Abstract: A method and system for managing files in a server environment includes launching a plurality of Virtual Private Servers (VPSs) in a computing system; copying a content of a file of a VPS to a shared space; providing access to the file copy in the shared space when the VPS attempts to access the file; detecting files with the same content in other VPSs; and providing access to the file copy in the shared space from the other VPSs when they attempt to access their files with the identical content.

Abstract: A computer system includes a Hypervisor having the highest privilege level; a Primary Virtual Machine Monitor (VMM) running with the same or fewer privileges than the Hypervisor; and a Primary Virtual Machine (PVM) without system level privileges and having a Primary operating system (POS) running within it. The POS can be the same operating system that ran on the computer system prior to activation of the Hypervisor. The POS can have hardware drivers used by other components for accessing hardware through the POS. The Hypervisor can have hardware drivers used by other components for accessing hardware through the Hypervisor. Alternatively, the POS can have some hardware drivers used by other components for accessing hardware, and the Hypervisor can have other hardware drivers used by the other components for accessing other hardware through the Hypervisor. The POS can have direct access to at least some real hardware devices.

Abstract: A method and system for handling of potential unsafe instructions and/or for handling transfers of control in a Virtual Machine, that includes generating a frame composed of pages of analyzed code based on original guest code; identifying instructions within the frame that transfer control (or are otherwise unsafe); replacing instructions that transfer the control with an interrupt that transfers control to a stub in non-privileged code; wherein the stub checks whether the control transfer (or instruction) is safe or unsafe, and (i) for unsafe control transfers/unsafe instructions, switches the context to Virtual Machine Monitor; and (ii) for safe control transfers, executes the control transfer in non-privileged mode. The instructions that transfer control can include any of JMP, CALL, RET and RET(n). The instructions that transfer control can also include interrupts.

Abstract: A method of accessing a shareable computer file includes receiving a request to access the shareable computer file, retrieving a file ID from a stub file corresponding to the shareable computer file, retrieving a file name from a database corresponding to the file ID, accessing the shareable computer file if a user has not modified the shareable computer file, and accessing a modified copy of the shareable file stored in the stub file if the user has modified the shareable computer file. A database is generated in operating system space or accessed using the operating system, and includes file IDs and their corresponding file names for shareable computer files. The stub file is generated locally to correspond to the shareable computer file, and includes a modified copy of the shareable computer file if the shareable computer file has been modified, and a link to the shareable computer file if the shareable computer file has not been modified.

Abstract: Data sets and blocks are stored in a set of independent, functionally equivalent chunks. These chunks are placed on different elements of a distributed network to achieve pre-defined level of fault tolerance. Terms of fault tolerance are defined in terms of amount of unavailable sites in the network allowing receipt and access to the data block. Maximal and minimal number of chunks available are variable method parameters. The minimal amount of data chunks K needed to restore a data block is defined. The size of each chunk is approximately 1/K of the original block size. The maximal amounts of chunks are defined during distribution operation and depend upon a requested fault tolerance level. Redundancy in data storage is minimized and varies dynamically by changing the total amount of chunks available. Significant increase in data transfer rate is possible because all block chunks could be transferred in parallel and independently.

Abstract: A system, method and computer program product for sharing files among users of multiple Virtual Environments (VEs). Each VE user has private objects, such as files or directories, that contain links to selected shareable files or directories in a common memory storage area. Each VE user also has a private file area to store files. If a VE user wishes to access a shareable file to perform an action that does not modify the shareable file, then the VE user private file allows the VE user to access the sharable file in a common memory storage area. The VE user private file contains a metadata attribute specifying the link to the shareable file. If the VE user wishes to access a shareable file and perform an operation that modifies the shareable file, the system makes a copy of the shareable file and places the copy in the VE user's private file area.

Abstract: A system for managing administration of computer services provided to users includes a computer system and an operating system running on the computer system. A server process is launched by the computer system for providing services to users. An isolated Virtual Private Server (VPS) has a set of services that perform administrative operations relating to the server process. The server process can be a webserver, a file server, an FTP server, an authentication server, a VPS, a chroot environment, a jail environment, a sand box environment, a print server and a Windows Terminal Service.

Abstract: A method of accessing a shareable computer file includes receiving a request to access the shareable computer file, retrieving a file ID from a stub file corresponding to the shareable computer file, retrieving a file name from a database corresponding to the file ID, accessing the shareable computer file if a user has not modified the shareable computer file, and accessing a modified copy of the shareable file stored in the stub file if the user has modified the shareable computer file. A database is generated in operating system space or accessed using the operating system, and includes file IDs and their corresponding file names for shareable computer files. The stub file is generated locally to correspond to the shareable computer file, and includes a modified copy of the shareable computer file if the shareable computer file has been modified, and a link to the shareable computer file if the shareable computer file has not been modified.

Abstract: A system, method and computer program product for managing computer resources in a computer system running an operating system and a plurality of processes grouped into at least two groups. A set of resource limits corresponds to the processes. A scheduler of resource allocation allocates resources to each process such that total resource allocation to a group to which that process belongs remains constant. The resources comprise, e.g., network bandwidth, number of network connections, I/O bandwidth for peripheral devices, number of operations in a period of time for service operation with countable requests for service, number of operations in a period of time for a daemon with countable requests for service, permission for execution of operation, number of security descriptors, and number of terminals. The scheduler reallocates the resources based on a predictive algorithm, or based on process priority, or based on relative weighting of the processes.

Abstract: Methods and systems for safe execution of guest code in virtual machine context are presented. A method for running a virtual machine in a computing system includes (a) launching a virtual machine monitor (VMM) that uses a software debugger; (b) launching a virtual machine (VM) that can natively run safe instructions; (c) determining, at runtime, if the instruction is safe or potentially unsafe; (d) executing safe instructions in a native mode; and (e) activating control logic to process potentially unsafe instructions in the software debugger. The software debugger can bypass at least one of the potentially unsafe instructions. The potentially unsafe instructions include instructions that cannot be safely executed in the context of the VM, and instructions that can cause unpredictable results in the context of the VM.

Abstract: A method and system for managing files in a server environment includes launching a plurality of Virtual Private Servers (VPSs) in a computing system; copying a content of a file of a VPS to a shared space; providing access to the file copy in the shared space when the VPS attempts to access the file; detecting files with the same content in other VPSs; and providing access to the file copy in the shared space from the other VPSs when they attempt to access their files with the identical content.

Abstract: A method and system for handling of potential unsafe instructions and/or for handling transfers of control in a Virtual Machine, that includes generating a frame composed of pages of analyzed code based on original guest code; identifying instructions within the frame that transfer control (or are otherwise unsafe); replacing instructions that transfer the control with an interrupt that transfers control to a stub in non-privileged code; wherein the stub checks whether the control transfer (or instruction) is safe or unsafe, and (i) for unsafe control transfers/unsafe instructions, switches the context to Virtual Machine Monitor; and (ii) for safe control transfers, executes the control transfer in non-privileged mode. The instructions that transfer control can include any of JMP, CALL, RET and RET(n). The instructions that transfer control can also include interrupts.

Abstract: A method of emulating segment addressing by a processor that includes initiating a Virtual Machine Monitor in a kernel mode; initiating a Virtual Machine in a user mode; forming a dynamically mapped table in Virtual Machine Monitor space, the dynamically mapped table corresponding to a table of segment descriptors of the Virtual Machine; populating the dynamically mapped table with descriptors that raise exceptions upon an attempt by the Virtual Machine to address a corresponding segment; and mapping a descriptor to the dynamically mapped table upon the Virtual Machine's use of that descriptor.

Abstract: A system, method and computer program product for controlling virtual private servers includes a plurality of virtual private servers running on a host computer. An address and a unique identifier can be associated with each virtual private server. A control procedure(s) is within each corresponding virtual private server, and can be used to control that virtual private server in response to control commands. A control interface is outside the virtual private servers and can be used for control of the virtual private servers in response to control commands. The virtual private server can be a Virtual Private Server. The control command can be executable by both the control procedure(s) and the control interface, or can be executable by the control interface if the control procedure(s) is unreachable, or can be executable by the control interface if the virtual private server has failed, or can be executable even if the virtual private server is inaccessible.

Abstract: On-the-fly patching of executable code includes placing a block of modified instructions in memory, identifying a block of code to be patched, storing instructions to be patched from the block of code to be patched in a storage location, change the instructions to be patched to mark instructions, and adding a jump to the block of modified instructions in the block of code. Prior to the placing and the identifying steps, a write flag for a page in memory where the block of code to be patched is located is set to allow writes, and interrupts are masked. The instructions are replaced in reverse order. The mark instructions are the same length, in bytes, as the instructions to be patched. The modified instructions include a resolver to determine a number of instructions of the block of code to be patched that had already been executed.

Abstract: An end user computer includes a processor running an operating system. A plurality of virtual private servers (VPSs) are supported within the operating system. A plurality of applications are available to a user of the end user computer. The applications are launched within different VPSs. At least one of the VPSs has multiple applications launched within it. At least two of the applications are launched within different VPSs, and communicate with each other using secure communications means, such as firewalls, proxies, dedicated clipboards, named pipes, shared memory, dedicated inter-process communications, Local Procedure Calls/Remote Procedure Calls, API, network sockets, TCP/IP communications, network protocol communications and memory mapped files. The VPSs can be dynamically created and terminated.

Abstract: A server includes a host running an operating system kernel. Isolated virtual private servers (VPSs) are supported within the kernel. At least one application is available to users of the VPS. A plurality of interfaces give the users access to the application. Each VPS has its own set of addresses. Each object of each VPS has a unique identifier in a context of the operating system kernel. Each VPS is isolated from objects and processes of another VPS. Each VPS includes isolation of address space of each user from address space of a user on any other VPS, isolation of server resources for each VPS, and failure isolation.

Abstract: A computing system includes a physical server having a single instance of an operating system; and a plurality of virtual environments running on the physical server and directly supported by the single instance of the operating system. Each virtual environment responds to requests from users and appears to the users as a stand-alone server having its own instance of the operating system. Each virtual environment has a plurality of objects associated with it and supported by the operating system. Some of the objects are private and other objects are shared between multiple virtual environments. One virtual environment cannot access private objects of another virtual environment.

Abstract: Data sets and blocks are stored in a set of independent, functionally equivalent chunks. These chunks are placed on different elements of a distributed network to achieve pre-defined level of fault tolerance. Terms of fault tolerance are defined in terms of amount of unavailable sites in the network allowing receipt and access to the data block. Maximal and minimal number of chunks available are variable method parameters. The minimal amount of data chunks K needed to restore a data block is defined. The size of each chunk is approximately 1/K of the original block size. The maximal amounts of chunks are defined during distribution operation and depend upon a requested fault tolerance level. Redundancy in data storage is minimized and varies dynamically by changing the total amount of chunks available. Significant increase in data transfer rate is possible because all block chunks could be transferred in parallel and independently.

Abstract: A system, method and computer program product for providing centralized management of multiple Virtual Execution Environments (VEEs) implemented on multiple physical servers. Each VEE is a virtual server. Multiple virtual servers of various types and formats are implemented on multiple physical servers. The physical servers are connected into a network. An intuitive graphical user interface (GUI) of a central console for remote management and administration of a plurality of virtual servers and multiple physical servers is provided. The system includes server managers controlled from a common control center. The system also includes a database containing configuration data and data related to operation formats of the physical and virtual servers. A server system can be a plurality of physical servers and VEEs implemented on them or it can be a plurality of VEEs executed on one physical server.