EXHIBIT 3 

Case 2:24-cv-00093-JRG Document 114-3 Filed 12/19/24 Page 1 of 22 PageID #:

6121
US010606634B1 

United States Patent 

Havemose 

( 10 ) Patent No .: US 10,606,634 B1 

( 45 ) Date of Patent : Mar. 31 , 2020 

( 54 ) SYSTEM AND METHOD FOR APPLICATION 

ISOLATION 

( 58 ) Field of Classification Search 

None 

See application file for complete search history . ( 71 ) Applicant : OPEN INVENTION NETWORK 

LLC , Durham , NC ( US ) ( 56 ) References Cited 

( 72 ) Inventor : Allan Havemose , Arroyo Grande , CA 

( US ) U.S. PATENT DOCUMENTS 

( 73 ) Assignee : OPEN INVENTION NETWORK 

LLC , Durham , NC ( US ) 

763,308 A 

5,774,660 A 

5,951,650 A 

5,996,016 A 

6,021,408 A 

6,026,499 A 

6/1904 Mitchell 

6/1998 Brendel et al . 9/1999 Bell et al . 11/1999 Thalheimer et al . 2/2000 Ledain et al . 2/2000 Shirakihara et al . 

( Continued ) 

( * ) Notice : Subject to any disclaimer , the term of this 

patent is extended or adjusted under 35 

U.S.C. 154 ( b ) by 0 days . 

( 21 ) Appl . No .: 16 / 278,659 OTHER PUBLICATIONS 

( 22 ) Filed : Feb. 18 , 2019 Karablieh et al .; “ Heterogeneous Checkpointing for Multithread 

Applications ” , IEEE 21st Symposium on Reliable Distributed Sys 

tems , Oct. 13-16 , 2002 , pp . 140-149 . ( Continued ) 

Primary Examiner — Qing Yuan Wu 

Related U.S. Application Data 

( 63 ) Continuation of application No. 15 / 641,300 , filed on 

Jul . 4 , 2017 , now Pat . No. 10,210,017 , which is a 

continuation of application No. 15 / 149,518 , filed on 

May 9 , 2016 , now Pat . No. 9,697,038 , which is a 

continuation of application No. 14 / 606,175 , filed on 

Jan. 27 , 2015 , now Pat . No. 9,336,045 , which is a 

continuation of application No. 13 / 708,477 , filed on 

Dec. 7 , 2012 , now Pat . No. 8,943,500 , which is a 

continuation of application No. 12 / 421,691 , filed on 

Apr. 10 , 2009 , now Pat . No. 8,341,631 . 

( 57 ) ABSTRACT 

( 51 ) Int . Ci . G06F 9/46 ( 2006.01 ) 

GO6F 8/61 ( 2018.01 ) 

GOOF 9/50 ( 2006.01 ) 

G06F 9/455 ( 2018.01 ) G06F 11/00 ( 2006.01 ) 

( 52 ) U.S. CI . CPC G06F 9/46 ( 2013.01 ) ; G06F 8/61 ( 2013.01 ) ; G06F 8/62 ( 2013.01 ) ; G06F 9/455 ( 2013.01 ) ; G06F 9/50 ( 2013.01 ) ; G06F 11/008 

( 2013.01 ) 

A system , method , and computer readable medium for providing application isolation to one or more applications and their associated resources . The system may include one 

or more isolated environments including application files 

and executables , and one or more interception layers inter cepting access to system resources and interfaces . Further , the system may include an interception database maintaining mapping between the system resources inside the one or 

more isolated environments and outside , and a host operat ing system . The one or more applications may be isolated from other applications and the host operating system while 

running within the one or more isolated environments . 

20 Claims , 10 Drawing Sheets 

40 

42 50 58 46 54 44 

Reg./Open Resource Create .. Installing Running Application 

" AppXYZ 

Use Resource Use + Interception Layer Interception 

Database ( DB ) Free . Resource Inactive 

48 56 

60 62 64 

Public C : \ Program Files \ AppDir Pdvate : D : private AppXYZICI Program Files AppDir 

Global Exceptions FileServer : 

Installing and running an Application 

Case 2:24-cv-00093-JRG Document 114-3 Filed 12/19/24 Page 2 of 22 PageID #:

6122
US 10,606,634 B1 

Page 2 

( 56 ) References Cited 

U.S. PATENT DOCUMENTS 

6,085,086 A 

6,105,148 A 

6,144,999 A 

6,154,877 A 

6,161,219 A 

6,167,385 A 

6,189,111 B1 

6,269,442 B1 

6,314,567 B1 

6,321,275 B1 

6,484,276 B1 

6,496,847 B1 

6,496,979 B1 

6,560,626 B1 

6,574,618 B2 

6,601,081 B1 

6,715,238 B2 

6,718,538 B1 

6,766,314 B2 

6,795,966 B1 

6,823,474 B2 

6,941,281 B1 

6,964,034 B1 

7,028,305 B2 

7,058,696 B1 

7,076,555 B1 

7,089,294 B1 

7,093,086 B1 

7,096,388 B2 

7,127,713 B2 

7,197,700 B2 

7,207,039 B2 

7,213,246 B1 

7,246,256 B2 

7,257,811 B2 

7,269,645 B2 

7,353,203 B1 

7,363,365 B2 

7,370,071 B2 

7,380,087 B2 * 

7/2000 Porta et al . 8/2000 Chung et al . 11/2000 Khalidi et al . 11/2000 Ramkumar et al . 12/2000 Ramkumar et al . 12/2000 Hartley - Urquhart 2/2001 Alexander et al . 7/2001 Oberhauser et al . 11/2001 Oberhauser et al . 11/2001 McQuistan et al . 11/2002 Singh et al . 12/2002 Bugnion et al . 12/2002 Chen et al . 5/2003 Hogle et al . 6/2003 Eylon et al . 7/2003 Provino et al . 4/2004 Zambelli et al . 4/2004 Mathiske 

7/2004 Burnett 

9/2004 Lim et al . 11/2004 Kampe et al . 9/2005 Johnson 

11/2005 Snow 

4/2006 Schaefer 

6/2006 Phillips et al . 7/2006 Orman et al . 8/2006 Baskey et al . 8/2006 Rietschote 

8/2006 Singh et al . 10/2006 Davis et al . 3/2007 Honda et al . 4/2007 Komarla et al . 5/2007 Rietschote et al . 7/2007 Cruz et al . 8/2007 Hunt et al . 9/2007 Goh et al . 4/2008 Kriplani et al . 4/2008 Ocko et al . 5/2008 Greschler et al . 5/2008 Johnson G06F 16/10 

711/170 

11/2008 Smith et al . 12/2008 Proudler et al . 3/2009 Munetoh 

4/2009 Blaser et al . 4/2009 Qiao et al . 6/2009 Branda et al . 11/2009 Scaralata 

3/2010 McMillan et al . 4/2010 Prasse et al . 5/2010 Vertes et al . 7/2010 Travostino et al . 11/2011 Budko et al . 1/2012 Fresko et al . 5/2012 Nord et al . 9/2014 Holler et al . 1/2002 Kampe et al . 3/2002 Yuan 

7/2002 Meth 

9/2002 Aiken et al . 11/2002 Jean et al . 11/2002 Schmidt 

1/2003 Sheikholeslam et al . 1/2003 Gadir et al . 2/2003 DeMent et al . 4/2003 Na et al . 7/2003 Rosensteel et al . 7/2003 Lawrance et al . 3/2004 Song et al . 4/2004 Browne et al . 8/2004 Nixon et al . 10/2004 Esfahany 12/2004 Koch et al . 3/2005 Mukherjee et al . 3/2005 N. et al . 

2005/0172082 A1 

2005/0213498 A1 

2005/0251785 A1 

2005/0262097 A1 

2005/0262411 Al 

2005/0268273 Al 

2005/0278688 Al 

2006/0015764 A1 

2006/0031547 A1 

2006/0053228 A1 

2006/0075381 A1 

2006/0080411 A1 

2006/0085679 Al 

2006/0090097 A1 

2006/0143512 Al 

2006/0156403 A1 

2006/0206873 A1 

2006/0262716 A1 

2006/0262734 A1 

2007/0007336 A1 

2007/0028110 A1 

2007/0028302 Al 

2007/0028303 A1 

2007/0028304 Al 

2007/0083501 Al 

2007/0083522 Al 

2007/0083610 A1 

2007/0083655 A1 

2007/0107052 A1 

2007/0156659 Al 

2007/0174191 A1 

2007/0192518 A1 

2007/0244987 A1 

2007/0248085 A1 

2007/0255653 Al 

2007/0260733 A1 

2007/0277056 A1 

2007/0294578 A1 

2008/0098006 A1 

2008/0104441 A1 

2008/0154769 A1 

2008/0195824 A1 

2008/0295114 A1 

2008/0301760 A1 

2009/0089406 Al 

2009/0228576 A1 

2009/0254900 A1 

2009/0271787 Al 

2009/0310663 A1 

2009/0313363 A1 

2010/0023996 A1 

2010/0107158 Al 

2010/0268667 A1 

2011/0119748 A1 

2011/0208908 Al 

2012/0054486 A1 

2013/0054484 Al 

2013/0204664 A1 

2013/0226688 A1 

2014/0032298 A1 

2014/0032307 Al 

2014/0032308 Al 

2014/0032309 Al 

2014/0032310 Al 

2014/0058804 A1 

2014/0143120 Al 

2014/0164049 Al 

2014/0171039 Al 

2014/0244486 Al 

2014/0279682 A1 

2014/0304137 Al 

2014/0316823 Al 

2014/0351116 Al 

8/2005 Liu et al . 9/2005 Appanna et al . 11/2005 Vertes et al . 

11/2005 Sim - Tang et al . 11/2005 Vertes et al . 12/2005 Fresko et al . 12/2005 Buskens et al . 1/2006 Ocko et al . 2/2006 Tsui et al . 3/2006 Rachman et al . 4/2006 Laborczfalvi et al . 4/2006 Buskens et al . 4/2006 Neary et al . 4/2006 Ngan et al . 6/2006 Jia et al . 7/2006 Haeffele et al . 9/2006 Argade 

11/2006 Ramaiah et al . 11/2006 Appanna et al . 1/2007 Kindberg 2/2007 Brennan 

2/2007 Brennan et al . 2/2007 Brennan 

2/2007 Brennan 

4/2007 Pedersen et al . 4/2007 Nord et al . 4/2007 Treder et al . 4/2007 Pedersen 

5/2007 Cangini et al . 7/2007 Lim 

7/2007 Keaton et al . 8/2007 Rupanagunta et al . 10/2007 Pedersen et al . 10/2007 Volpano 11/2007 Tumminaro et al . 11/2007 Havemose et al . 

11/2007 Varadarajan et al . 12/2007 Qiao et al . 4/2008 Pedersen et al . 

5/2008 Rao et al . 6/2008 Anderson et al . 8/2008 Sadovsky et al . 11/2008 Argade et al . 12/2008 Lim 

4/2009 Roush et al . 9/2009 Rosenan et al . 10/2009 Nakamura 

10/2009 Clark 

12/2009 Menon et al . 12/2009 Parsons et al . 1/2010 Sabin et al . 4/2010 Chen et al . 

10/2010 King et al . 5/2011 Edwards et al . 8/2011 Chou et al . 3/2012 Lakkavalli et al . 2/2013 Hoeflinger et al . 8/2013 Romagnolo et al . 8/2013 Harvilicz et al . 1/2014 Corrie et al . 1/2014 Corrie et al . 

1/2014 Corrie et al . 1/2014 Corrie et al . 1/2014 Corrie et al . 2/2014 Zhou et al . 5/2014 Clarke et al . 6/2014 Yakos et al . 6/2014 Bjontegard 8/2014 Abril 

9/2014 Feldman 

10/2014 Olson et al . 10/2014 Cooper 

11/2014 Hoff 

7,447,896 B2 

7,467,370 B2 

7,512,815 B1 

7,519,963 B1 

7,523,344 B2 

7,543,182 B2 

7,613,921 B2 

7,673,308 B2 

7,694,123 B2 

7,725,763 B2 

7,761,573 B2 

8,065,714 B2 

8,104,085 B2 

8,171,483 B2 

8,831,995 B2 

2002/0007468 Al 

2002/0038277 A1 

2002/0087916 A1 

2002/0124089 A1 

2002/0169884 Al 

2002/0174265 Al 

2003/0010272 Al 

2003/0018927 Al 

2003/0028635 Al 

2003/0069993 A1 

2003/0140041 A1 

2003/0140272 A1 

2004/0044721 A1 

2004/0064398 A1 

2004/0153700 A1 

2004/0210895 A1 

2004/0268175 A1 

2005/0050304 Al 

2005/0071824 Al 

Case 2:24-cv-00093-JRG Document 114-3 Filed 12/19/24 Page 3 of 22 PageID #:

6123
US 10,606,634 B1 

Page 3 

( 56 ) References Cited 

U.S. PATENT DOCUMENTS 

2014/0358766 Al 

2015/0351116 A1 

12/2014 Nayyar et al . 12/2015 Shoshan et al . 

OTHER PUBLICATIONS 

Medina , “ Understanding AIE to Citrix Presentation Server 4 ” , May 

12 , 2005 , Tech Target . Nam et al . , “ Probabilistic Checkpointing " , IEICE Trans . Inf . & 

Syst . , vol . E85 - D , No. 7 , Jul . 2002 , pp . 1093-1104 . Sancho et al . , “ On the Feasibility of Incremental Checkpointing for Scientific Computing ” , Proceedings of the 18th International Par allel and Distributed Processing Symposium , Apr. 2004 , 10 Pages . 

* cited by examiner 

Case 2:24-cv-00093-JRG Document 114-3 Filed 12/19/24 Page 4 of 22 PageID #:

6124
U.S. Patent Mar. 31 , 2020 Sheet 1 of 10 US 10,606,634 B1 

10 

24 

22 26 28 

12 

System / Node 

Memory 14 

Application A Application B 

16 

17 Interception 

Database 

18 ( IDB ) Interception Layer ( IL ) Interception Layer ( IL ) 

20 System Libraries 

Operating System 

32 34 30 

36 

Storage Network 1/0 1 or more 

CPUs 

38 

FIG.1 - System Overview 

Case 2:24-cv-00093-JRG Document 114-3 Filed 12/19/24 Page 5 of 22 PageID #:

6125
U.S. Patent Mar. 31 , 2020 Sheet 2 of 10 US 10,606,634 B1 

40 

42 50 58 

46 52 54 44 

Req./Open Resource Create 

Use Resource Use 

Installing / 

Running 

Application 

" AppXYZ " 

Interception 

Layer 

Interception 

Database 

( IDB ) Free . Resource Inactive 

48 56 

60 62 64 

Public 

C : \ Program Files \ AppDir 

Private : 

D : \ private AppXYZICI 

Program Files \ AppDir 

Global Exceptions 

FileServer : 

FIG.2 - Installing and running an Application 

Case 2:24-cv-00093-JRG Document 114-3 Filed 12/19/24 Page 6 of 22 PageID #:

6126
U.S. Patent Mar. 31 , 2020 Sheet 3 of 10 US 10,606,634 B1 

80 

82 86 90 

84 88 

Open / Use / Close Resource Use 

Uninstalling 

Application 

" AppXYZ " 

Interception 

Layer 

Interception 

Database 

( IDB ) exit ( ) exito 

92 94 

96 98 

Public 

C : \ Program Files \ AppDir DB Mapping 

Private : 

D : \ private AppXYZICI 

Program Files \ AppDir 

100 

FIG.3 -Un - Installing an Application 

Case 2:24-cv-00093-JRG Document 114-3 Filed 12/19/24 Page 7 of 22 PageID #:

6127
U.S. Patent Mar. 31 , 2020 Sheet 4 of 10 US 10,606,634 B1 

120 126 

122 

? 

124 

Interception Database ( IDB ) 

130 

* Core rules 

* Base Directory for private and isolated applications * Global exceptions Rules Engine 

132 

Resource Mapping 

136 138 

134 

Public Private Global Exceptions 

Files Files Files 

Fonts Fonts Fonts 

Shares libraries Shares libraries Shares libraries 

Shared Resources Shared Resources Shared Resources 

Windows Registry Windows Registry Windows Registry 

Etc. Etc. Etc. 

FIG.4 - Interception Database ( IDB ) 

Case 2:24-cv-00093-JRG Document 114-3 Filed 12/19/24 Page 8 of 22 PageID #:

6128
U.S. Patent Mar. 31 , 2020 Sheet 5 of 10 US 10,606,634 B1 

140 

142 

Application Group 

143 144 146 

App - 1 App - 2 App - ' n ' 

148 

Interception 

Layer 

154 152 

150 

Public Private : Global 

Exceptions 

Interception 

Database 

( IDB ) 

FIG.5 - Application Groups 

TE 

Case 2:24-cv-00093-JRG Document 114-3 Filed 12/19/24 Page 9 of 22 PageID #:

6129
U.S. Patent Mar. 31 , 2020 Sheet 6 of 10 US 10,606,634 B1 

160 

162 166 170 

Application Group Application Group Application Group 

A B C 

164 168 172 

Interception 

Layer 

Interception 

Layer 

Interception 

Layer 

178 

176 

174 

Public Private : Global 

Exceptions 00 Interception 

Database 

( IDB ) 

FIG.6 - Multiple Application Groups 

Case 2:24-cv-00093-JRG Document 114-3 Filed 12/19/24 Page 10 of 22 PageID #:

6130
U.S. Patent Mar. 31 , 2020 Sheet 7 of 10 US 10,606,634 B1 

180 

181 

Installation 186 188 

182 

Public 184 Private : Global 

Exceptions 

Application Group Install 

Interception 

Database 

( IDB ) 

196 

190 192 194 

196 197 198 Public 

Private 

Excp . 

Public 

Private 

Excp . 

Public 

Private 

Excp . 

FIG.7 - Installation free deployment 

Case 2:24-cv-00093-JRG Document 114-3 Filed 12/19/24 Page 11 of 22 PageID #:

6131
U.S. Patent Mar. 31 , 2020 Sheet 8 of 10 US 10,606,634 B1 

200 

202 

204 206 

203 Public Private : Global 

Exceptions Global Settings : 

Location of isolated 

environment Global exceptions Interception 

Database 

( IDB ) 

205 Application 1 - Logical application name - changes storage - custom resource exceptions 

Application 2 : 

208 

FIG.8 - Administration 

Case 2:24-cv-00093-JRG Document 114-3 Filed 12/19/24 Page 12 of 22 PageID #:

6132
U.S. Patent Mar. 31 , 2020 Sheet 9 of 10 US 10,606,634 B1 

220 

224 226 222 

Central File Server Server Server © 

238 og 

236 

228 

Internet 

232 

PC on LAN 

230 234 

Cell 

phone 

PC on Internet 

Fig . 9 - Deployment scenarios 

Case 2:24-cv-00093-JRG Document 114-3 Filed 12/19/24 Page 13 of 22 PageID #:

6133
U.S. Patent Mar. 31 , 2020 Sheet 10 of 10 US 10,606,634 B1 

240 

242 

Application 

“ AppXYZ " 244 

Write a 

243 

246 

248 System Libraries 

250 Operating System 

251 Storage 

252 262 264 

Application 

“ AppXYZ " 254 256 

Write a 253 Interception 

Layer 

Interception 

Database 

( IDB ) 

266 268 

266 

258 Public System Libraries Private : Global 

Exceptions 

260 Operating System 

Storage 261 TI 

FIG.10 – Detailed control and dataflow 

Case 2:24-cv-00093-JRG Document 114-3 Filed 12/19/24 Page 14 of 22 PageID #:

6134
1 

10 

US 10,606,634 B1 

2 

SYSTEM AND METHOD FOR APPLICATION No. 6,496,847 does not provide isolation at the level of 

ISOLATION individual applications , but for entire operating systems with 

all the applications within it . It does not address the problem 

STATEMENT REGARDING FEDERALLY of application isolation with multiple natively running appli 

SPONSORED RESEARCH OR DEVELOPMENT 5 cations on one host computer . In U.S. Pat . No. 6,601,081 Provino et al . teach the use of 

Not Applicable a virtual machine for a plurality of application programs . As 

with U.S. Pat . No. 6,496,847 the use of a VM subsystem INCORPORATION - BY - REFERENCE OF simply moves the problem to a different layer , and does not 

MATERIAL SUBMITTED ON A COMPACT address the fundamental issue of application isolation with 

DISC several natively running applications on one host computer . In U.S. Pat . No. 7,028,305 Schaefer teaches a system for Not Applicable creating an application protection layer to separate an appli cation from the host operating system . Shaefer primarily NOTICE OF MATERIAL SUBJECT TO teaches how to intercept the Windows registry to capture COPYRIGHT PROTECTION configuration information for Windows application and how 

A portion of the material in this patent document is subject to create a virtual operating environment for the application . to copyright protection under the copyright laws of the Access to files is provided via a virtual file system , access to 

United States and of other countries . The owner of the 20 registry information via the virtual registry etc. For Unix and 

copyright rights has no objection to the facsimile reproduc MacOS few specific teachings are presented . tion by anyone of the patent document or the patent disclo The present invention provides a system , method , and 

sure , as it appears in the United States Patent and Trademark computer readable medium to create an application isolation 

Office publicly available file or records , but otherwise environment where applications can run unmodified , on 

reserves all copyright rights whatsoever . The copyright 25 un - modified operating systems without requiring any virtual 

owner does not hereby waive any of its rights to have this environments , virtual machines or virtual machine monitors . patent document maintained in secrecy , including without The present invention also teaches how to manage and 

limitation its rights pursuant to 37 C.F.R. § 1.14 . handle applications that share libraries and resources , and how to handle complex multi - process applications . In one 

BACKGROUND OF THE INVENTION 30 embodiment an implementation in the Linux environment is described , in another embodiment an implementation on 

1. Field of the Invention Windows is described . 

15 

This invention pertains generally to enterprise computer BRIEF SUMMARY OF THE INVENTION 

systems , computer networks , embedded computer systems , 35 

wireless devices such as cell phones , computer systems , and A method , system , apparatus and / or computer program 

more particularly to methods , systems and procedures ( i.e. , are described for achieving application isolation for single programming ) for providing application isolation for mul and multi - process applications and their associated 

tiple applications running on a host operating system . resources . The application isolation is provided without 

40 requiring any changes to the host operating system kernel or 

2. Description of Related Art requiring any changes to the applications . The application isolation is fully transparent to both operating system and 

In many environments one of the most important features application and automatically adjusts for resources such as 

is to ensure that one running application doesn't affect other memory , storage , and CPUs being allocated and released . running applications , and that the crash of one application 45 The application isolation is provided in an interception layer doesn't compromise other running applications . In many interposed between the individual applications and the oper environments applications share system resources , libraries ating system and an interception database . Preferably , any and hardware , which exposes subtle interconnects between functional changes to system calls are done exclusively seemingly unrelated applications . within the interception layer and interception database , and 

Several approaches have been developed addressing this 50 only in the context of the calling application . fundamental problem . The first level of application isolation Another aspect of the present invention relates to a is provided by the operating system . Modern operating method and a computer readable medium comprising 

systems such as Linux , UNIX , Windows2000 , NT , XP and instructions for application and application group isolation . Vista provide some level of application isolation through the The instructions are for installing the applications into the 

use of processes , and the underlying hardware memory 55 isolated environment , running the application in the isolated 

management unit . The use of processes generally ensure that environment , un - installing applications from the isolated 

one running application process cannot address memory environment , configuring the isolated environments , and 

owned and used by other processes . This first level of deploying the isolated environments . isolation does not address the use of shared resources , such Yet another aspect of the invention relates to a system for 

as files , file systems , shared memory , and libraries , so other 60 providing application isolation to one or more applications , approaches have been developed the system comprising : one or more isolated environments 

In U.S. Pat . No. 6,496,847 Bugnion et al . teach the use of including application files and executables ; one or more 

a virtual machine monitor ( VMM ) with a protected host interception layers intercepting access to system resources operating system ( HOS ) . This invention partially solves the and interfaces ; an interception database maintaining map isolation problem by placing every application into its own 65 ping between the system resources inside the one or more 

VMM . The solution requires the use of a VMM subsystem isolated environments and outside ; and a host operating and in some cases a customized operating system . U.S. Pat . system , wherein the one or more applications are isolated 

Case 2:24-cv-00093-JRG Document 114-3 Filed 12/19/24 Page 15 of 22 PageID #:

6135
5 

US 10,606,634 B1 

3 4 

from other applications and the host operating system while The term " file context ” or “ context ” is used in relation 

running within the one or more isolated environments . with file operations to designate all relevant file information . By way of example , and not limitation , this includes file 

Definitions name , directory , read / write / append / execute attributes , buf fers and other relevant data as required by the operating 

The terms “ Windows ” and “ Microsoft Windows ” are system . 

utilized herein interchangeably to designate any and all The term “ transparent ” is used herein to designate that no 

versions of the Microsoft Windows operating systems . By modification to the application is required . In other words , the present invention works directly on the application example , and not limitation , this includes Windows XP , binary without needing any application customization , Windows Server 2003 , Windows NT , Windows Vista , Win- 10 source code modifications , recompilation , re - linking , special dows Server 2008 , Windows Mobile , and Windows Embed installation , custom agents , or other extensions . ded . The terms “ private and isolated environment ” and “ iso 

The terms “ Linux ” and “ UNIX ” are utilized herein to lated environment are used herein interchangeably to des 

designate any and all variants of Linux and UNIX . By ignate the private area set aside for application isolation , as 

15 described in further detail below . example , and not limitation , this includes RedHat Linux , Suse Linux , Ubuntu Linux , HPUX ( HP Unix ) , and Solaris The present invention provides application isolation at 

several levels : 1 ) during installation , all installation and ( Sun Unix ) . registration information is intercepted and installation is The term “ node " and " host " are utilized herein to desig re - directed to a private and isolated environment , 2 ) during nate one or more processors running a single instance of an 20 launch of an application the installation information is operating system . A virtual machine , such as VMWare or retrieved and provided to the application again via intercep 

XEN VM instance , is also considered a “ node ” . Using VM tion , and 3 ) during access to external resources interception technology , it is possible to have multiple nodes on one of all access is re - directed as necessary . The combination of 

physical server . all levels of isolation provides for fully transparent applica The terms “ application ” is utilized to designate a grouping 25 tion isolation . Thus at all times , access to resources , con of one or more processes , where each process can consist of figuration and run - time information is intercepted and redi rected . one or more threads . Operating systems generally launch an application by creating the application's initial process and By way of example , and not limitation , for embodiments 

letting that initial process run / execute . In the following within Windows operating systems , access to the Windows teachings we often identify the application at launch time 30 Registry is intercepted and included in the application isolation . with that initial process . Further aspects of the invention will be brought out in the The term “ application group ” is utilized to designate a following portions of the specification , wherein the detailed grouping of one or more applications . description is for the purpose of fully disclosing preferred In the following we use commonly known terms includ embodiments of the invention without placing limitations ing but not limited to " process ” , “ process ID ( PID ) ” , 35 thereon . “ thread ” , “ thread ID ( TID ) ” , “ thread local storage ( TLS ) ” , “ instruction pointer ” , “ stack ” , “ kernel ” , “ kernel module ” , BRIEF DESCRIPTION OF THE SEVERAL 

" loadable kernel module ” , “ heap ” , “ stack ” , “ files ” , “ disk ” , VIEWS OF THE DRAWING ( S ) “ CPU ” , “ CPU registers ” , “ storage ” , “ memory ” , “ memory 

segments " , " address space ” , “ semaphore ” , “ loader ” , “ sys- 40 The invention will be more fully understood by reference 

tem loader ” , “ system path ” , and “ signal ” . These terms are to the following drawings which are for illustrative purposes well known in the art and thus will not be described in detail only : 

herein . FIG . 1 is a block diagram of the core system architecture The term “ transport ” is utilized to designate the connec showing two applications , the interception layer , and the 

tion , mechanism and / or protocols used for communicating 45 interception database . across the distributed application . Examples of transport FIG . 2 is a block diagram illustrating installation and include TCP / IP , Message Passing Interface ( MPI ) , Myrinet , running of applications Fibre Channel , ATM , shared memory , DMA , RDMA , sys FIG . 3 is a block diagram illustrating un - installation 

tem buses , and custom backplanes . In the following , the FIG . 4 is a block diagram illustrating the Interception term “ transport driver " is utilized to designate the imple- 50 Database 

mentation of the transport . By way of example , the transport FIG . 5 is a block diagram illustrating running application driver for TCP / IP would be the local TCP / IP stack running groups 

on the host . FIG . 6 is a block diagram illustrating running multiple The term “ interception ” is used to designate the mecha application groups concurrently nism by which an application re - directs a system call or 55 FIG . 7. is a block diagram illustrating installation - free library call to a new implementation . On Linux and other deployment UNIX variants interception is generally achieved by a FIG . 8. is a block diagram illustrating administration 

combination of LD_PRELOAD , wrapper functions , identi FIG . 9 is a block diagram illustrating various deployment cally named functions resolved earlier in the load process , scenarios 

and changes to the kernel sys_call_table . On Windows , 60 FIG . 10 is a block diagram illustrating interception data interception can be achieved by modifying a process ’ Import and control flow 

Address Table and creating Trampoline functions , as docu 

mented by “ Detours : Binary Interception of Win32 Func DETAILED DESCRIPTION OF THE 

tions ” by Galen Hunt and Doug Brubacher , Microsoft INVENTION 

Research July 1999 ” . Throughout the rest of this document 65 

we use the term to designate the functionality across all Referring more specifically to the drawings , for illustra operating systems . tive purposes the present invention will be described in 

Case 2:24-cv-00093-JRG Document 114-3 Filed 12/19/24 Page 16 of 22 PageID #:

6136
a 

15 

US 10,606,634 B1 

5 6 

relation to FIG . 1 through FIG . 10. It will be appreciated that private and isolated environment in 

the system and apparatus of the invention may vary as to DAprivate \ App XYZ \ C \ Program Files \ AppDir . The IDB 58 

configuration and as to details of the constituent compo returns 54 the private resource to IL 50 , which returns the 

nents , and that the method may vary as to the specific steps resource handle 46 to the application 42. As the application and sequence , without departing from the basic concepts as 5 42 uses the resource 46 it operates under the assumption that 

disclosed herein . the original resource request was satisfied , and is unaware 

that all resources have been relocated to a private and 

1. Introduction isolated environment . When use of the resource is termi 

nated 48 , the IL 50 sends a message to the IDB 58 that the 

The context in which this invention is described is one or 10 resource currently is inactive 56. All mappings are main 

more applications being installed , running and accessing tained in the IDB 58 after the installation finishes as they local and remote resources . Without affecting the general may be needed after the initial request . case of multiple applications , the following scenarios often FIG . 2 also illus es , by way of example embodiment 

depict and describe one or two applications as applicable . 40 , how an application 42 runs after being installed . As 

Multiple applications are handled in a similar manner . resources are opened , used , and freed , the same steps as 

described above are used . As the application 42 executes , it 

2. Overview generally access or create resources not used during instal 

lation . By way of example , if AppXYZ 42 is a word 

FIG . 1 illustrates by way of example embodiment 10 the processor , the user may create a document and save it to 

overall structure of the present invention . The following 20 storage . That document did not exist as part of the installa brief overview illustrates the high - level relationship tion process , but is handled using the same mechanisms 

between the various components ; further details on the inner previously taught . As the user choose to create a new workings and interdependencies are provided in the follow document , AppXYZ 42 makes a request 44 to have the file 

ing sections . FIG . 1. Illustrates by way of example embodi created . This is intercepted by the IL 50 and forwarded 52 

ment 10 two applications A 22 and B 26 loaded in memory 25 to the IDB 58. The IDB creates a mapping between the 14 on a node 12. The interception layers 16 , 17 , are Applications 42s public document name 60 , and the private interposed between the applications 22 , 26 and the system and isolated document name 62. As with Application 42 

libraries 18 and operating system 20. The interception information stored in the IDB 58 , so is the application data 

database 28 provides system - wide persistent interception information stored persistently until un - installation . information and configuration information for the isolated 30 At times it may be desirable to store some user - data 

environments . The interception layers 16,17 combined with outside the isolated environment , such as on a central file 

the Interception database 28 provides application isolation server . In a preferred embodiment , this is supported by 24. System resources , such as CPUs 36 , 1/0 devices 34 , specifying which resource locations should remain fixed and 

Network interfaces 32 and storage 30 are accessed using the public in the global exceptions 64. Such public resources are 

operating system . Devices accessing remote resources use 35 not translated into the isolated environment . some form of transport network 38. By way of example , system networking 32 may use TCP / IP over Ethernet trans 4. Uninstalling Applications 

port , Storage 32 may use Fibre Channel or Ethernet trans 

port , and I / O may use USB . The present invention access FIG . 3 illustrates by way of example embodiment 80 , and arbitrate resources through the operating system and 40 un - installation of a typical application AppXYZ 82. The 

does not work at the transport level . un - installation uses and requests resources 84 , which are intercepted by the IL 86 and redirected 88 by the IDB 90 , as 3. Installing and Running Applications described above . All actions , such as deletion of files , are 

re - directed to the private and isolated location . When the 

FIG . 2 illustrates by way of example embodiment 40 45 un - install terminates , sometimes called exit ( ) , the exit is installation of a typical application “ AppXYZ ” 42. The intercepted 92 by the IL 86 , and forwarded 94 to the IDB 90 . Interception Layer ( IL ) 50 intercepts all calls to system The IDB 90 removes all entries mapping 100 application libraries and the operating system . IL 50 communicates with AppXYZ 82 resources 96 against its isolated environment 

the Interception Database ( IDB ) 58 to create a private and 98. The application is now uninstalled , and all isolation 

isolated environment where the application can execute 50 information has been removed . without depending on or affecting other parts of the envi 

ronment . By way of example , and not limitation , first the 5. Interception Database and Resource Mapping installation process requests a resource 44 , such as opening 

a file . The resource request is intercepted by IL 50 and a The Interception Database ( IDB ) is a system wide data 

request to create 54 a private instance of the resource is 55 base containing mappings between the resources as the made to the Interception Database ( IDB ) 58. The IDB 58 is application requests them , and their private values inside the 

a system wide database containing mappings 60 , 62 , 64 isolated environment . FIG . 4 illustrates , by way of example between the resources as the application 42 requests them embodiment 120 , the Interception Database ( IDB ) 122 , and 

60 , and their private values inside the isolated environment its various components . The IBD 122 contains two main 

62 , subject to global exceptions 64. Further details on the 60 components , a rules engine 130 and the core resource 

IDB are given in section 4 below . By way of example , and mappings 132. The rules engine 130 contains the main 

not limitation , if the resource request 44 was to create a file high - level configuration information 124 as provided by an 

in CAProgram Files \ AppDir , the IDB may map that to a administrator 126. The rules engine 130 and its configura private location 62 , such as D : \ private AppXYZ C Program tion information 124 includes , but is not limited to , infor Files \ AppDir . So while AppXYZ 42 operates under the 65 mation designating the base directory for installing the 

assumption that it's working on CAProgram Files \ AppDir , isolated environment , specific exceptions 138 to the 

in reality all access has been intercepted and re - directed to resource mappings and the general mechanism used to 

Case 2:24-cv-00093-JRG Document 114-3 Filed 12/19/24 Page 17 of 22 PageID #:

6137
US 10,606,634 B1 

7 8 

create the mappings . The administrator 126 defines excep subject to the automatic enumeration as the application tions 138 as needed . The global exceptions contain all knows where to look for its application - specific fonts . resources that should not be remapped to the isolated Modern operating systems share components across mul 

environments . Examples include , but are not limited to , tiple applications . Such shared libraries also pose a special shared storage , shared devices , network resources , and sys- 5 case . On Windows Dynamic Link Libraries ( DLLs ) and on 

tem - wide resources . Linux / UNIX shared objects ( .so files ) are examples of such The resource mapping 132 maintains mapping between shared components . On Window shared libraries primarily public resources 134 and the corresponding private and reside in C : \ Windows and CAWindows \ System32 , but can 

isolated resources 136. The resource mapping 132 also sit anywhere . On Linux / Unix the primary locations are 

consults the global exceptions 138 prior to translating any 10 / usr / lib ' , / usr / X11 / lib ' and the entire / usr / lib / directory public to private or private to public resource requests . structure . The loader of the operating system traverses the 

Resources take many forms including but not limited to system PATH to find any requested shared library , but this files , fonts , shared libraries , shared devices , and storage . On can be manually or programmatically changed as part of the Microsoft Windows the Registry is an important component load process . The PATH is set using environment variables 

and contains system wide configuration information used by 15 both on Windows and Linux . In order to intercept loading of 

most applications . Some resources , such as data files , tend to shares libraries the present invention loads the application in 

be local to the individual applications , while e.g. fonts tend stead of using the system loader directly . This enables 

to be shared between multiple applications . interception of library loading done by the loader . If during 

Access to files are handled by the IL ( FIGS . 2-50 ) installation additional shared libraries are installed , they are intercepting all file operations between the application and 20 installed according to the policy chosen by the administrator 

the system libraries and operating systems . Examples 126. Prior to installation , the administrator chooses if appli include , but are not limited to open ( ) , fopen ( ) , write ( ) , cation - installed libraries are allowed to be placed in a global read ( ) , close ( ) , seek ( ) , remove ( ) and the Windows directory or if they should be placed in the private and 

equivalents . Generally these functions either contain a pub isolated environment . If the libraries are placed into the 

lic file name as part of the arguments , or a file handle to an 25 private and isolated environment , the load PATH is adjusted already established file . The files names are remapped as to search the private location . described above , to an isolated environment , and any further As with files , libraries can be loaded with both absolute 

reference to the handle is automatically re - directed to the and relative addresses . The load process handles the 

isolated environment . File operations that return informa resource mapping as described above . In all cases , the 

tion , are translate back to the public values . By way of 30 loading must follow the same path and address resolution as 

example , and not limitation , if the applications ask for the system loader provides . " current directory ” , the public name , as the application If the application installs its shared libraries into its own 

expects is returned , and not the private name within the file structure , the libraries are treated as normal files and are 

isolated environment . By way of further example , if the not subject to an adjusted PATH or load - order as the 

current directory is located on shared storage included the 35 application knows where to look for its application - specific global exceptions 138 , the directory is returned un - trans libraries . In the preferred embodiment , if the application lated , as it's subject to the exception handling . installs new shared libraries , they are installed into the 

File , paths and other resource names can be specified both isolated environment 

as absolute values or relative values . By way of example , One of the most significant sources of application incom 

and not limitation , an absolute path for a document file may 40 patibilities , and one of the motivators for the present inven be " C : MyDocuments \ myfile.doc " , while a relative refer tion , is shared library conflict . By way of example , and not 

ence may be “ ... \ docs \ myfile.doc ” . Absolute references are limitation , if a shared library is loaded on the system , and a 

resolved as previously described by consulting the public new application installs an older version of the library , the 

resources 134 , private resources 136 and global exceptions older version may overwrite the newer version and render 

138. Relative addresses are resolved in a multi - step process : 45 other applications non - functional based on having their First relative names are converted to absolute names and shared library replaced by an incompatible older version . then the absolute name is converted as previously described . This is a common problem on both the Windows and Linux This mechanism ensures fully transparent support of both platforms . Using the preferred embodiment described 

absolute and relative naming of all resources . above , the application would install the older library into its 

Fonts pose particular problems , as fonts reside both in 50 isolated environment and therefore not affect other applica application - specific directories and global system directo tions . The application would load and use the older library ries , such as " C : \ Windows \ Fonts ” on Windows and " / usr / without ever being aware that it was provided from the 

X11R6 / lib / X11 / fonts / ” and “ / usr / share / fonts / " on Linux . An isolated environment , and other applications running on the 

application may install font both into one or more global font system would be unaffected by the installation of the older 

directories as well as application - specific directories . All 55 library . shared - fonts directories are included in the Global Excep Microsoft Windows uses a special configuration system tions 138 as they should be accessed directly . If during generally referred to as “ the Registry ” . The registry contains 

installation additional fonts are installed , they are installed configuration , installation and un - installation information according to the policy chosen by the administrator 126 . for applications on the system . When an application installs 

Prior to installation , the administrator chooses if application- 60 on a Windows system , it uses the registry to store values installed fonts are allowed to be placed in the global fonts such as “ home directory ” , “ recent files ” , etc. The preferred directory or if they should be placed in the isolated envi embodiment on Windows systems additionally include 

ronment . The rules engine 130 consults this administrative interception of all registry information , and ensures that 

choice and upon receiving a request to enumerate the font installation and runtime information that would normally go directory will include isolated - environment fonts if so con- 65 into the registry , in stead is stored and maintained in the figured . If the application installs its fonts into its own file IDB . During installation of a Windows application all reg 

structure , the fonts are treated as normal files and are not istry information is thus stored in the IDB and not the 

Case 2:24-cv-00093-JRG Document 114-3 Filed 12/19/24 Page 18 of 22 PageID #:

6138
US 10,606,634 B1 

9 10 

registry . When an application requests registry information , passing 268 the call on to the system library implementation the information is provided from the IDB , and not the 258. The following fwrite ( ) operation is unaware that the 

registry . This ensures complete application isolation from file pointer points to the isolated environment and simply the registry . writes the data . Finally , fclose ( ) is called to close the file . The isolated environment contains all application files and 5 The file pointer still points to the isolated environment and shared resources and their respective mappings . These are the close proceeds as a close would without the present all preserved persistently on local or remote storage and can invention active . be archived , copied and restored as any other set of files . Specifically , the isolated environment directory structure can 7. Application Groups be copied to a different node , and used directly to start the 10 

application on that node . At times multiple applications share data , libraries and 

So far the Interception database has been described as a work in combination . By way of example , and not limita 

" database ” . Based on the teachings above , it's readily appar tion , Microsoft Word may include a Microsoft Excel spread ent to anyone skilled in the art , that the only requirement is sheet . In general any number of applications may need to 

that updates to the resource tables 134 , 136 and 138 be 15 collaborate and share data . So far the approach has been to atomic at the record level . This functionality can be readily isolate applications so that , to continue the example , if Word implemented in a variety of ways , including using Java's and Excel were installed separately , they would both be 

ConcurrentHashMap ( ) , the Windows .NET equivalents , or isolated and not able to work together . To enable sharing by custom programming the data structures and locking . between pre - designated applications , the applications need 

Furthermore , preferably concurrent access to the Intercep- 20 to be grouped together in an application group and installed tion Database translations is provided . In an alternate imple inside the same isolated environment . FIG . 5 illustrates by mentation such a custom interception database is used in way of example embodiment 140 , an application group 142 

stead of a full database . operating within the present invention . The administrator 

152 pre - defines the application group 142 and the individual 6. Interception Data and Control Flow 25 applications within the group : App - 1 143 , App - 2 144 and 

App - n 146. The administrator 152 commits the application FIG . 10 illustrates by way of example embodiment 240 group to the IDB 150. The IDB uses the same mechanisms 

the data and control flow in more detail . By way of example , as described above for individual applications , and struc 

and not limitation , consider first an environment with the tures the isolated environment 154 so that the individual present invention inactive . An application 242 calls a 30 applications share resources and file system . By installing write ( ) 243 operation . The write operation is resolved by the the applications together they automatically use the same 

operating system loader and directed 244 to the system isolated environment and sharing is fully automatic without libraries 248 and operating system and ultimately requiring any additional information . The interception layer writes data to storage 251. Return value is returned 246 to 148 intercepts , as previously described , and requires no the caller 243 within the calling application 242 . 35 special configuration ; all application group information is 

By way of example , and not limitation , consider an contained within the IDB 150 and the settings for the 

environment with the present invention active . An applica isolated environment 154 . tion 252 calls a write ( 253 operation . As described in 

above , the write ( ) is intercepted 254 by the interception 8. Concurrent Operation of Multiple Application layer 262. Parameters to the write ( ) call are translated by the 40 Groups Interception Database 264 and the rules for the isolated 

environment 266 and the file context and parameters of the FIG . 6 illustrates by way of example embodiment 160 , calling write are adjusted to point to the isolated environ concurrent operation of three application groups : application ment . The write call 268 is then forwarded to the system group A 162 , application group B 166 and application group libraries 258 and operating system 260 as were the case with 45 C 170. Each application group consists of one or more the present invention inactive . The return value 266 from the applications . As previously described each application group write is returned to the IL 262 which , using the IDB 264 , has a dedicated interception layer : IL 164 for application 

maps the result back into the original context and returns the group A 162 , IL 168 for application group B 166 , and IL 172 

value 256 to the caller 253. The application 252 issuing the for application group C 170. Each interception layer 164 , write 253 operating is thus unaware that the write is being 50 168 , 172 provide the interception services as previously intercepted and re - directed to the isolated environment . All described , with each attached to only one application group . translation and isolation is performed outside the application As previously disclosed , the Interception Database 174 is 

252 , and before the write operation ever reaches the system global , and is shared between all application groups and libraries 258 or operating system 260 . interception layers . A specific example , using ANSI C , further illustrates the 55 The administrator 176 commits all administrative settings mechanics of the IL 262 and IDB 264 translations . Consider to the IDB 174 , which is reflected in the database tables for 

an example where a file is opened for writing , a small text the isolated environment 178 . is written , and the file is closed using the following code int main ( void ) { char const * pStr = “ small text ” ; FILE * fp = fopen 9. Running Multiple Concurrent Instances of One 

( " /home/user/newfile.txt ” , “ w ” ) if ( fp ! = null ) fwrite ( pStr , 60 Application 

strlen ( pStr ) , 1 , fp ) ; fclose ( fp ) } The call to fopen ( returns a file pointer , which the At times it may be desirable to run multiple instances of fwrite ( operation uses to write data to the file . The call to the same application or application group , but in separate fopen ( ) includes the file name “ /home/user/newfile.txt " as isolated environments . Referring again to FIG . 6 for illus the first parameter . The Interception Layer 262 intercepts the 65 trative purposes . The administrator 176 defines each 

call to fopen ( ) and changes the actual filename to the instance of the application group using separate application corresponding location in the isolated environment before group names . Even though Application Group A 162 , Appli 

Case 2:24-cv-00093-JRG Document 114-3 Filed 12/19/24 Page 19 of 22 PageID #:

6139
5 

15 

US 10,606,634 B1 

11 12 

cation Group B 166 , and Application Group C 170 are application basis . As determined by the administrator , identical , they have been pre - defined with their own envi examples of administrator - provided application - level con 

ronment , and thus run in separate isolated environments figuration information 205 include , but is not limited to 

without any further intervention or configuration . Storage location for isolated environment Logical name of application or application group 10. Installation - Free Deployment Application or application - group specific resource excep 

tions 

One of the major problems with application deployment Policy for installing fonts and shared resources into global is the actual installation and the associated risks as described or isolated environment 

previously . Using the present invention , a pre - created iso- 10 The combination of the global configuration information 

lated environment can be used in place of performing an 203 with the rules engine ( FIG . 4 130 ) , makes the con 

actual installation . The isolated environment contains all figuration and deployment on new isolated environment 

application files , shared libraries , and installation data and fully automatic after the initial global configuration has been 

can be moved , copied and run from anywhere the present provided . As described , it may be desirable to change one or invention is present . more of an application’s isolated environment settings . By FIG . 7 illustrates by way of example embodiment 180 , way of example , and not limitation , if a particular applica how to deploy an isolated environment without needing tion needs to locally access certain resources only available 

more than one initial installation 181. First the administrator on a particular server , that one application’s isolated envi 196 installs 184 the application group 182. As previously ronment would be located on that particular server , while all 

taught the interception database 186 creates an isolated 20 other environments were centrally stored . The ability to environment 188 which contains all application group data , “ mix and match ” environments and deployments ensure full including shared files , data and programs . As taught above , flexibility and ability to deploy multiple applications in a 

the isolated environment is written to storage and can be heterogeneous environment with all the benefits of the copied and run elsewhere . With the isolated environment present invention . ensuring isolation from the underlying operating system and 25 In another embodiment the administrative functions 202 applications , an isolated environment can be deployed on a is done programmatically using an Application Program different node by copying the entire isolated environment ming Interface ( API ) . directory structure to the new node and starting the appli cation . Referring to FIG . 7 , the administrator 196 copies the 12. Deployment Scenarios 

isolated environment 188 into the first node 190 , the second 30 

node 192 and the third node 194 . FIG . 9 illustrates by way of example embodiment 220 a 

In an alternate embodiment , the environment 188 is stored variety of ways the invention can be configured to operate . on shared storage , and is accessed directly from the shared In one embodiment , the invention is configured to run from 

storage . In this embodiment , the isolated environment is a central file server 222 , in another it is configured to run on 

loaded directly from shared storage , and only local data , 35 a pair of application servers 224 , 226. In a third embodiment such as temporary files , are kept locally . the invention is configured to run on a LAN 228 connected 

In another embodiment , the environment 188 is saved to PC 232 together with the application servers 224 , 226 , and 

storage and shipped to a remote site . The remote site loads with environments loaded from the central file server 222. In 

the environment and runs the applications directly from a fourth embodiment the invention is configured to isolate within the environment without any installations . In this 40 applications on a cell phone 230 , which is wirelessly con 

embodiment the present invention may be used for disaster nected 238 to the Internet 236 , the application servers 

recovery . 224,226 and the file server 222. A fifth embodiment has an 

isolated environment on a home - PC 234 connected via the 

11. Administration internet 236 to the application servers 224,226 and the LAN 

45 PC 232. The invention runs on one or more of the devices , FIG . 8 illustrates by way of example embodiment 200 , the can be distributed across two or more of these elements , and 

management infrastructure . The administrator 202 commu allows for running the invention on any number of the 

nicates configuration preferences to the Interception data devices ( 222,224,226,230,232,234 ) at the same time 

base 204 for each isolated environment 206. The IDB 204 contains , as described above , two separate modules : 1 ) a 50 13. Conclusion 

rules engine ( FIGS . 4—130 ) and 2 ) management of the 

resource mappings ( FIG . 4—132 ) . The rules engine imple In the embodiments described herein , an example pro 

ments the administrator provided resource translations and gramming environment was described for which an embodi 

populates the tables ( FIG . 4—134,136,138 ) . ment of programming according to the invention was taught . The administrator 202 provides general configuration 55 It should be appreciated that the present invention can be information applicable to all isolated environments and implemented by one of ordinary skill in the art using applications 203 , unless explicitly changed for a particular different program organizations and structures , different data 

isolated environment 205. Examples of administrator - pro structures , and of course any desired naming conventions vided global configuration information 203 includes , but is without departing from the teachings herein . In addition , the 

not limited to 60 invention can be ported , or otherwise configured for , use 

Default storage location for all isolated environments across a wide - range of operating system environments . Default resource exceptions Although the description above contains many details , Default application and application group naming these should not be construed as limiting the scope of the 

Default policy for installing fonts and shared resources invention but as merely providing illustrations of some of 

into global or isolated environment 65 the exemplary embodiments of this invention . Therefore , it Each setting can be changed , i.e. replaced , on an appli will be appreciated that the scope of the present invention 

cation by application basis , and on an application - group by fully encompasses other embodiments which may become 

Case 2:24-cv-00093-JRG Document 114-3 Filed 12/19/24 Page 20 of 22 PageID #:

6140
5 

20 

25 

US 10,606,634 B1 

13 14 

obvious to those skilled in the art , and that the scope of the 9. The system according to claim 1 , wherein each of the 

present invention is accordingly to be limited by nothing one or more applications is installed into its own isolated 

other than the appended claims , in which reference to an environment . element in the singular is not intended to mean “ one and 10. The system according to claim 1 , wherein two or more 

only one ” unless explicitly so stated , but rather “ one or applications are installed into a shared isolated environment . more . ” All structural and functional equivalents to the ele 11. The system according to claim 10 , wherein the two or ments of the above - described preferred embodiment that are more applications share resources inside the shared isolated known to those of ordinary skill in the art are expressly environment . incorporated herein by reference and are intended to be 12. The system according to claim 1 , wherein two or more encompassed by the present claims . Moreover , it is not 10 applications are installed into separate isolated environ necessary for a device or method to address each and every problem sought to be solved by the present invention , for it ments and the one or more applications run concurrently in 

to be encompassed by the present claims . Furthermore , no the separate isolated environments . element , component , or method step in the present disclo 13. The system according to claim 1 , wherein a first 

sure is intended to be dedicated to the public regardless of 15 application of the one or more applications is installed twice 

whether the element , component , or method step is explic into separate isolated environments , and the separate iso 

itly recited in the claims . No claim element herein is to be lated environments run concurrently and independently . construed under the provisions of 35 U.S.C. 112 , sixth 14. A method , comprising : 

paragraph , unless the element is expressly recited using the creating one or more isolated environments during instal 

phrase “ means for . " lation of one or more applications ; 

What is claimed is : maintaining a mapping between a resource as requested 1. A system , comprising : by the one or more applications and the corresponding 

one or more central processing units ; resource inside said isolated environments , wherein 

one or more isolated environments including one or more said mapping is created or updated during one or more applications ; and of installing an application in an isolated environment , one or more resource mappings between resources as running said application in said isolated environment , requested by the one or more applications and the or accessing a resource corresponding to said resource corresponding resources inside said isolated environ mapping ; and 

ments ; uninstalling an application of the one or more applica wherein the one or more central processing units and the 30 tions , wherein said uninstalling comprises one or more one or more isolated environments are configured to of removing at least one of said mappings , uninstalling interact with each other ; 

wherein a resource mapping for an application is created said application , and removing isolated environment 

or updated during one or more of installing said appli information from storage . cation in an isolated environment , running said appli- 35 15. The method of claim 14 comprising intercepting 

cation in said isolated environment , or accessing a access to system resources and interfaces at one or more 

resource corresponding to said resource mapping ; and interception layers . 

wherein a resource mapping for an application is removed 16. The method of claim 14 comprising updating the one 

or updated during one or more of uninstalling said or more isolated environments as the one or more applica application , deleting a resource corresponding to said 40 tions use additional resources . resource mapping , archiving at least one of the one or 17. The method 14 comprising isolating the one or more 

more isolated environments , or copying an isolated applications from other applications and a host operating environment to a new location . system while running within the one or more isolated 2. The system according to claim 1 , wherein the one or environments . more applications are isolated from other applications and a 45 18. A non - transitory computer readable storage medium 

host operating system while the one or more applications run comprising instructions for : 

within the one or more isolated environments . creating one or more isolated environments during instal 

3. The system according to claim 1 comprising one or lation of one or more applications ; 

more interception layers configured to intercept access to maintaining a mapping between a resource as requested host operating system resources and host operating system 50 by the one or more applications and the corresponding interfaces . resource inside said isolated environments , wherein 

4. The system according to claim 3 , wherein the one or said mapping is created or updated during one or more 

more interception layers intercept calls by the one or more of installing an application in an isolated environment , applications to the host operating system and system librar running said application in said isolated environment , ies . or accessing a resource corresponding to said resource 

5. The system according to claim 1 , wherein updates to mapping ; and 

the one or more isolated environments occur as the one or uninstalling an application of the one or more applica 

more applications use additional resources . tions , wherein said uninstalling comprises one or more 

6. The system according to claim 1 , wherein said one or of removing at least one of said mappings , uninstalling 

more resource mappings are maintained in an interception 60 said application , and removing isolated environment 

database . information from storage . 7. The system according to claim 1 , wherein the one or 19. The non - transitory computer readable storage medium 

more isolated environments are stored on a local storage . of claim 18 comprising instructions for updating the one or 

8. The system according to claim 1 , wherein the one or more isolated environments as the one or more applications 

more isolated environments are stored on a networked 65 use additional resources . storage and the one or more applications are delivered over 20. The non - transitory computer readable storage medium 

a network . of claim 18 comprising instructions for isolating the one or 

55 

Case 2:24-cv-00093-JRG Document 114-3 Filed 12/19/24 Page 21 of 22 PageID #:

6141
16 

US 10,606,634 B1 

15 

more applications from other applications and a host oper ating system while running within the one or more isolated 

environments . 

Case 2:24-cv-00093-JRG Document 114-3 Filed 12/19/24 Page 22 of 22 PageID #:

6142