Back to results
US 9,003,408 B2Granted
Providing virtual machine services by isolated virtual machines
AssigneeAdventium Enterprises, LLC
InventorsJason D. Sonnek, Steven A. Harp, J. Thomas Haigh
Life of this patent
Estimating the term…
Abstract
The present disclosure includes methods and systems for providing virtual machine services. A number of embodiments can include a user VM with a virtual workstation, a number of service modules that can provide a number of services without communicating with the user VM and/or the virtual workstation, a communication channel that allows the number of service modules to communicate with each other, a computing device, and a manager. A number of embodiments can also include a virtual machine monitor to enforce an isolation policy within the system.
Claims15
A computer implemented method for providing virtual machine services, the method comprising:
- providing a user virtual machine (VM) having access to a number of virtual resources;
- providing a number of service VMs having a number of service modules that provide a number of services to the user VM by accessing the virtual resources, wherein each of the number of service modules includes:
- a requirements declaration that describes resources required by a corresponding service module;
- a cryptographically signed certificate that allows the corresponding service module to access the number of virtual resources which includes a number of memory pages, network traffic, and a number of virtual storage devices associated with the user VM;
- a management policy that is used to regulate each of the number of service modules;
- a security policy that specifies an access that the corresponding service module can have to the number of memory pages, the network traffic, and the number of virtual storage devices;
- a baseline configuration that establishes settings required to start the corresponding service module in a default mode;
- and
- isolating the user VM from the number of service VMs through a virtual machine monitor that prevents communication between the user VM and the number of service VMs.
6 more elements
A system for providing virtual machine services, comprising:
- a first computing device including processor and memory resources and a virtual machine monitor configured to enforce an isolation policy between a number of virtual machines (VM);
- a user VM that allows a user to access a number of virtual resources;
- a number of service modules within a number of service VMs, wherein each of the number of service modules includes:
- instructions executed to provide security related services;
- an authentication mechanism that is used to uniquely identify each of the service modules and an associated security policy;
- a management policy that regulates the operation of the corresponding service module;
- the security policy that specifies an access that the corresponding service module has to the virtual resources;
- a communication channel that allows the number of service modules to communicate with each other, wherein the number of service modules and the number of service VMs are isolated from the user VM through the communication channel and through the isolation policy enforced by the virtual machine monitor;
- and
- a management module within a management VM that allows a manager to communicate with the number of service modules and the number of service VMs, wherein the management VM is isolated from the user VM and wherein the manager modifies and updates the management policy and the security policy in each of the number of service VMs.
7 more elements
A system for providing virtual machine services, comprising:
- a first computing device including processor and memory resources and a virtual machine monitor configured to enforce an isolation policy between a number of virtual machines (VM);
- a user VM that allows a user to access a number of virtual resources;
- a number of service modules within a number of service VMs, wherein each of the number of service modules includes:
- instructions executed to provide security related services;
- an authentication mechanism that is used to uniquely identify each of the service modules and an associated security policy;
- a management policy that regulates the operation of the corresponding service module;
- the security policy that specifies an access that the corresponding service module has to the virtual resources;
- a communication channel that allows the number of service modules to communicate with each other, wherein the number of service modules and the number of service VMs are isolated from the user VM through the communication channel and through the isolation policy enforced by the virtual machine monitor;
- a management module within a management VM that allows a manager to communicate with the number of service modules and the number of service VMs, wherein the management VM is isolated from the user VM;
- and
- a message broker that restricts access to the communication channel based on an identification assigned to each of the number of service modules by an authentication mechanism.
8 more elements
Dependencies are inferred from the claim text.