Richer model of cloud app markets

• US 10,210,014 B2
• Filed: 11/21/2016
• Issued: 02/19/2019
• Est. Priority Date: 10/15/2013
• Status: Active Grant

• Current Assignee: AT&T Intellectual Property I LP (AT&T, Inc.), Rutgers University
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.), Rutgers University
• Inventors: Srivastava, Abhinav, Ganapathy, Vinod
• Primary Examiner(s): Swift, Charles M
• Application Number:
  US15/357,002
• Publication Number:
  US 20170069004A1
• Time in Patent Office: 820 Days
• CPC Class Codes: G06F 2009/45566 Nested virtual machines
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 2009/45591 Monitoring or debugging support
• CPC Class Codes: G06F 2009/45595 Network integration; Enabling network access in virtual machine instances
• CPC Class Codes: G06F 8/60 Software deployment
• CPC Class Codes: G06F 9/455 Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
• CPC Class Codes: G06F 9/45533 Hypervisors; Virtual machine monitors
• CPC Class Codes: G06F 9/45545 Guest-host, i.e. hypervisor is an application program itself, e.g. VirtualBox
• CPC Class Codes: G06F 9/4555 Para-virtualisation, i.e. guest operating system has to be modified
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: G06F 9/50 Allocation of resources, e.g. of the central processing unit [CPU]
• CPC Class Codes: G06F 9/5072 Grid computing
• CPC Class Codes: G06Q 30/0609 Buyer or seller confidence or verification
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

In a cloud app market, a cloud infrastructure customer can purchase apps for performing services such as rootkit detection and network security for a customer virtual machine run by the cloud infrastructure customer. A cloud infrastructure provider executes a provider virtual machine monitor or hypervisor on cloud infrastructure. The cloud app is provided with a customer virtual machine monitor nested on the provider virtual machine monitor. The customer virtual machine, together with a nested management domain of the customer, execute on the customer virtual machine monitor.

Claims

1. A method for implementing a cloud-based app market, comprising:

by a cloud infrastructure provider, advertising a functionality of a virtual machine app for performing a privileged service in connection with a customer work virtual machine under control of a cloud infrastructure customer;

by the cloud infrastructure provider, distributing the virtual machine app via a cloud infrastructure customer download, the virtual machine app executing on a provider virtual machine monitor, the virtual machine app having privileges for accessing privileged information from the customer work virtual machine, the virtual machine app containing a virtual machine app operating system separate from an operating system of the customer work virtual machine, the virtual machine app further containing instructions for performing the privileged service based on the privileged information from the customer work virtual machine;

by the cloud infrastructure provider, providing a provider management virtual machine executing on the provider virtual machine monitor, the provider management virtual machine disallowing interaction between the virtual machine app and virtual machine apps of other cloud infrastructure customers executing on the provider virtual machine monitor; and

disallowing sharing of any data between the virtual machine app and the provider management virtual machine.

2. The method of claim 1, further comprising:

by a privilege model of the provider virtual machine monitor, allowing the customer work virtual machine to delegate privileges to the virtual machine app based on the virtual machine app executing with credentials of the cloud infrastructure customer.

3. The method of claim 1 wherein the instructions for performing the privileged service based on the privileged information from the customer work virtual machine comprise instructions for conducting two-way communication between the customer work virtual machine and the virtual machine app.

4. The method of claim 3 wherein the instructions for performing the privileged service based on the privileged information from the customer work virtual machine comprise instructions for performing a service selected from a group consisting of a checkpointing service, an antivirus service, an intrusion detection service and a virtual machine introspection service.

5. The method of claim 3 wherein the instructions for performing the privileged service based on the privileged information from the customer work virtual machine comprise instructions for implementing rootkit detector.

6. The method of claim 1 wherein the virtual machine app has privileges to map memory pages of the customer work virtual machine.

7. The method of claim 1 wherein disallowing sharing of any data between the virtual machine app and the provider management virtual machine further comprises specifying via Xen grant tables that the customer work virtual machine establishes no shared pages with the provider management virtual machine.

8. A computer system for providing cloud computing platform services by a cloud infrastructure provider to a cloud infrastructure customer, the computer system comprising at least one processor, at least one storage device and instructions stored on the at least one storage device that, when executed by the at least one processor, create software modules comprising:

a provider virtual machine monitor containing instructions for hosting virtual machines;

a customer work virtual machine hosted by the provider virtual machine monitor and under control of the cloud infrastructure customer, the customer work virtual machine containing instructions for performing a cloud computing function, the customer work virtual machine including a customer work virtual machine operating system;

a virtual machine app hosted by the provider virtual machine monitor, the virtual machine app performing a privileged service in connection with the customer work virtual machine, the virtual machine app having privileges for accessing privileged information from the customer work virtual machine, the virtual machine app having a virtual machine app operating system separate from the customer work virtual machine operating system, the virtual machine app further containing instructions for performing the privileged service based on the privileged information from the customer work virtual machine;

a provider management virtual machine containing a host operating system for managing the computer system, the provider management virtual machine being hosted by the provider virtual machine monitor, the provider management virtual machine containing instructions disallowing interaction between the virtual machine app and virtual machine apps of other cloud infrastructure customers hosted the provider virtual machine monitor; and

the virtual machine app containing instructions disallowing sharing of any data between the virtual machine app and the provider management virtual machine.

9. The computer system of claim 8, wherein the provider virtual machine monitor further includes a privilege model allowing the customer work virtual machine to delegate privileges to the virtual machine app based on the virtual machine app executing with credentials of the cloud infrastructure customer.

10. The computer system of claim 8, wherein the instructions for performing the privileged service based on the privileged information from the customer work virtual machine comprise instructions for conducting two-way communication between the customer work virtual machine and the virtual machine app.

11. The computer system of claim 10, wherein the instructions for performing the privileged service based on the privileged information from the customer work virtual machine comprise instructions for performing a service selected from a group consisting of a checkpointing service, an antivirus service, an intrusion detection service and a virtual machine introspection service.

12. The computer system of claim 10, wherein the instructions for performing the privileged service based on the privileged information from the customer work virtual machine comprise instructions for implementing rootkit detector.

13. The computer system of claim 8, wherein the virtual machine app has privileges to map memory pages of the customer work virtual machine.

14. The computer system of claim 8, wherein the instructions contained in the virtual machine app for disallowing sharing of any data between the virtual machine app and the provider management virtual machine further comprise Xen grant tables specifying that the customer work virtual machine establishes no shared pages with the provider management virtual machine.

15. Computer readable media comprising one or more storage devices, the computer readable media having stored thereon computer readable instructions for execution by processors in a cloud infrastructure provided by a cloud infrastructure provider, wherein execution of the computer readable instructions causes the processors to perform operations comprising:

distributing a virtual machine app via a cloud infrastructure customer download, the virtual machine app executing on a provider virtual machine monitor, the virtual machine app having privileges for accessing privileged information from a customer work virtual machine-under control of a cloud infrastructure customer, the virtual machine app containing a virtual machine app operating system separate from an operating system of the customer work virtual machine, the virtual machine app further containing instructions for performing a privileged service based on the privileged information from the customer work virtual machine;

providing a provider management virtual machine executing on the provider virtual machine monitor, the provider management virtual machine disallowing interaction between the virtual machine app and virtual machine apps of other cloud infrastructure customers executing on the provider virtual machine monitor; and

disallowing sharing of any data between the virtual machine app and the provider management virtual machine.

16. The computer readable media of claim 15, herein the operations further comprise:

by a privilege model of the provider virtual machine monitor, allowing the customer work virtual machine to delegate privileges to the virtual machine app based on the virtual machine app executing with credentials of the cloud infrastructure customer.

17. The computer readable media of claim 15, wherein the instructions for performing the privileged service based on the privileged information from the customer work virtual machine comprise instructions for conducting two-way communication between the customer work virtual machine and the virtual machine app.

18. The computer readable media of claim 17, wherein the instructions for performing the privileged service based on the privileged information from the customer work virtual machine comprise instructions for performing a service selected from a group consisting of a checkpointing service, an antivirus service, an intrusion detection service and a virtual machine introspection service.

19. The computer readable media of claim 15, wherein the virtual machine app has privileges to map memory pages of the customer work virtual machine.

20. The computer readable media of claim 15, wherein disallowing sharing of any data between the virtual machine app and the provider management virtual machine further comprises specifying via Xen grant tables that the customer work virtual machine establishes no shared pages with the provider management virtual machine.