Method, apparatus and system for virtualized peer-to-peer proxy services

• US 20050289648A1
• Filed: 06/23/2004
• Published: 12/29/2005
• Est. Priority Date: 06/23/2004
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Grobman, Steven, Jones, Carl C.
• Granted Patent: US 7,788,713 B2
• Time in Patent Office: Days
• US Class Current: 726/12
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 2009/45595 Network integration; Enabling network access in virtual machine instances
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: H04L 12/1886 with traffic restrictions for efficiency improvement, e.g. involving subnets or subdomains
• CPC Class Codes: H04L 63/0281 Proxies

Abstract

A method, apparatus and system for virtualized proxy services are disclosed herein. Specifically, on one embodiment, a virtual proxy may be implemented in a virtual machine host. The virtual proxy may reside within a dedicated or shared virtual partition and may include a set of access restrictions. In one embodiment, a network including virtual machine hosts having virtual proxies may also provide additional peer-to-peer services. More specifically, a virtual proxy on a virtual host may be configured to broadcast/multicast content requests to other virtual hosts on the network prior to accessing the content from a remote location. If the content has previously been downloaded by another virtual host on the network, the virtual proxy on the requesting host may copy the content from the peer virtual host, instead of downloading the content from the remote location again. A variety of security measures may be implemented in one embodiment to ensure data integrity.

Claims

1. A method for providing a virtual proxy, comprising:

starting up a virtual proxy in a first virtual machine (“

VM”

) on a VM host, the virtual proxy capable of;

intercepting a content request from a second VM on the VM host; and

enforcing access restrictions on the content request.

2. The method according to claim 1 wherein the virtual proxy is further capable of:

routing the content request to a content source if the content request clears the access restrictions; and

denying the content request if the content request fails to clear the access restrictions.

3. The method according to claim 1 wherein the virtual proxy is further capable of caching content received in response to the content request.

4. The method according to claim 3 wherein the virtual proxy is further capable of:

receiving a second content request wherein the cached content is responsive to the second content request; and

responding to the second content request by providing a hash value of the cached content.

5. A method for providing a virtual proxy, comprising:

starting up a virtual proxy in a first virtual machine (“

VM”

) on a first VM host coupled to a network, the virtual proxy capable of;

intercepting a content request from a second VM on the first VM host;

enforcing access restrictions on the content request;

transmitting the content request via a broadcast protocol to other VM hosts coupled to the network; and

receiving a response from at least one of the other VM hosts coupled to the network if the at least one of the other VM hosts contains content corresponding to the content request.

6. The method according to claim 5 wherein the virtual proxy is further capable of:

examining the response from the at least one of the other VM hosts;

validating the content on the at least one of the other VM hosts using the response; and

determining based on the validation whether to copy the content from the at least one other VM host to the first VM host.

7. The method according to claim 6 wherein the response from the at least one other VM hosts comprises a hash value of the content.

8. The method according to claim 7 wherein validating the content further comprises one of:

comparing the hash value of the content from the at least one of the other VM hosts to a hash value requested from an authoritative site and requesting the authoritative site to validate the content by providing the authoritative entity with the hash value of the content from the at least one of the other VM hosts.

9. The method according to claim 8 wherein the virtual proxy is further capable of copying the content from the at least one other of the VM hosts to the first VM host if the content passes validation and selecting a second of the other VM hosts that responded if the content fails validation.

10. The method according to claim 9 wherein the virtual proxy is further capable of calculating a final hash value to validate the content if the content is copied from the at least one other of the VM hosts.

11. The method according to claim 10 wherein if the final hash value does not validate the content, the virtual proxy is capable of:

discarding the content; and

selecting one of;

a third of the other VM hosts that responded, and

a remote site containing the content.

12. A system for providing a virtual proxy, comprising:

a virtual machine manager;

a first virtual machine coupled to the virtual machine manager;

a second virtual machine coupled to the virtual machine manager;

a virtual proxy coupled to the virtual machine manager, the virtual proxy capable of intercepting content requests from the first virtual machine and the second virtual machine, the virtual proxy additionally capable of enforcing access restrictions to content corresponding to the content requests.

13. The system according to claim 12 wherein the virtual proxy is further capable of:

routing the content requests to a content source if the content request clear the access restrictions; and

denying the content requests if the content request fail to clear the access restrictions.

14. The system according to claim 13 wherein the virtual proxy is further capable of caching the content corresponding to the content requests.

15. The system according to claim 14 wherein the virtual proxy is further capable of:

receiving a second content request for the cached content received; and

responding to the second content request by providing a hash value of the cached content.

16. A system for providing a virtual proxy, comprising:

a first virtual machine (“

VM”

) host coupled to a network;

other VM hosts coupled to the network;

a virtual proxy in the first VM host, the virtual proxy capable of;

intercepting a content request from a VM on the first VM host;

enforcing access restrictions on the content request;

transmitting the content request via a broadcast protocol to the other VM hosts coupled to the network; and

receiving a response from at least one of the VM hosts coupled to the network if the at least one of the VM hosts contains content corresponding to the content request.

17. The system according to claim 16 wherein the virtual proxy is further capable of:

examining the response from the at least one of the other VM hosts;

validating the content on the at least one of the other VM hosts using the response;

determining based on the validation whether to copy the content from the at least one of the other VM hosts to the first VM host.

18. The system according to claim 17 wherein the response from the at least one of the other VM hosts comprises a hash value of the content.

19. The system according to claim 18 wherein the virtual proxy validates the content by one of:

comparing the hash value of the content from the at least one of the other VM hosts to a hash value requested from an authoritative entity, and

requesting the authoritative entity to validate the content.

20. The system according to claim 19 further wherein the virtual proxy is further capable of copying the content from the second VM host to the first VM host if the content passes validation and selecting a second of the other VM hosts that responded if the content fails validation.

21. The system according to claim 20 wherein the virtual proxy is further capable of calculating a final hash value to validate the content if the content is copied from the at least one other of the VM hosts.

22. The system according to claim 21 wherein if the final hash value does not validate the content, the virtual proxy is capable of:

discarding the content; and

selecting one of;

a third of the other VM hosts that responded, and

a remote site containing the content.

23. An article comprising a machine-accessible medium having stored thereon instructions that, when executed by a rnachine, cause the machine to:

start up a virtual proxy in a first virtual machine (“

VM”

) on a VM host, the virtual proxy capable of;

intercepting a content request from a second VM on the VM host; and

enforcing access restrictions on the content request.

24. The article according to claim 23 wherein the instructions, when executed by the machine, further cause the machine to:

route the content request to a content source if the content request clears the access restrictions; and

deny the content request if the content request fails to clear the access restrictions.

25. The article according to claim 23 wherein the instructions, when executed by the machine, further cause the machine to cache content received in response to the content request.

26. The article according to claim 25 wherein the instructions, when executed by the machine, further cause the machine to provide the virtual proxy capable of:

receiving a second content request for the cached content; and

responding to the second content request by providing a hash value of the cached content.

27. An article comprising a machine-accessible medium having stored thereon instructions that, when executed by a machine, cause the machine to:

start up a virtual proxy in a first virtual machine (“

VM”

) on a first VM host coupled to a network, the virtual proxy capable of;

intercepting a content request from a second VM on the first VM host;

enforcing access restrictions on the content request;

transmitting the content request via a broadcast protocol to other VM hosts coupled to the network; and

receiving a response from at least one of the other VM hosts coupled to the network if the at least one of the other VM hosts contains content corresponding to the content request.

28. The article according to claim 27 wherein the instructions, when executed by the machine, further cause the machine to:

examine the response from the at least one of the other VM hosts;

validate the content on the at least one of the other VM hosts using the response; and

determine based on the validation whether to copy the content from the at least one of the other VM hosts to the first VM host.

29. The article according to claim 28 wherein the response from the at least one of the other VM hosts comprises a hash value of the content.

30. The article according to claim 29 wherein the instructions, when executed by the machine, further cause the machine to validate the content by one of:

comparing the hash value of the content from the at least one of the other VM hosts to a hash value requested from an authoritative entity and requesting the authoritative entity to validate the content.

31. The article according to claim 30 wherein the instructions, when executed by the machine, further cause the machine to copy the content from the at least one other VM host to the first VM host if the hash value of the content from the at least one other VM host matches the hash value requested from the authoritative entity.

32. The article according to claim 31 wherein the instructions, when executed by the machine, further cause the machine to calculate a final hash value corresponding to the content copied from the at least one other VM host to validate the content.

33. The article according to claim 32 wherein the instructions, when executed by the machine, further cause the machine to discard the content and select one of:

a third of the other VM hosts that responded, and a remote site containing the content, if the final hash value does not validate the content.