Patent ID: 9483639
Filing Date: 2016-11-01
CPC Classification: G06F

Claim Text:
1. A virtualization method for a host computing device having at least one host processor and system resources including memory divided into most privileged system memory and less privileged user memory, the method comprising: providing an ultraboot application that operates in the less privileged user memory and divides the host computing device into a resource management partition, at least one virtual service partition and at least one virtual guest partition, executing the ultraboot application to divide the host computing device into the resource management partition, the at least one virtual guest partition providing a virtualization environment for at least one guest operating system, the at least one virtual service partition providing a virtualization environment for the basic operations of the virtualization system, and the resource management partition maintaining a resource database for use in managing the use of the at least one host processor and the system resources; building a secure application; executing the secure application in the at least one virtual guest partition, wherein the at least one virtual guest partition is an isolated secure partition, wherein the isolated secure partition includes a security manifest portion for controlling the execution of the secure application within the isolated secure partition, wherein the isolated secure partition includes a secure application operating system (OS) portion that supports only the execution of the secure application within the isolated secure partition, wherein the secure application operating system (OS) portion includes a secure application runtime portion that provides the runtime needed to execute the secure application within the isolated secure partition; maintaining, by a monitor in the most privileged system memory, guest applications in the at least one virtual guest partition within memory space allocated by the at least one virtual service partition to the at least one virtual guest partition; and controlling multitask processing in the partitions on the at least one host processor by a context switch between the at least one monitor and the respective virtual guest partitions and the at least one virtual service partition, wherein the at least one virtual service partition further comprises a plurality of isolated secure partitions isolated from one another, wherein at least one of the isolated secure partitions includes a secure application executing therein and isolated from the other isolated secure partitions, and wherein at least one of the isolated secure partitions includes a primary secure application executing therein and sharing the isolated secure partition with at least one other secure application that is allowed to be executed with the primary secure application within the isolated secure partition.