Method and apparatus for isolating execution of software applications

A method for isolating access by application programs to native resources provided by an operating system, the method comprising instructing a suitably programmed computer to perform the steps of:

• (a-1) intercepting by a file system filter driver a request for a file system native resource provided by an operating system and stored in a memory element provided by a computer, the request made by a process executing on behalf of a first user;
• (a-2) redirecting to an isolation environment comprising a user isolation layer and an application isolation layer the request for the file system native resource;
• (b) locating in the memory element an instance of the requested resource associated with a user isolation scope provided by the user isolation layer on behalf of a first user;
• and
• (c) responding to the request for the native resource using the instance of the requested native resource located in the memory element and associated with the user isolation scope.

A method for isolating access by application programs to native resources provided by an operating system, the method comprising instructing a suitably programmed computer to perform the steps of:

• (a) redirecting to an isolation environment comprising a user isolation layer and an application isolation layer a request for a file stored in a memory element provided by a computer, the request made by a process executing on behalf of a first user;
• (b) locating in the memory element an instance of the requested resource associated with a user isolation scope provided by the user isolation layer on behalf of a first user;
• and
• (c) responding to the request for the native resource using the instance of the requested native resource located in the memory element and associated with the user isolation scope.

A method for isolating access by application programs to native resources provided by an operating system, the method comprising instructing a suitably programmed computer to perform the steps of:

• (a) redirecting to an isolation environment comprising a user isolation layer and an application isolation layer a request for a registry database entry stored in a memory element provided by a computer, the request made by a process executing on behalf of a first user;
• (b) locating in the memory element an instance of the requested resource associated with a user isolation scope provided by the user isolation layer on behalf of a first user;
• and
• (c) responding to the request for the native resource using the instance of the requested native resource located in the memory element and associated with the user isolation scope.

A method for isolating access by application programs to native resources provided by an operating system, the method comprising instructing a suitably programmed computer to perform the steps of:

• (a) redirecting to an isolation environment comprising a user isolation layer and an application isolation layer a request for a native resource provided by an operating system and stored in a memory element provided by a computer, the request made by a process executing on behalf of a first user;
• (b) locating in the memory element an instance of the requested resource associated with a user isolation scope provided by the user isolation layer on behalf of a first user;
• (c) responding to the request for the native resource using the instance of the requested native resource located in the memory element and associated with the user isolation scope;
• (d) redirecting to the isolation environment a request for the native resource made by a second process executing on behalf of a second user;
• (e) locating in the memory element an instance of the requested native resource associated with a second user isolation scope provided by the user isolation layer on behalf of the second user;
• and
• (f) responding to the request for the native resource using the instance of the native resource located in the memory element and associated with the second user isolation scope.

A method for isolating access by application programs to native resources provided by an operating system, the method comprising instructing a suitably programmed computer to perform the steps of:

• (a) redirecting to an isolation environment comprising a user isolation layer and an application isolation layer a request for a native resource provided by an operating system and stored in a memory element provided by a computer, the request made by a process executing on behalf of a first user;
• (b) locating in the memory element an instance of the requested resource associated with a user isolation scope provided by the user isolation layer on behalf of a first user
• (c) responding to the request for the native resource using the instance of the requested native resource located in the memory element and associated with the user isolation scope;
• (d) redirecting to the isolation environment a request for a native resource made by a second process executing on behalf of a first user;
• (e) locating in the memory element an instance of the requested native resource associated with the user isolation scope;
• and
• (f) responding to the request for the native resource using the instance of the resource associated with the user isolation scope.

An apparatus for isolating access by application programs to native resources provided by an operating system, the apparatus comprising:

• computer-readable program means for associating an instance of a native resource provided by an operating system with a user isolation scope provided by an isolation environment comprising an application isolation layer and a user isolation layer, the user isolation scope corresponding to a user;
• computer-readable program means for associating an instance of a native resource with an application isolation scope provided by the isolation environment, the application isolation scope corresponding to an application;
• and
• computer-readable program means for intercepting a request for a native resource made by a process executing on behalf of the user and redirecting the request to the instance of the resource associated with the user isolation scope.

An apparatus for isolating access by application programs to native resources provided by an operating system, the apparatus comprising:

• computer-readable program means for:
• (i) associating an instance of a native resource provided by an operating system with a user isolation scope provided by an isolation environment comprising an application isolation layer and a user isolation layer, the user isolation scope corresponding to a user, and for (ii) associating an instance of the native resource with a second user isolation scope, the second user isolation scope corresponding to a second user;
• and
• computer-readable program means for intercepting a request for a native resource made by a process executing on behalf of the user and redirecting the request to the instance of the resource associated with the user isolation scope.