NOTICE OF MATERIAL SUBJECT TO COPYRIGHT PROTECTION

A portion of the material in this patent document is subject to copyright protection under the copyright laws of the United States and of other countries. The owner of the copyright rights has no objection to the facsimile reproduction by anyone of the patent document or the patent disclosure, as it appears in the United States Patent and Trademark Office publicly available file or records, but otherwise reserves all copyright rights whatsoever. The copyright owner does not hereby waive any of its rights to have this patent document maintained in secrecy, including without limitation its rights pursuant to 37 C.F.R. § 1.14.

BACKGROUND OF THE INVENTION

1. Field of the Invention

This invention pertains generally to enterprise computer systems, computer networks, embedded computer systems, wireless devices such as cell phones and PDAs, computer systems, and more particularly to methods, systems and procedures (i.e., programming) for providing application isolation for multiple applications running on a host operating system and for providing usage billing for applications running within the isolated environments. The invention further provides application usage billing for applications running within a “cloud computing” or “hosted environment” with or without isolated environments.

2. Description of Related Art

In many environments one of the most important features is to ensure that one running application doesn't affect other running applications, and that the crash of one application doesn't compromise other running applications. In many environments applications share system resources, libraries and hardware, which expose subtle interconnects between seemingly unrelated applications.

Several approaches have been developed addressing this fundamental problem. The first level of application isolation is provided by the operating system. Modern operating systems such as Linux, UNIX, Windows2000, NT, XP and Vista provide some level of application isolation through the use of processes, and the underlying hardware memory management unit. The use of processes generally ensure than one running application process cannot address memory owned by other processes. This first level of isolation does not address the use of shared resources, such as files, file systems, shared memory, and libraries, so other approaches have been developed.

The present invention builds on the teachings in U.S. application Ser. No. 12/813,593 wherein Havemose teaches “SYSTEM AND METHOD FOR APPLICATION ISOLATION WITH LIVE MIGRATION”, now U.S. issued U.S. Pat. No. 8,539,488 issued on Sep. 17, 2013, and U.S. application Ser. No. 12/813,618 wherein Havemose teaches “SYSTEM AND METHOD FOR HIERARCHICAL INTERCEPTION WITH ISOLATED ENVIRONMENTS”, now U.S. issued U.S. Pat. No. 8,464,256 issued on Jun. 11, 2013, collectively identified as “Havemose” throughout the disclosures. Havemose further discloses system and methods for creating isolated environments and for the use of pre-created isolated environment as “installation-free” images that can run on a client without requiring direct application installation on the client. Havemose teaches an approach that works on commodity operating system using off-the-shelf applications. Havemose is incorporated herein by reference in its entirety.

In a “Cloud computing” environment, where resources and applications are dynamically assigned and accessed remotely a related challenge is one of charging for the use of the application. Historically, applications were purchased by a corporation, installed in the company's datacenter and managed by in-house IT staff. With the shift to cloud computing, the applications are hosted somewhere in the internet “cloud” and accessed remotely. The actual end-user or the end-user's IT group are typically not responsible for installing, hosting, and maintaining the application.

A variety of approaches have been designed to manage billing for application use. Historically software was purchased and paid for once and keep updated using an annual maintenance contract. With the move to hosted applications, the hosting provider needs a flexible way to do “usage billing” where the user pays based on actual use patterns. Existing billing-mechanisms are often either fixed one-time licenses as just described, or require custom applications, custom operating systems, or custom hardware.

In U.S. Pat. Nos. 5,047,928 and 5,155,680 Wiedmer teach “Billing System for Computer Software” and “Billing System for Computing Software” respectively. The teachings rely on a combination of algorithms and custom hardware security and billing modules. The billing modules are replaced periodically and the billing information is read from the billing module. In a typical cloud environment requiring custom hardware and replacement of modules to do billing is impractical and not well suited to hosting in a datacenter. Furthermore the teachings do not address usage billing.

In U.S. Pat. No. 5,235,290 Cauffman et al teach “Billing System with Data Indexing”. The teachings describe a pre-processing mechanism to facilitate display, under the control of a service customer, for services rendered to a customer. The teachings do not disclose steps for collection of usage billing information or the use in a cloud computing environment, only a pre-processing step for displaying the results.

In U.S. Pat. No. 5,386,369 Christiano teach “License Metering System for Software Applications”. The teachings rely on a hardware dongle as “metering device” and disclose various techniques to ensure that the application metering data is accurately stored, and cannot easily be lost due to hardware failures. The teachings do not address the actual metering mechanics, the use within the context of cloud computing or application isolation.

In U.S. Pat. No. 5,708,709 Rose teach “System and Method of managing try-and-buy usage of application programs”. The teachings focus on ensuring that a user only can run applications properly licensed using a combination of encryption and verification. The teachings do not address collecting usage billing information or application isolation.

Therefore, in many systems, providing usage billing of hosted applications requires one or more of customized operating systems, customized applications, and proprietary billing infrastructure Furthermore, the above cited references do not include or address application isolation. Hence, there is a need for systems and methods that combine application isolation with usage billing of hosted applications running on commodity operating systems such as Windows and Linux

BRIEF SUMMARY OF THE INVENTION

The present invention provides a system and methods for usage billing of one or more hosted applications. The one or more applications are pre-configured inside one or more isolated environment and the isolated environments are hosted on one or more central servers. The teachings of Havemose work on commodity operating systems, such as Windows and Linux, and work with standard “off the shelf” applications; no customizations of operating system or applications are required, and no virtual machines, virtual file system or any other proprietary protocols are needed. The isolated environments with said one of more applications are accessed remotely or locally and clients can run said one or more applications without ever performing a local installation. Usage billing information is collected for said one or more applications and collected and aggregated for billing purposes. In one embodiment an implementation in the Linux environment is disclosed, in another embodiment an implementation on Windows is disclosed. In yet another embodiment, an implementation of usage billing without isolated environments is disclosed.

Another aspect of the present invention is the fine granularity on which usage billing is provided. Examples include billing based on application time used, application memory used, number of open files, number of transactions, amount of air-time, and a variety of other metrics. Yet another aspect of the present invention is a flexible event driven billing aggregator providing summary billing information for each chosen event type.

Yet other aspects of the present invention are a two-way authentication subsystem and encryption of communication data. The streaming server is authenticated by clients before they accepting any streaming data, and clients likewise are authenticated against pre-defined credentials before the streaming servers delivers any isolated environments or updates.

A user of the client computer can run the application without needing to install or configure the application; the user runs the application as pre-configured and provided on the streaming server. The present teachings require no special virtual file systems, proprietary streaming protocols, or any other proprietary protocols.

Definitions

The terms “Windows” and “Microsoft Windows” is utilized herein interchangeably to designate any and all versions of the Microsoft Windows operating systems. By example, and not limitation, this includes Windows XP, Windows Server 2003, Windows NT, Windows Vista, Windows Server 2008, Windows 7, Windows Mobile, and Windows Embedded.

The terms “Linux” and “UNIX” is utilized herein to designate any and all variants of Linux and UNIX. By example, and not limitation, this includes RedHat Linux, Suse Linux, Ubuntu Linux, HPUX (HP UNIX), and Solaris (Sun UNIX).

The term “node” and “host” are utilized herein interchangeably to designate one or more processors running a single instance of an operating system. A virtual machine, such as VMWare, KVM, or XEN VM instance, is also considered a “node”. Using VM technology, it is possible to have multiple nodes on one physical server.

The terms “application” is utilized to designate a grouping of one or more processes, where each process can consist of one or more threads. Operating systems generally launch an application by creating the application's initial process and letting that initial process run/execute. In the following teachings we often identify the application at launch time with that initial process.

The term “application group” is utilized to designate a grouping of one or more applications.

In the following we use commonly known terms including but not limited to “client”, “server”, “API”, “java”, “process”, “process ID (PID)”, “thread”, “thread ID (TID)”, “thread local storage (TLS)”, “instruction pointer”, “stack”, “kernel”, “kernel module”, “loadable kernel module”, “heap”, “stack”, “files”, “disk”, “CPU”, “CPU registers”, “storage”, “memory”, “memory segments”, “address space”, “semaphore”, “loader”, “system loader”, “system path”, “sockets”, “TCP/IP”, “http”, “ftp”, “Inter-process communication (IPC), “Asynchronous Procedure Calls (APC), “POSIX”,” and “signal”. These terms are well known in the art and thus will not be described in detail herein.

In the following we use commonly known terms from computer security and encryption including, but not limited to “certificate”, “certificate authority”, “Secure Socket Layer”, “SSL”, MD-5”, “MD-6”, “Message Digest”, “SHA”, “Secure Hash Algorithm”, “NSA”, “NIST”, “private key”, “public key”, “key pair”, and “hash collision”. These terms are well known in the art and thus will not be described in detailed herein.

The term “transport” is utilized to designate the connection, mechanism and/or protocols used for communicating across the distributed application. Examples of transport include TCP/IP, Message Passing Interface (MPI), Myrinet, Fibre Channel, ATM, shared memory, DMA, RDMA, system buses, and custom backplanes. In the following, the term “transport driver” is utilized to designate the implementation of the transport. By way of example, the transport driver for TCP/IP would be the local TCP/IP stack running on the host.

The term “interception” is used to designate the mechanism by which an application re-directs a system call or library call to a new implementation. On Linux and other UNIX variants interception is generally achieved by a combination of LD_PRELOAD, wrapper functions, identically named functions resolved earlier in the load process, and changes to the kernel sys_call_table. On Windows, interception can be achieved by modifying a process' Import Address Table and creating Trampoline functions, as documented by “Detours: Binary Interception of Win32 Functions” by Galen Hunt and Doug Brubacher, Microsoft Research July 1999”. Throughout the rest of this document we use the term interception to designate the functionality across all operating systems.

The term “file context” or “context” is used in relation with file operations to designate all relevant file information. By way of example, and not limitation, this includes file name, directory, read/write/append/execute attributes, buffers and other relevant data as required by the operating system.

The term “transparent” is used herein to designate that no modification to the application is required. In other words, the present invention works directly on the application binary without needing any application customization, source code modifications, recompilation, re-linking, special installation, custom agents, or other extensions.

The terms “private and isolated environment” and “isolated environment IE)” are used herein interchangeably to designate the private area set aside for application isolation, as described in Havemose. The abbreviation IE is used to designate an isolated environment on the diagrams and throughout the text.

The Term “Isolated Environment Infrastructure (IEI)” is used herein to designate the entire isolated environment infrastructure as disclosed in Havemose. It's comprised of shared libraries, a series of interceptors and other configuration information is described in the cited reference. Details of IEI will not be further described herein.

The terms “Cloud Computing”, “Software as a service (SaaS)”, “Utility Computing”, and “Hosted Applications” are used herein interchangeably to designate a deployment model where applications are hosted centrally, often off-site, and accessed remotely. Typically, the applications are hosted and managed by an independent company and the end-user pays to access the software services.

The term “usage billing” is used herein to designate that the user of an applications pays to use the application based on one or more metrics. Possible metrics include, but are not limited to: time used, storage used, number of open files, number of records in a database, and number of times the application has been launched.

Further aspects of the invention will be brought out in the following portions of the specification, wherein the detailed description is for the purpose of fully disclosing preferred embodiments of the invention without placing limitations thereon.

