation
select, in response to determining the application to be a protected application, the first virtual machine for the initiation of the application based on the identifier of the application being excluded from a second list unique to a second virtual machine remote from the processor indicating which applications are allowed to operate within the second virtual machine.
16. A non-transitory processor-readable medium storing code representing instructions to be executed by a processor, the code comprising code to cause the processor to:
intercept an execution request to execute an application on a host operating system;
determine, in response to the execution request, that the application is a protected application and does not have permission to execute on the host operating system without isolation;
identify, in response to the determining, a virtual machine remote from the processor and configured to run the application; and
send, in response to the determining, an invocation call to the virtual machine to execute the application on the virtual machine.
17. The non-transitory processor-readable medium of claim 16 , wherein the code further comprises code to cause the processor to:
compare the execution request with a permissions list associated with the virtual machine; and
determine, based on the comparing, that the application has permission to execute in the virtual machine, the sending the invocation call being in response to the determining that the application has permission to execute in the virtual machine.
18. The non-transitory processor-readable medium of claim 16 , wherein the code to cause the processor to determine that the application is a protected application includes code to cause the processor to determine that the application is a protected application based on the application requesting network access.
19. The non-transitory processor-readable medium of claim 16 , wherein the code to cause the processor to determine that the application is a protected application includes code to cause the processor to determine that the application is a protected application based on an identifier of the application not being included on a list indicating which applications are allowed to operate on the host operating system without isolation.
20. The non-transitory processor-readable medium of claim 16 , wherein the host operating system is a first type of operating system,
the code to cause the processor to send includes code to cause the processor to send the invocation call to the virtual machine to execute the application such that the virtual machine executes the application within a guest operating system, the guest operating system is a second type of operating system different from the first type of operating system.
21. The non-transitory processor-readable medium of claim 16 , wherein the code to cause the processor to determine that the application is a protected application includes code to cause the processor to determine that the application is a protected application based on an identifier of the application being included on a list indicating which applications are not allowed to operate on the host operating system without isolation.
22. The non-transitory processor-readable medium of claim 16 , wherein the code to cause the processor to determine that the application is a protected application includes code to cause the processor to determine that the application is a protected application based on a type of the application.
23. The non-transitory processor-readable medium of claim 16 , wherein the virtual machine is a first virtual machine remote from the processor, the code further comprising code to cause the processor to:
identify, in response to the determining that the application is a protected application, a second virtual machine remote from the processor and configured to run the application;
select the first virtual machine for executing the application based on an identifier of the application being included on a first list unique to the first virtual machine indicating which applications are allowed to operate within the first virtual machine, and the identifier of the application being excluded from a second list unique to the second virtual machine remote from the processor and indicating which applications are allowed to operate within the second virtual machine.