# US 2019/0173846 A1 · Dedicating hardware devices to virtual machines in a computer system > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2019/0173846 A1 - Document ID: US20190173846A1 - Status: Published application - Kind: A1 - Application number: 15/831,610 - Filed: 2017-12-05 - Published: 2019-06-06 - Earliest claimed: 2017-12-05 - Assignees: Assured Information Security, Inc. - Applicants: Assured Information Security, Inc. - Inventors: Christopher James PATTERSON; Rian QUINN; Katherine Julia TEMKIN; Harlan Philip WHITE - Web page: https://patentgrep.com/patent/US20190173846A1 ## CPC - H04L 63/0272: {Virtual private networks} - G06F 9/45545: {Guest-host, i.e. hypervisor is an application program itself, e.g. VirtualBox} - G06F 9/45558: {Hypervisor-specific management and integration aspects} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 67/131: Protocols for games, networked simulations or virtual reality - G06F 2009/45579: {I/O management, e.g. providing access to device drivers or storage} - G06F 2009/45587: {Isolation or security of virtual machine instances} - G06F 2009/45595: {Network integration; Enabling network access in virtual machine instances} - H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Dedicating hardware devices to virtual machines includes dedicating, by a hypervisor executing on a computer system, a set of hardware devices of the computer system to a first virtual machine of the hypervisor, the first virtual machine executing a guest operating system, and the set of hardware devices for use by the guest operating system in execution of the guest operating system, and dedicating network device hardware of the computer system to a second virtual machine of the hypervisor, the second virtual machine being a different virtual machine than the first virtual machine, wherein network communication between the guest operating system and a network to which the computer system is connected via the network device hardware occurs via the second virtual machine. ## Claims ### Claim 1 A computer-implemented method comprising: dedicating, by a hypervisor executing on a computer system, a set of hardware devices of the computer system to a first virtual machine of the hypervisor, the first virtual machine executing a guest operating system, and the set of hardware devices for use by the guest operating system in execution of the guest operating system; and dedicating network device hardware of the computer system to a second virtual machine of the hypervisor, the second virtual machine being a different virtual machine than the first virtual machine, wherein network communication between the guest operating system and a network to which the computer system is connected via the network device hardware occurs via the second virtual machine. ### Claim 2 (depends on 1) The method of claim 1, wherein the set of hardware devices and the network device hardware are part of hardware of the computer system and wherein the dedicating the set of hardware devices and the dedicating the network device hardware partitions the hardware of the computer system absent multiplexing usage of the hardware by virtual machines of the hypervisor. ### Claim 3 (depends on 1) The method of claim 1, wherein the network device hardware comprises a network interface card. ### Claim 4 (depends on 3) The method of claim 3, wherein the dedicating the network device hardware to the second virtual machine comprises placing into the second virtual machine a network stack facilitating the network communication between the guest operating system and the network to which the computer system is connected. ### Claim 5 (depends on 4) The method of claim 4, wherein the dedicating the network device hardware to the second virtual machine dedicates network interface interrupts, generated by the network device hardware, to the second virtual machine for handling. ### Claim 6 (depends on 1) The method of claim 1, further comprising interposing one or more additional virtual machines between the first virtual machine and the second virtual machine along a network communication path across which the network communication is passed. ### Claim 7 (depends on 6) The method of claim 6, wherein the one or more additional virtual machines implement at least one guard configured for constraining communications between the first virtual machine and the second virtual machine. ### Claim 8 (depends on 6) The method of claim 6, wherein each virtual machine of the one or more additional virtual machines performs encryption on communications between the first virtual machine and the second virtual machine. ### Claim 9 (depends on 1) The method of claim 1, wherein an operating system is installed on the computer system prior to installation of the hypervisor, and wherein the hypervisor is installed on the computer system at a higher privilege level than the installed operating system and forces isolation of the installed operating system into the first virtual machine as the guest operating system thereof. ### Claim 10 (depends on 1) The method of claim 1, wherein the hypervisor comprises configuration information indicating enabling hardware, of the computer system, that enables operation of the guest operating system, and wherein the hypervisor dedicates, on the basis of the configuration information, the allowed hardware, as the set of hardware devices, to the guest operating system and blocks direct access by the guest operating system to a remainder of the hardware, of the computer system, not indicated as enabling hardware. ### Claim 11 A computer program product comprising: a computer readable storage medium storing instructions for execution to perform a method comprising: dedicating, by a hypervisor executing on a computer system, a set of hardware devices of the computer system to a first virtual machine of the hypervisor, the first virtual machine executing a guest operating system, and the set of hardware devices for use by the guest operating system in execution of the guest operating system; and dedicating network device hardware of the computer system to a second virtual machine of the hypervisor, the second virtual machine being a different virtual machine than the first virtual machine, wherein network communication between the guest operating system and a network to which the computer system is connected via the network device hardware occurs via the second virtual machine. ### Claim 12 (depends on 11) The computer program product of claim 11, wherein the set of hardware devices and the network device hardware are part of hardware of the computer system and wherein the dedicating the set of hardware devices and the dedicating the network device hardware partitions the hardware of the computer system absent multiplexing usage of the hardware by virtual machines of the hypervisor. ### Claim 13 (depends on 11) The computer program product of claim 11, wherein the method further comprises interposing one or more additional virtual machines between the first virtual machine and the second virtual machine along a network communication path across which the network communication is passed. ### Claim 14 (depends on 13) The computer program product of claim 13, wherein the one or more additional virtual machines implement at least one guard configured for constraining communications between the first virtual machine and the second virtual machine. ### Claim 15 (depends on 11) The computer program product of claim 11, wherein the hypervisor comprises configuration information indicating enabling hardware, of the computer system, that enables operation of the guest operating system, and wherein the hypervisor dedicates, on the basis of the configuration information, the allowed hardware, as the set of hardware devices, to the guest operating system and blocks direct access by the guest operating system to a remainder of the hardware, of the computer system, not indicated as enabling hardware. ### Claim 16 A computer system configured to perform a method, the method comprising: dedicating, by a hypervisor executing on a computer system, a set of hardware devices of the computer system to a first virtual machine of the hypervisor, the first virtual machine executing a guest operating system, and the set of hardware devices for use by the guest operating system in execution of the guest operating system; and dedicating network device hardware of the computer system to a second virtual machine of the hypervisor, the second virtual machine being a different virtual machine than the first virtual machine, wherein network communication between the guest operating system and a network to which the computer system is connected via the network device hardware occurs via the second virtual machine. ### Claim 17 (depends on 16) The computer system of claim 16, wherein the set of hardware devices and the network device hardware are part of hardware of the computer system and wherein the dedicating the set of hardware devices and the dedicating the network device hardware partitions the hardware of the computer system absent multiplexing usage of the hardware by virtual machines of the hypervisor. ### Claim 18 (depends on 16) The computer system of claim 16, wherein the method further comprises interposing one or more additional virtual machines between the first virtual machine and the second virtual machine along a network communication path across which the network communication is passed. ### Claim 19 (depends on 18) The computer system of claim 18, wherein the one or more additional virtual machines implement at least one guard configured for constraining communications between the first virtual machine and the second virtual machine. ### Claim 20 (depends on 16) The computer system of claim 16, wherein the hypervisor comprises configuration information indicating enabling hardware, of the computer system, that enables operation of the guest operating system, and wherein the hypervisor dedicates, on the basis of the configuration information, the allowed hardware, as the set of hardware devices, to the guest operating system and blocks direct access by the guest operating system to a remainder of the hardware, of the computer system, not indicated as enabling hardware.