Providing excess compute resources with virtualization

• US 10,095,532 B2
• Filed: 04/27/2015
• Issued: 10/09/2018
• Est. Priority Date: 04/28/2014
• Status: Active Grant

• Current Assignee: Netkine Incorporated
• Original Assignee: Netkine Incorporated
• Inventors: Hiltgen, Daniel, Devine, Patrick, Papp, Erik P., Jamil, Mustafa
• Primary Examiner(s): Chen, Qing
• Assistant Examiner(s): Thatcher, Clint A
• Application Number:
  US14/697,203
• Publication Number:
  US 20150309829A1
• Time in Patent Office: 1,261 Days
• Field of Search: 718 1
• CPC Class Codes: G06F 2009/45562 Creating, deleting, cloning virtual machine instances
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 9/45533 Hypervisors; Virtual machine monitors
• CPC Class Codes: G06F 9/45545 Guest-host, i.e. hypervisor is an application program itself, e.g. VirtualBox

Abstract

A main operating system interface engine can be configured to receive instructions from a main operating system of one or more host systems and can manage a virtualized operating system on the one or more host systems, the virtualized operating system appearing distinct from the main operating system to a user of the one or more host systems. A virtualization environment management engine can manage a virtualization environment, the virtualization environment using the virtualized operating system. A virtual machine management engine can manage one or more virtual machine instances in the virtualization environment, each of the one or more virtual machine instances operative to provide virtualized resources of the one or more host systems for a compute access system coupled to the one or more host systems.

Claims

1. A system comprising:

a main operating system interface engine configured to receive instructions from a main operating system of a host system of a plurality of host systems;

a virtualization environment management engine coupled to the main operating system interface engine and operative to manage a virtualization environment of the host system, the virtualization environment using a virtualized operating system, the virtualized operating system appearing distinct from the main operating system of the host system to a user of the host system;

the virtualization environment management engine operative to receive one or more instructions to supply a requested number of virtual machine instances from the plurality of host systems;

in response to the one or more instructions to supply the requested number of virtual machine instances from the plurality of host systems;

a virtual compute class request identification engine is coupled to the virtualization environment management engine and is operative to identify virtualized resources available to execute virtual machine instances from excess compute resources of the host system, a virtual machine management engine coupled to the virtualization environment management engine and operative to determine a number of one or more virtual machine instances that can be supported in the virtualization environment, each of the one or more virtual machine instances operative to provide at least a respective portion of the virtualized resources of the host system for a compute access system coupled to the plurality of host systems, a virtualized compute class association engine coupled to the virtual machine management engine and operative to, based on the virtualized resources, determine one or more virtual machine tiers that are supported by the virtualization environment for the one or more virtual machine instances of the host system, each of the one or more virtual machine tiers corresponding to a different class of virtualized resources of the plurality of host systems, and the virtualized compute class association engine is further operative to;

identify that the host system is configured to support a particular class of a first virtualized resource of the virtualized resources for the virtualization environment, determine a particular amount of a second virtualized resource of the virtualization resources is available for the virtualization environment, based on the particular class of the first virtualized resource and the particular amount of the second virtualized resource, determine that a particular virtual machine tier of the one or more virtual machine tiers is supported by the virtualization environment of the host system; and

wherein the virtual machine management engine comprises a tiered virtual machine selection engine operative to select a respective virtual machine tier, of the one or more virtual machine tiers to associate with each of the one or more virtual machine instances of the host system.

2. The system of claim 1, wherein a file system of the virtualized operating system is visible to a user of the main operating system when the user of the main operating system is within the main operating system.

3. The system of claim 1, wherein the main operating system resides on a first disk partition of the host system, and the virtualized operating system resides on a second disk partition of the host system.

4. The system of claim 1, further comprising a state data transfer engine coupled to the virtualization environment management engine and operative to save a present state of the virtualization environment to a virtualization state file on the host system.

5. The system of claim 4, wherein the state data transfer engine is coupled to the virtual machine management engine and is operative to save a present state of the one or more virtual machine instances to the virtualization state file.

6. The system of claim 4, wherein the virtualization state file comprises a delta disk file that represents a difference of the present state of the virtualization environment and a prior state of the virtualization environment.

7. The system of claim 4, further comprising a delayed virtual machine data uploading engine coupled to the state data transfer engine and operative to upload the virtualization state file to a virtualized compute control and management system using an uploading process executed within the main operating system.

8. The system of claim 7, wherein the uploading process is initiated in response to booting the main operating system.

9. The system of claim 1, further comprising a virtualization environment security engine coupled to the virtualization environment management engine and operative to provide security for the virtualization environment.

10. The system of claim 9, wherein the virtualization environment security engine is coupled to secure hardware of the host system and uses the secure hardware to provide the security for the virtualization environment.

11. The system of claim 10, wherein the secure hardware comprises a chip configured to securely cryptographically sign data in the virtualization environment, wherein in an operation, the securely cryptographically signed data is used to verify that an operating system image of the virtualized operating system is trusted and, after the virtualized operating system is trusted, secure disk access is enabled.

12. The system of claim 9, wherein the virtualization environment security engine is operative to stream at least a portion of the virtualization environment to the compute access system using encrypted blocks secured from decryption by the main operating system.

13. The system of claim 12, wherein the encrypted blocks emulate the virtualized resources.

14. The system of claim 10, wherein the secure hardware is compatible with a centralized shared key, wherein, in an operation, the centralized shared key is shared with the virtualized operating system and used to decrypt disk blocks.

15. The system of claim 9, wherein in an operation, a virtual machine specific key is generated for the one or more virtual machine instances in the virtualization environment of the host system which has a virtual disk or portion of a virtual disk allocated to virtual machine instance hosting functionality or a delta disk where local changes to a central image are stored, wherein the virtual machine specific key is never written to disk, thereby preventing virtual machine images of the one or more virtual machine instances associated with the host system from being decrypted by an untrusted operating system image.

16. The system of claim 1, wherein each of the one or more virtual machine tiers corresponds to a different level of security for the one or more virtual machine instances.

17. The system of claim 1, wherein at least one of the one or more virtual machine tiers uses secure hardware to provide security for virtual machine instances associated with the at least one of the one or more virtual machine tiers.

18. The system of claim 17, wherein the secure hardware comprises a chip configured to hash a virtualized operating system image, cryptographically sign data to be tamper-resistant generating a signed hash included in the data, and send the data to the virtualization environment management engine while retaining tamper-resistance, wherein the virtualization environment management engine compares the signed hash against a known good hash and, if the signed hash and the known good hash match, trusts the virtualized operating system image.

19. The system of claim 1, wherein each of the one or more virtual machine tiers is based on one or more classification criteria, the one or more classification criteria dependent on one or more of:

network bandwidth, network latency, processor performance, storage capacity, storage performance, and available run-time memory.

20. The system of claim 1, further comprising a virtualized compute control and management system coupled to the host system and operative to manage the virtualization environment.

21. The system of claim 20, wherein the virtualized compute control and management system is operative to manage a quality of service associated with the virtualization environment.

22. The system of claim 20, wherein the virtualized compute control and management system is operative to manage a remote lifecycle associated with the virtualization environment.

23. The system of claim 20, wherein the plurality of host systems comprises a first host system and a second host system coupled to the first host system using a logical network, and the virtualized compute control and management system is operative to manage peer-to-peer storage between the first host system and the second host system.

24. The system of claim 20, wherein the plurality of host systems comprises a first host system and a second host system coupled to the first host system using a logical network, and the virtualized compute control and management system is operative to manage a computer cluster formed between the first host system and the second host system.

25. The system of claim 20, wherein the plurality of host systems comprises a first host system and a second host system coupled to the first host system using a logical network, and the virtualized compute control and management system is operative to balance a computing load between the first host system and the second host system.

26. The system of claim 20, wherein the plurality of host systems comprises a first host system and a second host system coupled to the first host system using a logical network, and the virtualized compute control and management system is operative to create one or more secure private networks between the first host system and the second host system.

27. A computer-implemented method comprising:

receiving instructions from a main operating system of a host system of a plurality of host systems;

wherein the host system includes a virtualization environment, the virtualization environment using a virtualized operating system, the virtualized operating system appearing distinct from the main operating system of the host system to a user of the host system;

receiving one or more instructions to supply a requested number of virtual machine instances from the plurality of host systems;

in response to the one or more instructions to supply the requested number of virtual machine instances from the plurality of host systems;

identifying virtualized resources available to execute virtual machine instances from excess compute resources of the host system, determining a number of one or more virtual machine instances that can be supported in the virtualization environment, each of the one or more virtual machine instances operative to provide at least a respective portion of the virtualized resources of the host system for a compute access system coupled to the plurality of host systems, and based on the virtualized resources, determining one or more virtual machine tiers that are supported by the virtualization environment, for the one or more virtual machine instances of the host system, each of the one or more virtual machine tiers corresponding to a different class of virtualized resources of the plurality of host systems, wherein determining the one or more virtual machine tiers that are supported further comprises;

identifying that the host system is configured to support a particular class of a first virtualized resource of the virtualized resources for the virtualization environment, determining a particular amount of a second virtualized resource of the virtualization resources is available for the virtualization environment, based on the particular class of the first virtualized resource and the particular amount of the second virtualized resource, determining that a particular virtual machine tier of the one or more virtual machine tiers is supported by the virtualization environment of the host system; and

selecting a respective virtual machine tier, of the one or more virtual machine tiers, to associate with each of the one or more virtual machine instances.

28. The method of claim 27, wherein the main operating system resides on a first disk partition of the host system, and the virtualized operating system resides on a second disk partition of the host system.

29. The method of claim 27, further comprising storing a present state of the virtualization environment to a virtualization state file on the host system.

30. The method of claim 29, wherein storing a present state of the one or more virtual machine instances to the virtualization state file.

31. The method of claim 29, wherein the virtualization state file comprises a delta disk file that represents a difference of the present state of the virtualization environment and a prior state of the virtualization environment.

32. The method of claim 29, further comprising uploading the virtualization state file to a virtualized compute control and management system using an uploading process executed within the main operating system.

33. The method of claim 32, wherein the uploading process is initiated in response to booting the main operating system.

34. The method of claim 27, wherein the host system comprises secure hardware that provides security for the virtualization environment.

35. The method of claim 34, wherein the secure hardware comprises a chip configured to securely cryptographically sign data in the virtualization environment, wherein in an operation, the securely cryptographically signed data is used to verify an operating system image of the virtualized operating system is trusted and, after the virtualized operating system is trusted, secure disk access is enabled.

36. The method of claim 27, further comprising streaming at least a portion of the virtualization environment to the compute access system using encrypted blocks secured from decryption by the main operating system.

37. The method of claim 36, wherein the encrypted b locks emulate the virtualized resources.

38. The method of claim 27, wherein each of the one or more virtual machine tiers corresponds to a different level of security for the one or more virtual machine instances.

39. The method of claim 27, wherein at least one of the one or more virtual machine tiers uses secure hardware to provide security for virtual machine instances associated with the at least one of the one or more virtual machine tiers.

40. The method of claim 27, wherein each of the one or more virtual machine tiers is based on one or more classification criteria, the one or more classification criteria dependent on one or more of:

network bandwidth, network latency, processor performance, storage capacity, storage performance, and available run-time memory.

41. The method of claim 27, wherein the plurality of host systems comprises a first host system and a second host system coupled to the first host system using a logical network and further comprises peer-to-peer storage between the first host system and the second host system.

42. The method of claim 27, further comprising:

receiving a request for a virtual machine instance of a certain virtual machine tier from the plurality of host systems;

identifying that the one or more virtual machine tiers include the certain virtual machine tier and identifying at least one particular virtual machine instance, the one or more virtual machine instances, associated with the certain virtual machine tier;

fulfilling the request for the virtual machine instance with particular virtualized resources of the particular virtual machine instance.