Abstract: A computer-implemented method for remediation of a computing device attempting to access a network. The method may include detecting that the computing device is attempting to access the network. The method may also include determining that the computing device does not comply with a network-access-control policy of the network. The method may include using a virtualization layer to bring the computing device into compliance with the network-access-control policy. The method may include permitting the computing device to access the network after the computing device is brought into compliance with the network-access-control policy. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: The disclosure is directed to automatic virtualization based on user-defined criteria. In one example, data representative of user-defined criteria is received, a virtualization heuristic is generated based on the user-defined criteria, the virtualization heuristic is activated, an occurrence of an event defined by the user-defined criteria is detected, and at least one virtualization operation is automatically performed in response to the detected event. In certain embodiments, the virtualization operation is selected based on the user-defined criteria. In certain embodiments, the virtualization operation includes capturing file system and configuration activity associated with the detected event and storing data representative of the captured file system and configuration activity to a virtual layer.

Abstract: A computer-implemented method for defragmenting virtual machine prefetch data. The method may include obtaining prefetch information associated with prefetch data of a virtual machine. The method may also include defragmenting, based on the prefetch information, the prefetch data on physical storage. The prefetch information may include a starting location and length of the prefetch data on a virtual disk. The prefetch information may include a geometry specification of the virtual disk. Defragmenting on physical storage may include placing the prefetch data contiguously on physical storage, placing the prefetch data in a fast-access segment of physical storage, and/or ordering the prefetch data according to the order in which it is accessed at system or application startup.

Abstract: The disclosure is directed to dynamic insertion and removal of virtual software sub-layers. In one example, a virtual layer associated with a software application is virtually installed and activated in a computing device. A virtual sub-layer associated with a component of the software application is dynamically inserted in the virtual layer. The virtual layer remains active during the dynamic insertion of the virtual sub-layer. In certain embodiments, a process is executed from the virtual layer, a determination is made as to whether the process launched before or after the insertion of the virtual sub-layer, and the inserted virtual sub-layer is selectively made visible or invisible to the process based on the determination.

Abstract: The disclosure is directed to feature based software virtualization. In one example, a first virtual sub-layer associated with a first feature set of a software package is virtually installed to a computing device. The first feature set includes a first subset of features associated with the software package. The first virtual sub-layer is enabled to activate the first feature set. A second virtual sub-layer associated with a second feature set of the software package is virtually installed to the computing device. The second feature set includes a second subset of the features associated with the software package. The second virtual sub-layer is enabled to activate the second feature set. In certain embodiments, a first fee is charged for the first feature set and a second fee is charged for the second feature set.

Abstract: The disclosure is directed to systems and methods for patching computer programs. In one example, a patch is virtually installed to a computing device having a base file system and configuration, a computer program, and a patch layering subsystem. The virtual installation may include storing content of the patch to a patch layer, and generating and storing mapping data defining at least one relationship between the content in the patch layer and content in the base file system and configuration. The virtually installed patch may be enabled, including applying the mapping data to the patch layering subsystem such that the patch layering subsystem is configured for selectively redirecting access requests from the base file system and configuration to the patch layer. In certain embodiments, the enabled patch may be disabled by reversing the application of the mapping data to the patch layering subsystem.

Abstract: The disclosure is directed to dynamic insertion and removal of virtual software sub-layers. In one example, a virtual layer associated with a software application is virtually installed and activated in a computing device. A virtual sub-layer associated with a component of the software application is dynamically inserted in the virtual layer. The virtual layer remains active during the dynamic insertion of the virtual sub-layer. In certain embodiments, a process is executed from the virtual layer, a determination is made as to whether the process launched before or after the insertion of the virtual sub-layer, and the inserted virtual sub-layer is selectively made visible or invisible to the process based on the determination.

Abstract: A method may include identifying a first version of a virtualized application. The first version of the virtualized application may include a first read-only virtualization sublayer, and the first read-only virtualization sublayer may provide a base state of the first version of the virtualized application. The method may also include identifying a second version of the virtualized application. The second version of the virtualized application may include a second read-only virtualization sublayer, which may provide a base state of the second version of the virtualized application. The method may further include determining a difference between the first read-only virtualization sublayer and the second read-only virtualization sublayer and using the difference to create a patch configured to update an instance of the first version of the virtualized application to an instance of the second version of the virtualized application. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: The disclosure is directed to systems, apparatus, and methods for layered execution. In one example, a layered execution environment is provided where one or more layers are overlaid over a base operating environment in a manner that they appear to be installed on the local system. The first layer may include a resource associated with one or more resources on a second layer. The resource on the first layer may be monitored to determine when access to the resource is requested. In response to access to the resource of the first layer, the second layer, which comprises the associated resources, may be activated. By activating the second layer only in response to a request to access a resource on the first layer, associated resources may be selectively activated resulting in more efficient execution.

Abstract: A method may include identifying a virtualized application that has a read-only virtualization sublayer and a read-write virtualization sublayer. The read-only virtualization sublayer may represent a base state of the virtualized application and the read-write virtualization sublayer may be configured to store changes to the base state of the virtualized application. The method may also include determining a first difference between the read-only virtualization sublayer and the read-write virtualization sublayer at a first point in time and using the first difference between the read-only virtualization sublayer and the read-write virtualization sublayer to create a first snapshot that represents a state of the virtualized application at the first point in time. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: A computer-implemented method for transparently restoring data using streaming may comprise identifying an attempt to access backed-up data that is not present on a computing device, transmitting a request to a server to restore the backed-up data, receiving the backed-up data from the server via streaming, and restoring the backed-up data to the computing device. A corresponding method for streaming backed-up data to a target computing device is also disclosed. In addition, corresponding systems and computer-readable media are also disclosed.

Abstract: Systems and methods for delivery of user profile data are disclosed. An exemplary method includes detecting a request for a full copy of a user profile data package maintained by a user profile data source subsystem, creating an illusion that the request has been fulfilled, and copying on demand a portion of the user profile data package from the source subsystem to a target location for access by a data consuming subsystem. In certain embodiments, the method further includes utilizing the copied portion of the user profile data package for execution of a computing operation, without fully copying the user profile data package from the source subsystem. In certain embodiments, the portion of the user profile data package is streamed from the source subsystem to the target location over a network connection.

Abstract: The disclosure is directed to systems, apparatus, and methods for layered execution pre-boot configuration. In one example, a system includes a local computer, a base operating system, a layered execution environment, and a layered environment manager. The system may further include an environment update service and one or more layered environment data store(s). The system may, before booting the base operating system and layered execution environment, perform such modification operations as applying an operating system patch, applying a program patch, changing a layer activation property, disabling a program, replacing a program, changing a configuration file, and installing a driver.

Abstract: The disclosure is directed to dynamic insertion and removal of virtual software sub-layers. In one example, a virtual layer associated with a software application is virtually installed and activated in a computing device. A virtual sub-layer associated with a component of the software application is dynamically inserted in the virtual layer. The virtual layer remains active during the dynamic insertion of the virtual sub-layer. In certain embodiments, a process is executed from the virtual layer, a determination is made as to whether the process launched before or after the insertion of the virtual sub-layer, and the inserted virtual sub-layer is selectively made visible or invisible to the process based on the determination.

Abstract: The disclosure is directed to computing systems that provide access to the content of layers. Layers may include, for example, application layers, baseline layers, data layers, patch layers, application patch layers, and sublayers. Prioritization schemes, including prioritization by layer type, by assigned priority weights, by access type, by sub-layers and by read-write indicators are provided. Layers may contain file reference information including exclusion or inclusion entries indicating what files may be written. Paths recorded in layers may also embed variables to true paths on a layered system. Detailed information on various example embodiments are provided in the Detailed Description, and the invention is defined by the appended claims.

Abstract: A computer-implemented method of imaging a computer system may include taking an image of the computer system that includes those files needed to boot an operating system but excludes at least some of those files that are not needed to boot the operating system. The image may be loaded on a target computer system, which may or may not be the same as the imaged computer system, to enable the target computer system to boot the operating system. Those files that are not needed to boot the operating system may be streamed to the target computer system on an as-needed basis or in the background. Corresponding systems and computer-readable media are also disclosed.

Abstract: The inventions relate generally to portable media storage devices that contain layers permitting applications to be used at a connected computing device, those systems optionally including drivers for operating a layered computing environment or a driver installation program. Also disclosed herein are computer systems for using other systems for creating those portable storage devices. Detailed information on various example embodiments of the inventions are provided in the Detailed Description below, and the inventions are defined by the appended claims.

Abstract: The inventions relate generally to protection of computing systems by isolating intrusive attacks into layers, those layers containing at least file objects and being accessible to applications, those layers further maintaining potentially intrusive file objects separately from regular file system objects such that the regular objects are protected and undisturbed. Also disclosed herein are computing systems which use layers and/or isolation layers, and various systems and methods for using those systems. Detailed information on various example embodiments of the inventions are provided in the Detailed Description below, and the inventions are defined by the appended claims.

Abstract: The inventions relate generally to protection of computing systems by isolating intrusive attacks into layers, those layers containing at least file objects and being accessible to applications, those layers further maintaining potentially intrusive file objects separately from regular file system objects such that the regular objects are protected and undisturbed. Also disclosed herein are computing systems which use layers and/or isolation layers, and various systems and methods for using those systems. Detailed information on various example embodiments of the inventions are provided in the Detailed Description below, and the inventions are defined by the appended claims.

Abstract: A portable media storage device may include layers permitting applications to be used at a connected computing device, those systems optionally including drivers for operating a public context layered computing environment or a driver installation program. Also disclosed are computer systems for using other systems for creating those portable storage devices.