Method for protecting client and server
View Patent ↗A service provider provides a service to a service user using a client server based system executed in network, such as Internet, Intranet and Extranet. If the service user request a service to the service provider, the service provider installs a protection space within system of the service user and executes programs requested by the service user within the protection space, thereby both the system of the service user and the system of the service provider are securely protected. A software distritution based on distribution of virtual machine makes a user who is not familiar with a computer use the PC in a easy and speedy way.
1. A method for providing at least one client with a service, for which at least one server computer in communication with a computer network is provided, the method performed by the server comprising the steps of:
receiving a request for the service,
creating a protection space within the client through the computer network in response to the request, and
providing the requested service to the protection space while the client is connected to the computer network, wherein providing the requested service comprises network communication with the client executing one or more first computer programs in the protection space;
wherein the protection space created by the server is configured to protect the one or more first computer programs executed by the client in the protection space from one or more second computer programs executed by the client outside of the protection space when the one or more first computer programs are executed by the client in the protection space for providing the service to the client; and
wherein the protection space created by the server is configured to protect the one or more second computer programs executed by the client outside of the protection space from the one or more first computer programs executed by the client in the protection space when the one or more first computer programs are executed by the client in the protection space for providing the service to the client.
2. The method according to claim 1 wherein creating a protection space comprises:
transferring data for creating a virtual machine to the client,
wherein the data is for booting the virtual machine in the client,
wherein the protection space is formed by the virtual machine.
3. The method according to claim 2 wherein the data for creating the virtual machine includes at least part of data for applications required for providing the client with the service.
4. The method according to claim 2 wherein the virtual machine is created by virtualizing an operating system of the client.
5. The method according to claim 4 wherein the virtual machine comprises a layered combination of at least one image selected from the group of an operating system image, an application program template image, a user data image and a temporary data image.
6. The method according to claim 5 wherein the application program template image comprises a pre-installed application program image or a shared library image required for providing the client with the service.
7. The method according to claim 4 wherein virtualizing the operating system of the client comprises virtualizing a memory of a kernel execution unit.
8. The method according to claim 1 wherein the protection space is created by isolating resources of an operating system of the client.
9. The method according to claim 1 , the method further comprising:
providing the client with a client entity verification means, the client entity verification means performing:
verifying whether at least part of the resources, objects or user data from outside of the protection space are secured, and
if secured, allowing at least part of the resources, objects or user data from outside of the protection space to be shared with the protection space.
10. The method according to claim 1 , the method further comprising:
providing the client with a protection space entity verification means, the protection space entity verification means performing:
verifying whether at least part of the resources, objects or user data from inside of the protection space are secured, and
if secured, allowing at least part of the resources, objects or user data from inside of the protection space to be shared with outside of the protection space.
11. The method according to claim 1 wherein the server receives only packets created in the protection space when the server receives packets from the client for the service.
12. The method according to claim 1 , the method further comprising:
verifying integrity of at least part of data traveling between the server and the client.
13. The method of claim 1 wherein said protecting of the one or more first computer programs and the one or more second computer programs is effective for protecting at least one first computer program and at least one second computer program from each other as the at least one first computer program shares a resource with the at least one second computer program in the service being provided to the client.
14. A computer program product for providing at least one client with a service by a server in communication with a computer network, comprising program instructions stored on at least one non-transitory computer readable storage medium which when executed cause a computer to:
receive a request for the service;
create a protection space within the client through the computer network in response to the request; and
provide the requested service to the protection space, wherein providing the requested service comprises network communication with the client executing one or more first computer programs in the protection space;
wherein the protection space created by the server is for protecting the one or more first computer programs executed by the client in the protection space from one or more second computer programs executed by the client outside of the protection space when the one or more first computer programs are executed by the client in the protection space for providing the service to the client; and
wherein the protection space created by the server is for protecting the one or more second computer programs executed by the client outside of the protection space from the one or more first computer programs executed by the client in the protection space when the one or more first computer programs are executed by the client in the protection space for providing the service to the client.
15. The computer program product according to claim 14 further comprising program instructions for:
transferring data for creating a virtual machine to the client;
wherein the data is for booting the virtual machine in the client,
wherein the protection space is formed by the virtual machine.
16. The computer program product of claim 14 wherein said protecting of the one or more first computer programs and the one or more second computer programs is effective for protecting at least one first computer program and at least one second computer program from each other as the at least one first computer program shares a resource with the at least one second computer program in the service being provided to the client.
17. A server for communicating with at least one client over a computer network to provide the client with a service, the server comprising:
a receiver for receiving a request for the service,
a transmitter for transmitting data for creating a protection space to the client through the computer network in response to the request, and
a service provider for providing the requested service to the protection space, wherein providing the requested service comprises network communication with the client executing one or more first computer programs in the protection space;
wherein the protection space created by the server is for protecting the one or more first computer programs executed by the client in the protection space from one or more second computer programs executed by the client outside of the protection space when the one or more first computer programs are executed by the client in the protection space for providing the service to the client; and
wherein the protection space created by the server is for protecting the one or more second computer programs executed by the client outside of the protection space from the one or more first computer programs executed by the client in the protection space when the one or more first computer programs are executed by the client in the protection space for providing the service to the client.
18. The server of claim 17 wherein said protecting of the one or more first computer programs and the one or more second computer programs is effective for protecting at least one first computer program and at least one second computer program from each other as the at least one first computer program shares a resource with the at least one second computer program in the service being provided to the client.