US 10,873,584 B2Granted

Secure network-accessible system for executing remote applications

AssigneeORock Technologies, Inc.

InventorJohn Leon

Life of this patent

Estimating the term…

Loading patent…

Abstract

A plurality of system nodes coupled via a dedicated private network is described herein. The nodes offer an end-to-end solution for protecting against network-based attacks. The nodes can also execute applications locally at the request of a user device such that a user operating the user device can use the applications executed locally on the nodes as if the applications were executing locally on the user device. To protect user data, the nodes may not transmit any user data to the user device. Rather, a node can generate a graphical representation of the environment in which the applications are executed, and transmit the graphical representation to the user device. As the user performs actions that result in a change of a graphical view of the environment in which the applications are executed, the node can generate and transmit new graphical representations of the environment to the user device.

Claims18

Dependent claims

A system for executing remote applications, the system comprising:

an applications data store;
and
a hardware processor in communication with the applications data store and configured with computer-executable instructions, wherein the computer-executable instructions, when executed, cause the hardware processor to:
process a request to access a first application received from a local application running on a user device via a network;
retrieve first source files for the first application from the applications data store;
initialize a container formed from a container image and a top container layer, wherein the container shares an operating system with other containers initialized by the hardware processor and is isolated from the other containers;
cause the container to load the first application using the first source files;
generate a graphical representation of the container;
encrypt the graphical representation of the container using a first key;
transmit the encrypted graphical representation of the container to the user device, wherein reception of the encrypted graphical representation of the container causes the local application running on the user device to decrypt the encrypted graphical representation of the container, display the decrypted version of the graphical representation of the container such that the first application that is loaded by the container appears to be available locally on the user device, and encrypt the decrypted version of the graphical representation of the container using the first key for storage;
encrypt a second graphical representation of the container using a second key different than the first key;
and
transmit the encrypted second graphical representation of the container to the user device, wherein reception of the encrypted second graphical representation of the container causes the local application running on the user device to decrypt the encrypted second graphical representation of the container, display the decrypted version of the second graphical representation of the container, and encrypt the decrypted version of the second graphical representation of the container using the second key for storage.

10 more elements

A computer-implemented method for executing remote applications, the computer-implemented method comprising:

as performed by a computing system comprising a processor and accessible via a network,
receiving, from a local application running on a user device via the network, a request to access a first application;
retrieving first source files for the first application;
initializing a container formed from a container image and a top container layer, wherein the container shares an operating system with other containers initialized by the computing system and is isolated from the other containers;
causing the container to load the first application using the first source files;
generating a graphical representation of the container;
encrypting the graphical representation of the container using a first key;
transmitting the encrypted graphical representation of the container to the user device, wherein reception of the encrypted graphical representation of the container causes the local application running on the user device to decrypt the encrypted graphical representation of the container, display the decrypted version of the graphical representation of the container such that the first application that is loaded by the container appears to be available locally on the user device, and encrypt the decrypted version of the graphical representation of the container using the first key for storage;
encrypting a second graphical representation of the container using a second key different than the first key;
and
transmitting the encrypted second graphical representation of the container to the user device, wherein reception of the encrypted second graphical representation of the container causes the local application running on the user device to decrypt the encrypted second graphical representation of the container, display the decrypted version of the second graphical representation of the container, and encrypt the decrypted version of the second graphical representation of the container using the second key for storage.

8 more elements

Non-transitory, computer-readable storage media comprising computer-executable instructions for executing remote applications, wherein the computer-executable instructions, when executed by a computer system accessible via a network, cause the computer system to perform operations comprising:

processing a request to access a first application received from the user device via the network;
retrieving first source files for the first application;
initializing a container formed from a container image and a top container layer, wherein the top container layer stores changes to the container, and wherein the container shares an operating system with other containers initialized by the computer system and is isolated from the other containers;
causing the container to load the first application using the first source files;
generating a graphical representation of the container;
encrypting the graphical representation of the container using a first key;
transmitting the encrypted graphical representation of the container to the user device, wherein reception of the encrypted graphical representation of the container causes the user device to decrypt the encrypted graphical representation of the container, display the decrypted version of the graphical representation of the container, and encrypt the decrypted version of the graphical representation of the container using the first key for storage;
encrypting a second graphical representation of the container using a second key different than the first key;
and
transmitting the encrypted second graphical representation of the container to the user device, wherein reception of the encrypted second graphical representation of the container causes the local application running on the user device to decrypt the encrypted second graphical representation of the container, display the decrypted version of the second graphical representation of the container, and encrypt the decrypted version of the second graphical representation of the container using the second key for storage.

7 more elements

Dependencies are inferred from the claim text.

Facts

Application: 16/002,738Filed 7 Jun 2018 · us provisional application
Priority: 9 Jun 2017
Published: US 2018/0359259 A113 Dec 2018
Granted: 22 Dec 2020
Term ends: Not estimatedThe source records don’t support an estimate.

Classification12 codes

H04L 63/102
For controlling access to devices or network resources: entity profiles
G06F 9/445
Arrangements for executing specific programs: program loading or initiating
G06F 21/6218
Protecting access to data via a platform, e.g. using keys or access control rules: to a system of files or objects, e.g. local or distributed file…
H04L 63/0428
For providing a confidential data exchange among entities communicating through data packet networks: wherein the data content is protected, e.g.…

Family

Application62/517,712Us provisional application · filed 9 Jun 2017
US 2018/0359259 A1Pre-grant publication · published 13 Dec 2018
US 10,873,584 B2This patent

From the US filing history. Foreign family members aren’t listed.

Timeline

Citations

Open elsewhere

Building an agent or pulling many patents? Use the API or MCP server instead of scraping pages. Get an API key