Abstract:
The present disclosure provides a method and system for dynamically updating an application functionality in a secure and constrained manner comprising a cloud service for generating dynamic code fragments and receiving reports, an agent manager in communication with the cloud service receiving code fragments from the cloud service and passing reports thereto, and an in-application agent in communication with the agent manager for receiving dynamic code fragments therefrom and passing reports thereto for dynamically updating the application functionality in which the in-application agent is embedded.

Description:
CROSS REFERENCE TO RELATED APPLICATIONS 
       [0001]    This application claims priority from U.S. Provisional Patent Application 61/866,191 filed Aug. 15, 2013. 
     
    
     TECHNICAL FIELD 
       [0002]    The present invention relates to methods and systems for dynamically altering application functionality, and is particularly concerned with using dynamic and in-application components. 
       BACKGROUND 
       [0003]    In almost all scenarios, updating software functionality requires the updating of the source code, and in some cases compiling the source code to produce a new artifact. In both cases, this will require a new release of the software unto the target machine. There are scenarios where it may be desirable to be able to update the functionality without needing this release step. 
         [0004]    For example, some algorithms may need to be improved over time, certain classes of security bugs need to be fixed, or even certain features introduced or disabled. There is a need in the industry for a method and the system that allow for the above examples to be addressed without requiring a software release (installation/application restart) step. 
         [0005]    Furthermore, there is a need to be able to perform said alterations, without compromising system security. 
       SUMMARY 
       [0006]    An object of the present invention is to provide a method and system for dynamic application updates at runtime, in a constrained and safe manner. Furthermore, the dynamic alteration of functionality can be constrained to only allowable operations/features such that certain security guarantees can be made. 
         [0007]    In the present disclosure there is provided method and system for an agent library to be included into an application, either by the developer or at runtime by the runtime environment. The agent library is able to hook into various interfaces between the application and the different components in the environment, including custom defined interfaces. 
         [0008]    These interfaces can vary significantly. In the case of a web application, such interfaces include, but are not limited to datastores (SQL/NoSQL/XML as well as other types of databases), caching services, other services exposed via an API mechanism, the application runtime environment, included application libraries, as well as other services that are components of a web application, such as an email server. In the case of a mobile app, the interfaces include but are not limited to the local datastore operations on the mobile device, the networking interface, or even an in-application custom defined interface (e.g. hook around user performing a certain operation). Each hook around an interface is able to call a chain of dynamic code fragments. For example, in a mobile application that processes photos taken with the mobile device, hooks are placed around the Camera&#39;s interface (the “save picture” functionality), and those hooks call functions (dynamic code fragments) to perform post processing on the photo just taken, before it is stored to the device. 
         [0009]    The hooking mechanism is capable of working in cases where the runtime does not provide an instrumentation API. For example, the hooking mechanism may use “monkey patching” techniques or utilize a plugin/middleware mechanism provided by the language, framework or runtime of the particular application. 
         [0010]    The present disclosure provides for these code fragments to be dynamic. That is, the code/logic implementing the functions (code fragments), which in turn are called by the hooks around particular interfaces can be modified at runtime without intervention by the developer. These functions are generated by the service side of the platform, and delivered via a secure channel to the agent library, where they are implemented. 
         [0011]    The present disclosure also contains guarantees to certain security constraints. Specifically, while these code fragments are dynamic (i.e. modifiable at runtime without installation/restart/intervention)—there are constraints placed on what these fragments can do. For example, it may be desirable to eliminate generic input/output operations from such fragments. This can be accomplished by, but not limited to, use of a scripting engine to execute the code fragments, with said limitations in place. Alternatively, a virtual machine and runtime can execute said dynamic code fragments. The virtual machine and runtime will exclude the necessary operations to conduct input/output operations—for example. 
         [0012]    Such a design will allow for the safe execution of dynamic code fragments within acceptable constraints: constraints that are by design sufficient to guarantee non-violation of security of operation. 
         [0013]    In the example of the mobile device and picture processing application, new post processing effects and filters, for example, can be added dynamically by altering these dynamic code fragments. 
         [0014]    There are constraints placed in the engine that prevent the accidental or malicious redirection of pictures to a remote server. For example, this could be accomplished by the use of a virtual machine runtime that exclude the network input/output operations. Specifically, only basic computation operations are allowed (load value from memory, store value to memory, all arithmetic operations). Hence, utilizing this invention, we are able to restrict the features of the processing filters to the nature of such filters: mathematical transformations on data structures. 
         [0015]    Communication also flows in the other direction, from the agent library to the cloud service, and allows for the agent library to provide information to the cloud service. 
         [0016]    In the example of the mobile device and the picture processing application, data about the geographic location of where the picture is taken can be sent to the cloud service. 
         [0017]    In accordance with an aspect of the present disclosure there is provided a system for dynamically updating components comprising a cloud service for generating dynamic code fragments and receiving data, an agent manager in communication with the agent library sending dynamic code fragments to the agent library and passing data thereto, and an in-application agent in communication with the agent manager for receiving dynamic code fragments there from and passing reports thereto for dynamically updating an application in which the in-application agent is embedded. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0018]    The present invention will be further understood from the following detailed description with reference to the drawings in which: 
           [0019]      FIG. 1  illustrates a system for dynamically updating an application&#39;s functionality in a dynamic manner accordance with an embodiment of the present disclosure; 
           [0020]      FIG. 2  illustrates the in-application agent of  FIG. 1  in further detail; 
           [0021]      FIG. 3  illustrates in a flowchart a method of dynamically updating an application&#39;s functionality in accordance with another embodiment of the present disclosure; 
           [0022]      FIG. 4  illustrates in a flowchart another method of updating an application&#39;s functionality in accordance with another embodiment of the present disclosure; and 
           [0023]      FIG. 5  illustrates in a flowchart another method updating an application&#39;s functionality in accordance with another embodiment of the present disclosure. 
       
    
    
     DETAILED DESCRIPTION 
       [0024]    In general, the present invention provides a technique for injecting dynamic code fragments into an application 
       Definitions 
       [0025]    A dynamic code fragment is a set of instructions (a part of a software program) to be executed by an agent library. 
         [0026]    A cloud service is a set of remote servers exposing an endpoint that collects relevant data from authenticated agent libraries via a secure channel, and generates dynamic code fragments to be executed by the virtual machine in the agent library. 
         [0027]    An agent library (also known as in-application agent) is a software component that is included by the developer into the application directly or by the runtime environment, that provides the base functionality on the agent side to receive and execute dynamic code fragments, and is able to send requested information to the cloud service. 
         [0028]    A report is any data communicated back from the agent library to the agent manager. 
         [0029]    Referring to  FIG. 1  there is illustrated a system for dynamically updating an application&#39;s functionality (e.g. of a web application or other non-web application) in accordance with a first embodiment of the present disclosure.  FIG. 1  provides an overview of the system components. The system  100  includes a cloud service  110  coupled to a real-time web dashboard  120  and in communication with an agent manager  130 . The agent manager  130  communicates via the Internet  140  with an in-app agent  150  disposed in a web application  160 . The in-app agent  150  is either included as a library by the developer or may be injected into the application  160  via the runtime environment. For example, this may be done by wrapping the application or by injecting the library directly into the application via available runtime methods. 
         [0030]    In operation, the in-app agent  150  receives dynamic code fragments  170  from the cloud service  110  via the agent manager  130 . The dynamic code fragments  170  provide the new or modified functionality for the application. The in-app agent  150  also sends reports  180  to the agent manager  130 . The agent manager  130  is responsible for the communications between the cloud service  110  and the application  160 . 
         [0031]    The real-time web dashboard  120  is provided to give the application developer or user an insight into any aspect of the dynamic code execution, for example_the performance of the application (to observe the effects of the dynamic code fragments on the application performance). The real-time web dashboard  120  also provides an interface for creating, editing, modifying, selecting and/or scheduling the delivery of the dynamic code fragments. 
         [0032]    The cloud service  110  receives the reports  180  from the various agent managers  130  (only one shown in  FIG. 1 ), as well as other sources, for example third party feeds and new algorithms developed by others and generates new dynamic code fragments to be deployed to the in-app agents  150  via the agent manager  130 . 
         [0033]    Referring to  FIG. 2 , there is illustrated the in-app agent of  FIG. 1  in further detail.  FIG. 2  shows the components of the in-app agent  150 . The in-app agent  150  includes a link manager  200 , an in-app library  210  for storing the dynamic code fragments  170  and a fragment processor  220  for applying, adding, compiling or integrating the dynamic code fragments  170  into the application and for generating reports  180 . 
         [0034]    In an example of the present disclosure, in operation, the agent library  210  uses a middleware mechanism  230  to hook into various points of the application  160  and the web application framework. The hooks  240  allow the processor  220  to inject dynamic code fragments  170 , that it received from the cloud service  110  via the link manager  130  into these points in the program (application). In turn, these dynamic code fragments  170  allow reports  180  to be generated by the fragment processor  220  and to be sent by the in-app agent  150  back to the agent manager  130 , who forwards these reports  180  to the cloud service  110  for the creation of new dynamic code fragments where necessitated or desirable. 
         [0035]    The dynamic code fragments  170  may be used for updates, security patches, bug fixes or any other purpose. The dynamic code fragments are executable code that does not require the application to be shut down and restarted. 
         [0036]    Referring to  FIG. 3  there is illustrated in a flowchart a method of dynamically updating an application&#39;s functionality in accordance with another embodiment of the present disclosure. The method  300  begins with embedding the in-app agent  150  at step  310 . Once embedded, the in-app agent  150  receives dynamic code fragments from the cloud service  110 , via the agent manager  130 , at step  320 . The in-app agent  150  then adds the dynamic code fragments to the web application at step  330 . The in-app agent  150  monitors performance/activity of the application with the added code fragments at step  340 . The in-app agent  150  generates a report and sends it to the cloud service  110  via the agent manager  130  at step  350 . The cloud service analyzes the report and generates new dynamic code fragments to extend the functionality of the application at step  360  and sends the new dynamic code fragments to the in-app agent  150 , via the agent manager  130 , at step  370 . Finally, the in-app agent adds the new dynamic code fragments to the application at step  380 . 
         [0037]    Referring to  FIG. 4  there is illustrated in a flowchart a method of dynamically updating a functionality of an application in accordance with a further embodiment of the present disclosure. The method  400  begins with embedding the in-app agent  150  at step  410 . Once embedded, the in-app agent  150  receives dynamic code fragments from the cloud service  110 , via the agent manager  130 , at step  420 . The in-app agent  150  then injects the dynamic code fragments into the application at step  430 . The cloud service  110  may then receive new information from one or more external sources at step  440 . In this scenario there is no tripwire event in the in-app agent, rather, there is an update to the dynamic code fragments deriving from a source external to the application. Based on this new external information, the cloud service generates new dynamic code fragments at step  450 . The cloud service sends the new dynamic code fragments to the in-application agent at step  460 . Finally, the in-app agent adds the new dynamic code fragments to the application at step  470 . 
         [0038]    The dynamic nature of the method provides for altering the functionality of an application by injecting dynamic code fragments into the application based on what the cloud service  110  believes is most effective. Consequently, the cloud service is injecting new code (representing a new algorithm, feature, tool or functionality) into the in-app agents, which changes how each respective application behaves. This injection of code is automatic in the sense that it is done without developer intervention. Thus, the in-app agent provides an empty container at certain interfaces within the application to be filled (injected) with dynamic code fragments that are generated dynamically cloud side. 
         [0039]      FIG. 5  is a flowchart illustrating by way of example the operation of the in-app agent  150 . The operation  500  begins with embedding the in-app agent  150  as represented by step  510 . The application is started at step  520 . The In-App Agent  150  injects hooks into the various interfaces: for example, it injects code (hook) into the database interface layer (DB API) that allows it to process requests before the DB API call is made. The In-App agent  150  inserts the dynamic code fragments via the hooks into these various interfaces at step  540 . The In-App agent  150  requests updated dynamic code fragments for these interfaces at step  550 . The In-App agent  150  receives dynamic code fragments the from cloud service  110  at step  560 . Finally, at step  570 , the in-app agent  150  adds the new dynamic code fragments to the application. As an example only, the application may be a web application. However, it should be clearly understood that the application may be any type of application, not just a web application. 
         [0040]    From the foregoing, it is apparent that the system may include a sandboxing mechanism to constrain the dynamic code fragments that may be executed. As an example, it may not be desirable to allow the dynamic code fragments to contain generic input/output operations, for security reasons, and to be restricted to computation algorithms only. As such, in an embodiment, the agent library disables all input/output operations such that dynamic code fragments are injected into the application cannot be compromised by a malicious agent to perform undesirable operations or export data. In other embodiments, the agent library may selectively disable some operations (such as input/output operations) to sandbox the new dynamic code fragments injected into the application. 
         [0041]    The dynamic code fragments are executed by an agent library, which places such constraints on the dynamic code fragments. This sandboxing effect can be achieved by use of a scripting engine, or alternatively, a full virtual machine and runtime environment with a restricted instruction set. 
         [0042]    Although the foregoing technology is best implemented using a cloud service  110 , in other embodiments the cloud service may be replaced by a server cluster or even a single server. Each server is a computing device having a processor coupled to a memory and to a data communication port (e.g. modem, network adapter, etc.) for data communication with a network to which the server is connected. The server may include various input/output (I/O) devices and peripherals. The processor and memory cooperate to execute instructions in the form of software code for causing the computing device (server, cluster or cloud service as the case may be) to perform the acts or operations of the novel methods described herein. 
         [0043]    Any of the methods disclosed herein may be implemented in hardware, software, firmware or any combination thereof. Where implemented as software, the method steps, acts or operations may be programmed or coded as computer-readable instructions and recorded electronically, magnetically or optically on a non-transitory computer-readable medium, computer-readable memory, machine-readable memory or computer program product. In other words, the computer-readable memory or computer-readable medium comprises instructions in code which when loaded into a memory and executed on a processor of a computing device cause the computing device to perform one or more of the foregoing method(s). 
         [0044]    A computer-readable medium can be any means, memory device or medium that contains, records, or stores a computer program or application to be executed or run by a processor (or microprocessor) of a computer (or computing device or other instruction-execution apparatus). The computer-readable medium may be electronic, magnetic, optical, electromagnetic, infrared or any semiconductor system or device. For example, computer executable code to perform the methods disclosed herein may be tangibly recorded on a non-transitory computer-readable medium including, but not limited to, a floppy-disk, a CD-ROM, a DVD, RAM, ROM, EPROM, Flash Memory or any suitable memory card, etc. The method may also be at least partially implemented in hardware. A hardware implementation might employ discrete logic circuits having logic gates for implementing logic functions on data signals, an application-specific integrated circuit (ASIC) having appropriate combinational logic gates, a programmable gate array (PGA), a field programmable gate array (FPGA), etc. 
         [0045]    This invention has been described in terms of specific embodiments, implementations and configurations which are intended to be exemplary only. Persons of ordinary skill in the art will appreciate, having read this disclosure, that many obvious variations, modifications and refinements may be made without departing from the inventive concept(s) presented herein. The scope of the exclusive right sought by the Applicant(s) is therefore intended to be limited solely by the appended claims.