# US 12,225,050 B2 · Distribution and management of services in virtual environments > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,225,050 B2 - Document ID: US12225050B2 - Status: Granted - Kind: B2 - Application number: 17/706,567 - Filed: 2022-03-28 - Published: 2022-07-14 - Granted: 2025-02-11 - Earliest claimed: 2017-01-09 - Assignees: Microsoft Technology Licensing, LLC - Applicants: Microsoft Technology Licensing, LLC - Inventors: Hari R. Pulapaka; Margarit Simeonov Chenchev; Benjamin M. Schultz; Jonathan David Wiswall; Frederick Justus Smith; John A. Starks; Richard O. Wolcott; Michael Bishop Ebersol - Web page: https://patentgrep.com/patent/US12225050B2 ## CPC - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - G06F 9/455: Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines - G06F 9/45558: {Hypervisor-specific management and integration aspects} - G06F 9/5077: {Logical partitioning of resources; Management or configuration of virtualized resources (specific details on emulation or internal functioning of virtual machines G06F9/455)} - G06F 9/547: {Remote procedure calls [RPC]; Web services} - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - H04L 41/5009: Determining service level performance parameters or violations of service level contracts, e.g. violations of agreed response time or mean time between failures [MTBF] - H04L 41/5025: by proactively reacting to service quality change, e.g. by reconfiguration after service quality degradation or upgrade - H04L 63/10: {for controlling access to devices or network resources} - G06F 2009/45587: {Isolation or security of virtual machine instances} - G06F 2009/45591: {Monitoring or debugging support} - G06F 2209/542: Intercept - H04L 63/0272: {Virtual private networks} - H04L 63/0281: {Proxies} - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Distribution and management of services in virtual environments is described herein. In one or more implementations, a service distribution and management model is implemented in which system services and applications are seamlessly distributed across multiple containers which each implement a different runtime environment. In one or more implementations, a system for distributing access to services in a host operating system of a computing device includes a host operating system configured to implement a host runtime environment, and one or more services implemented by the host operating system. The system further includes a service control manager configured to enable communication between a client stub of a service implemented in a client runtime environment and a service provider of the service that is implemented in a service runtime environment that is separate from the first client runtime environment. ## Claims ### Claim 1 One or more computing devices, in aggregate comprising: processing hardware; and storage hardware storing instructions configured to cause the processing hardware to perform steps comprising: execute a host runtime environment provided by an operating system of the one or more computing devices; execute a service within a first runtime environment, the first runtime environment either being the host runtime environment or being hosted by the host runtime environment; execute a client stub of the service within a second runtime environment, the second runtime environment being a separate, isolated execution environment from the first runtime environment, the second runtime environment being hosted by the host runtime environment; establish inter-process communication (IPC) between the client stub executing within the second runtime environment and the service executing within the first runtime environment based on provided communication parameters; and responsive to a request to access the service from an application executing on the host runtime environment, executing a virtual version of the application within the second runtime environment, the virtual version of the application directing the request to the client stub. ### Claim 2 (depends on 1) The one or more computing devices of claim 1, wherein the storage hardware stores further instructions configured to cause the processing hardware to: remotely display, through the second runtime environment, a graphical user interface of the service executing within the first runtime environment. ### Claim 3 (depends on 1) The one or more computing devices of claim 1, wherein the provided communication parameters are specific to the IPC establishing between the client stub and the service and are provided by the application. ### Claim 4 (depends on 1) The one or more computing devices of claim 1, wherein the provided communication parameters are universal between multiple client stubs and corresponding multiple services and are provided by a centralized host service control manager. ### Claim 5 (depends on 1) The one or more computing devices of claim 1, wherein the request to access the service from the application is a standard name query that is directed by the application to a service endpoint that is implemented as a standard name. ### Claim 6 (depends on 1) The one or more computing devices of claim 1, wherein the second runtime environment comprises a second registration database that is separate from a first registration database that is part of the first runtime environment, the second registration database comprising information for establishing the IPC with the client stub, the first registration database comprising information for establishing the IPC with the service. ### Claim 7 (depends on 1) The one or more computing devices of claim 1, wherein the second runtime environment comprises a different operating system than the operating system of the one or more computing devices. ### Claim 8 (depends on 1) The one or more computing devices of claim 1, wherein the second runtime environment is a container that shares aspects of the operating system of the one or more computing devices. ### Claim 9 (depends on 8) The one or more computing devices of claim 8, wherein the container is a process container, the operating system implementing namespace isolation such that processes executing within the container can access shared parts of the operating system, while isolated parts of the operating system are independently established for the container. ### Claim 10 (depends on 1) The one or more computing devices of claim 1, wherein the storage hardware stores further instructions configured to cause the processing hardware to: copy changes in the second runtime environment back to the operating system of the one or more computing devices. ### Claim 11 (depends on 1) The one or more computing devices of claim 1, wherein the storage hardware stores further instructions configured to cause the processing hardware to: responsive to an update to the operating system of the one or more computing devices, re-instantiate the second runtime environment. ### Claim 12 (depends on 1) The one or more computing devices of claim 1, wherein the storage hardware stores further instructions configured to cause the processing hardware to: determine, prior to executing the virtual version of the application within the second runtime environment, whether the request to access the service comprises a request to access an untrusted resource; and executing the virtual version of the application within the second runtime environment and directing the request to the client stub only in response to the determining that the request comprises the request to access the untrusted resource. ### Claim 13 (depends on 12) The one or more computing devices of claim 12, wherein the storage hardware stores further instructions configured to cause the processing hardware to: responsive to determining that the request to access the service comprises a request to access a trusted resource, executing the application within the host runtime environment. ### Claim 14 (depends on 1) The one or more computing devices of claim 1, wherein the storage hardware stores further instructions configured to cause the processing hardware to: execute a network filter, the network filter blocking network communications between an untrusted resource and the first runtime environment and allowing network communications between the untrusted resource and the second runtime environment. ### Claim 15 (depends on 14) The one or more computing devices of claim 14, wherein the network filter further blocks network communications between a trusted resource and the second runtime environment and allows network communications between the trusted resource and the first runtime environment. ### Claim 16 (depends on 14) The one or more computing devices of claim 14, wherein the network filter comprises a network address translator. ### Claim 17 (depends on 14) The one or more computing devices of claim 14, wherein the allowing the network communications between the untrusted resource and the second runtime environment comprises modifying the network communications between the untrusted resource and the second runtime environment with dummy credential data created by the network filter. ### Claim 18 (depends on 1) The one or more computing devices of claim 1, wherein the service is a Domain Name Service (DNS). ### Claim 19 Storage hardware storing instructions configured to cause a computing device to perform steps comprising: execute a host runtime environment provided by an operating system of the computing device; execute a service within a first runtime environment, the first runtime environment either being the host runtime environment or being hosted by the host runtime environment; execute a client stub of the service within a second runtime environment, the second runtime environment being a separate, isolated execution environment from the first runtime environment, the second runtime environment being hosted by the host runtime environment; establish inter-process communication (IPC) between the client stub executing within the second runtime environment and the service executing within the first runtime environment based on provided communication parameters; and responsive to a request to access the service from an application executing on the host runtime environment, executing a virtual version of the application within the second runtime environment, the virtual version of the application directing the request to the client stub. ### Claim 20 A method of providing, to an application executing on a computing device, isolated access to a computer-executed service process, the method comprising: execute a host runtime environment provided by an operating system of the computing device; execute the service process within a first runtime environment, the first runtime environment either being the host runtime environment or being hosted by the host runtime environment; execute a client stub of the service process within a second runtime environment, the second runtime environment being a separate, isolated execution environment from the first runtime environment, the second runtime environment being hosted by the host runtime environment; establish inter-process communication (IPC) between the client stub executing within the second runtime environment and the service process executing within the first runtime environment based on provided communication parameters; and responsive to a request to access the service from the application executing on the host runtime environment, executing a virtual version of the application within the second runtime environment, the virtual version of the application directing the request to the client stub.