Patent ID: 12248593

DETAILED DESCRIPTION

FIG.1provides an example of a computing environment in which one or more embodiments of the present invention may be implemented. This computing environment includes a user computing device100and a management solution150which is used to manage user computing device100. Although only a single user computing device100is shown, management solution150would typically be used to manage a large number of user computing devices, any or all of which could be configured in the same manner as user computing device100to thereby enable snapshots with integrity to be taken of secure workspaces having distribute cache in accordance with embodiments of the present invention.

User computing device100is shown as having one or more secure workspace managers110. A secure workspace manager is intended to represent the components on user computing device100that allow secure workspaces to be deployed. For example, a secure workspace manager may be a hypervisor (e.g., Hyper-V) when virtual machines are used to implement secure workspaces, a container daemon when containers (e.g., Docker containers) are used to implement secure workspaces, a sandbox manager when sandboxes (e.g., Sandboxie isolated environments) are used to implement secure workspaces, a Webapp manager when a browser sandbox is used to implement secure workspaces, etc. In the depicted example, it is assumed that four secure workspaces120-1through120-4are deployed on user computing device100. However, there could be any number and/or type of secure workspaces at any given time. These secure workspaces are represented as hosting applications121,122,123, and124respectively. Notably, a secure workspace could include more than one application.

User computing device100also includes an operating system (OS)115which can be considered the base operating system to distinguish it from an operating system inside any of the secure workspaces (e.g., inside a virtual machine). Some or all the secure workspaces could run in the context of operating system115(e.g., when the secure workspace is a software container) and/or some or all the secure workspaces could run in separate virtual machines. User computing device also includes host agent131which can run in the context of operating system115.

Host agent131can be configured to implement management services on user computing device100including the deployment and management of secure workspaces on user computing device100. For example, a secure workspace orchestrator151on management solution150may interface with host agent131to provide secure workspaces (or at least information for creating secure workspaces), and host agent131may interface with secure workspace manager(s)110to create and manage the secure workspaces.

Each secure workspace can include a workspace agent133that is configured to interface with host agent131to facilitate the taking of snapshots with integrity of the secure workspaces deployed on user computing device100in accordance with embodiments of the present invention. These snapshots could be stored on user computing device100and/or in a snapshot repository152on or accessible to management solution150.

FIGS.2A-2Fprovide an example of how snapshots with integrity can be taken of secure workspaces having distributed cache in accordance with one or more embodiments of the present invention. As represented inFIG.2A, it is assumed in this example that secure workspace120-1has been deployed on user computing device100from an image maintained in disk101. As one example only, this image for secure workspace120-1could be a VHDX file. It is also assumed that host agent131and workspace agent133in secure workspace120-1have established a session for communicating with one another.

In step 1, it is also assumed that secure workspace orchestrator151instructs host agent131to take a snapshot of secure workspace120-1(or of application121which is running in secure workspace120-1). This instruction to take the snapshot could be in response to administrator input, in accordance with a schedule, etc. and could include an identifier of secure workspace120-1. In step 2, host agent131can notify workspace agent133running in secure workspace120-1to prepare for a snapshot. For example, based on the identifier of secure workspace120-1contained in the instruction received from secure workspace orchestrator151, host agent131may identify and employ the session corresponding to secure workspace120-1to send the notification.

Turning toFIG.2B, in step 3a and in response to the notification, workspace agent133can lock the filesystem and flush the cache within secure workspace120-1. For example, if secure workspace120-1is Windows-based, workspace agent133could send an IOCTL_VOLSNAP_FLUSH_AND_HOLD_WRITES control code as part of an IRP_MJ_DEVICE_CONTROL request targeting the volume device object of a file system within secure workspace120-1. As another example, if secure workspace120-1is Linux-based, workspace agent133could invoke the fsfreeze and/or freeze_super commands. As a result of step 3a, any of application121's cached data and any data cached by the filesystem within secure workspace120-1will be flushed from secure workspace120-1(e.g., to the image for secure workspace120-1). In step 3b, and after locking the filesystem and flushing the cache, workspace agent131can send confirmation to host agent131that secure workspace120-1is prepared for a snapshot.

Turning toFIG.2C, in step 4 and after workspace agent133has confirmed that the filesystem within secure workspace120-1has been locked and the cache has been flushed, host agent131can lock the filesystem and flush the cache of user computing device100(e.g., by interfacing with operating system115using the control code or commands referenced above). As a result of step 4, any cached data pertaining to but outside of secure workspace120-1can be flushed to the image for secure workspace120-1. Accordingly, after step 4, all data relating to the execution of application121can be flushed. This data could include application121's cache within secure workspace120-1, the filesystem cache inside secure workspace120-1(e.g., a Hyper-V storage cache), the filesystem cache of operating system115(e.g., the filesystem in which the image for secure workspace120-1is stored), and a hardware cache for disk101(e.g., a disk controller cache).

Turning toFIG.2D, in step 5, host agent131can create a snapshot of secure workspace120-1. For example, host agent131could interface with operating system115to create a snapshot from the image of secure workspace120-1. As examples only, in embodiments where operating system115is a version of Windows, host agent131could use the Msvm_SnapshotOfVirtualSystem class to accomplish this step, whereas in embodiments where operating system115is a version of Linux, host agent131could use the Libvirt APIs to accomplish this step.

Turning toFIG.2E, in step 6, host agent131may send the snapshot to secure workspace orchestrator151for storage in snapshot repository152. In some embodiments, however, host agent131may only retain the snapshot in a local repository or some other storage location.

Turning toFIG.2F, in step 7a, host agent131unlocks the filesystem of user computing device100(e.g., using the control code or commands referenced in step 3a above). This will allow writes to the filesystem provided by operating system115to be resumed. In step 7b, host agent131can instruct workspace agent133in secure workspace120-1to unlock the file system in secure workspace120-1, and then in step 7c, workspace agent133does so (e.g., using the control code or commands referenced in step 3a above). This will allow writes to the filesystem within secure workspace120-1, including application121's writes, to resume). At this point, secure workspace120-1can resume its normal operation. Given that the above-described steps can be taken relatively quickly, the user's experience may only be minimally impacted during the short period when the filesystem within secure workspace120-1is locked.

In embodiments where a secure workspace may be a virtual machine running a separate operating system from operating system115, the above-described process for creating a snapshot with integrity can be performed even when operating system115and the operating system within the secure workspace are not the same. For example, operating system115could be a version of Windows and the operating system inside secure workspace120-1could be a version of Linux. In such a case, host agent131can still instruct workspace agent133to lock the filesystem and flush the cache within secure workspace120-1as described above thereby allowing the snapshot of the Linux-based secure workspace to be obtained from the Windows environment external to secure workspace120-1.

Similarly, in embodiments where a secure workspace is implemented using a cloud container, the above-described process can be performed by leveraging available APIs within the cloud environment. For example, in an Azure cloud environment, host agent131could leverage the snapshots API to create a snapshot of the secure workspace as part of step 5.

In some embodiments, operating system115may not be trusted. In such cases, a supervisory secure workspace200(e.g., in the form of a virtual machine) may be deployed on user computing device100and may include host agent131as represented inFIG.3. This host agent131that is embedded in supervisory secure workspace200can then perform the above-described functionality using virtual machine introspection libraries (e.g., to interface with workspace agent133to cause the filesystem to be locked and the cache flushed and to interface with operating system115to cause the filesystem to be locked and the cache flushed and then to create the snapshot) resulting in the snapshot being created from within supervisory secure workspace200. This snapshot can then be provided to secure workspace orchestrator151for storage in snapshot repository152.

In the above-described examples, only a single secure workspace has been considered. However, the same functionality could be performed to take snapshots of any number of secure workspaces that may be concurrently deployed on user computing device100. Notably, these concurrently deployed secure workspaces could be the same type or different types of secure workspaces. Regardless of the type of secure workspace, host agent131and workspace agent133can perform the above-described functionality to ensure that a snapshot of the secure workspace will include all the data of any applications executing in the secure workspace and will therefore have integrity.

In summary, embodiments of the present invention enable a snapshot of a secure workspace to be created with integrity with minimal if any impact on user productivity. These benefits can be provided for each secure workspace deployed on a user computing device and regardless of the type of the secure workspace.

Embodiments of the present invention may comprise or utilize special purpose or general-purpose computers including computer hardware, such as, for example, one or more processors and system memory. Embodiments within the scope of the present invention also include physical and other computer-readable media for carrying or storing computer-executable instructions and/or data structures. Such computer-readable media can be any available media that can be accessed by a general purpose or special purpose computer system.

Computer-readable media are categorized into two disjoint categories: computer storage media and transmission media. Computer storage media (devices) include RAM, ROM, EEPROM, CD-ROM, solid state drives (“SSDs”) (e.g., based on RAM), Flash memory, phase-change memory (“PCM”), other types of memory, other optical disk storage, magnetic disk storage or other magnetic storage devices, or any other similar storage medium which can be used to store desired program code means in the form of computer-executable instructions or data structures and which can be accessed by a general purpose or special purpose computer. Transmission media include signals and carrier waves. Because computer storage media and transmission media are disjoint categories, computer storage media does not include signals or carrier waves.

Computer-executable instructions comprise, for example, instructions and data which, when executed by a processor, cause a general-purpose computer, special purpose computer, or special purpose processing device to perform a certain function or group of functions. The computer executable instructions may be, for example, binaries, intermediate format instructions such as assembly language or P-Code, or even source code.

Those skilled in the art will appreciate that the invention may be practiced in network computing environments with many types of computer system configurations, including, personal computers, desktop computers, laptop computers, message processors, hand-held devices, multi-processor systems, microprocessor-based or programmable consumer electronics, network PCs, minicomputers, mainframe computers, mobile telephones, PDAs, tablets, smart watches, pagers, routers, switches, and the like.

The invention may also be practiced in distributed system environments where local and remote computer systems, which are linked (either by hardwired data links, wireless data links, or by a combination of hardwired and wireless data links) through a network, both perform tasks. In a distributed system environment, program modules may be located in both local and remote memory storage devices. An example of a distributed system environment is a cloud of networked servers or server resources. Accordingly, the present invention can be hosted in a cloud environment.

The present invention may be embodied in other specific forms without departing from its spirit or essential characteristics. The described embodiments are to be considered in all respects only as illustrative and not restrictive. The scope of the invention is, therefore, indicated by the appended claims rather than by the foregoing description.