US 9,852,001 B2 · Compliance-based adaptations in managed virtual systems

Abstract

Techniques are disclosed for controlling and managing virtual machines and other such virtual systems. VM execution approval is based on compliance with policies controlling various aspects of VM. The techniques can be employed to benefit all virtual environments, such as virtual machines, virtual appliances, and virtual applications. For ease of discussion herein, assume that a virtual machine (VM) represents each of these environments. In one particular embodiment, a systems management partition (SMP) is created inside the VM to provide a persistent and resilient storage for management information (e.g., logical and physical VM metadata). The SMP can also be used as a staging area for installing additional content or agentry on the VM when the VM is executed. Remote storage of management information can also be used. The VM management information can then be made available for pre-execution processing, including policy-based compliance testing.

Drawings

Drawings are temporarily unavailable. Open the PDF at USPTO

Drawings

Claims50

Dependent claims

A method for enforcing a policy associated with a virtual appliance, the method comprising:

receiving a virtual appliance event request;
receiving first data about the virtual appliance in response to receiving the virtual appliance event request, wherein the first data about the virtual appliance was extracted prior to initiating the virtual appliance and prior to receiving the virtual appliance event request, and the first data was stored prior to receiving the virtual appliance event request for later processing after receiving the virtual appliance event request;
receiving second different data from an environment outside the virtual appliance in response to receiving the virtual appliance event request;
determining whether an internal non-compliance by the virtual appliance of a first policy-based compliance scheme exists based on the first data that was stored prior to receiving the virtual appliance event request;
determining whether an external non-compliance by the virtual appliance as provided in the environment of a second different policy-based compliance scheme exists based on the second different data;
and
in response to determining that at least one of the internal non-compliance and the external non-compliance exists, at least one of denying the virtual appliance event request, providing a notification of non-compliance, adapting the virtual appliance, and adapting the environment.

4 more elements

An apparatus for enforcing a policy associated with a virtual appliance, the apparatus comprising:

a hardware processor, and
a machine readable medium storing instructions which, when executed by the hardware processor, cause the hardware processor to:
receive a virtual appliance event request;
receive first data about the virtual appliance in response to receiving the virtual appliance event request, wherein the first data about the virtual appliance was extracted prior to initiating the virtual appliance and prior to receiving the virtual appliance event request, and the first data was stored prior to receiving the virtual appliance event request for later processing after receiving the virtual appliance event request;
receive second different data from an environment outside the virtual appliance in response to receiving the virtual appliance event request;
determine whether an internal non-compliance by the virtual appliance of a first policy-based compliance scheme exists based on the first data that was stored prior to receiving the virtual appliance event request;
determine whether an external non-compliance by the virtual appliance as provided in the environment of a second different policy-based compliance scheme exists based on the second different data;
and
in response to determining that at least one of the internal non-compliance and the external non-compliance exists, at least one of deny the virtual appliance event request, provide a notification of non-compliance, adapt the virtual appliance, and adapt the environment.

6 more elements

A non-transitory machine readable medium storing a program for enforcing a policy associated with a virtual appliance, which when executed by a processor, causes the processor to:

receive a virtual appliance event request;
receive first data about the virtual appliance in response to receiving the virtual appliance event request, wherein the first data about the virtual appliance was extracted prior to initiating the virtual appliance and prior to receiving the virtual appliance event request, and the first data was stored prior to receiving the virtual appliance event request for later processing after receiving the virtual appliance event request;
receive second different data from an environment outside the virtual appliance in response to receiving the virtual appliance event request;
determine whether an internal non-compliance by the virtual appliance of a first policy-based compliance scheme exists based on the first data that was stored prior to receiving the virtual appliance event request;
determine whether an external non-compliance by the virtual appliance as provided in the environment of a second different policy-based compliance scheme exists based on the second different data;
and
in response to determining that at least one of the internal non-compliance and the external non-compliance exists, at least one of deny the virtual appliance event request, provide a notification of non-compliance, adapt the virtual appliance, and adapt the environment.

4 more elements

Dependencies are inferred from the claim text.

Description20,343 words

Summary1,386 words

#This application is related to U.S. application Ser. No. 11/550,348, filed Oct. 17, 2006, titled “Control and Management of Virtual Systems. In addition, this application is related to U.S. application Ser. No. 11/550,356, filed Oct. 17, 2006, titled “Registering and Accessing Virtual Systems for Use in a Managed System”. In addition, this application is related to U.S. application Ser. No. 11/550,364, filed Oct. 17, 2006, titled “Enforcement of Compliance Policies in Managed Virtual Systems”. In addition, this application is related to U.S. application Ser. No. 11/550,368, filed Oct. 17, 2006, titled “Automatic Optimization for Virtual Systems”. In addition, this application is related to U.S. application Ser. No. 11/945,945, filed Nov. 27, 2007, titled “Control and Management of Virtual Systems”. In addition, this application is related to U.S. application Ser. No. 11/945,923, filed Nov. 27, 2007, titled “Registering and Accessing Virtual Systems for Use in a Managed System”. In addition, this application is related to U.S. application Ser. No. 11/945,927, filed Nov. 27, 2007, titled “Enforcement of Compliance Policies in Managed Virtual Systems”. In addition, this application is related to U.S. application Ser. No. 11/945,941, filed Nov. 27, 2007, titled “Automatic Optimization for Virtual Systems”. Each of these applications is herein incorporated in its entirety by reference.

#The invention relates to virtual execution environments, and more particularly, to the control and management of virtual systems such as virtual machines, virtual appliances, and virtual applications.

#Virtual machines are becoming increasingly prevalent and there are a number of commercial vendors and open source products providing or enabling virtual machine environments. Such enablement involves getting virtual machine monitors (hosts or VMMs) running on a variety of hardware platforms and then allowing virtual machines (guests or VMs) to run in those environments.

Brief description of the drawings14 figures

#FIG. 1 illustrates a virtual environment configured in accordance with one embodiment of the present invention.

#FIG. 2a illustrates a VM management module configured in accordance with an embodiment of the present invention.

#FIG. 2b illustrates different control points and actions that can be called by the event handler module shown in FIG. 2a, in accordance with an embodiment of the present invention.

Detailed description18,675 words

#Techniques are disclosed for controlling and managing virtual machines and other such virtual systems. Traditional VMM/host environments employ the concept of admission control, which is quantitative in nature, in that VMs are only allowed to execute if there are enough resources (e.g., memory, swap space and bandwidth) for the VM to execute and run. One technique described herein is qualitative, in that VM execution approval is based on compliance with various policies, such as those regarding one or more of VM content, VM characteristics, execution context (e.g., production vs. test), change management, configuration management, asset management, version control, security management, license management, and resource management. These policies can be stored in a single or multiple locations. They can be contained in files, databases, directories, repositories, or other external policy stores, such as a CMDB, inventory database, or version control system. The techniques can be employed to benefit all virtual environments, such as virtual machines, virtual appliances, and virtual applications. For ease of discussion herein, assume that a virtual machine (VM) represents each of these environments.

#General Overview

#An effective way to manage management information associated with a VM is to create a new, resilient location to store the management information. This location can be attached to the VM or within the VM itself, in accordance with one embodiment of the present invention. Creating a new virtual partition or disk inside the VM provides an ideal location that will survive transportation, conversion etc and can even be used for introspection from the VM itself, as will be explained in turn. Such a virtual partition or disk is referred to herein as a systems management partition (SMP). This SMP travels with other VM disks/partitions, such as the operating system, applications, and data drives. Conversion, migration, and transformation utilities can be used to transport the SMP transparently, with such utilities being unaware that the SMP is for VM management. The VM management information can be stored across executions and vendors.

Facts

Application

14/922,979Filed 26 Oct 2015 · continuation

Priority

17 Oct 2006

Published

US 2016/0055026 A125 Feb 2016

Granted

26 Dec 2017

Term ends

2 Jan 2027

Estimated · how

20 years from earliest known nonprovisional domestic filing plus recorded patent term adjustment, including 77 days of adjustment. Maintenance-fee lapses, terminal disclaimers and statutory extensions have not been checked. The continuity chain may be incomplete; this is not an enforceability determination.

Classification14 codes

G06F 9/45558
Hypervisors; Virtual machine monitors: hypervisor-specific management and integration aspects
G06F 9/45533
Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines:…
G06F 21/51
Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems: at application…
G06F 21/56
Detecting local intrusion or implementing counter-measures: computer malware detection or handling, e.g. anti-virus arrangements

Family

Application11/550,362Parent of this continuation-in-part · filed 17 Oct 2006

Application11/945,935Parent of this continuation · filed 27 Nov 2007

Application13/490,949Parent of this continuation · filed 7 Jun 2012

US 8,234,641 B2Parent of this continuation · filed 31 Jul 2012

US 8,234,640 B1Parent of this continuation-in-part · filed 31 Jul 2012

Application14/479,464Parent of this continuation · filed 8 Sep 2014

US 8,832,691 B2Parent of this continuation · filed 9 Sep 2014

US 2016/0055026 A1Pre-grant publication · published 25 Feb 2016

US 9,170,833 B2Parent of this continuation

Application14/479,464Parent of this continuation

Application13/490,949Parent of this continuation

Application11/945,935Parent of this continuation-in-part

US 2008/0134177 A1Published application

US 2012/0284715 A1Published application

US 2014/0380412 A1Published application

US 9,852,001 B2This patent

From the US filing history. Foreign family members aren’t listed.

Timeline

17 Oct 2006Priority claimedParent application 11/550,362
26 Oct 2015Application filedUS 14/922,979
28 Oct 2015Assigned to Manageiq, Inc.assignment of assignor's interest
25 Feb 2016PublishedUS 2016/0055026 A1
26 Dec 2017GrantedUS 9,852,001 B2
12 Oct 2026TodayWithin its term
2 Jan 2027Term endsEstimated, includes 77 days of adjustment

Compliance-based adaptations in managed virtual systems

Life of this patent

Compliance-based adaptations in managed virtual systems

Life of this patent

Life of this patent

Abstract

Drawings

Drawings

Claims50

Description20,343 words

Drawings

Classification14 codes

Life of this patent

Description20,343 words