Virtual machine based network carriers

• US 20070079307A1
• Filed: 09/30/2005
• Published: 04/05/2007
• Est. Priority Date: 09/30/2005
• Status: Abandoned Application

• Current Assignee: Dell Products LP (Dell Technologies Inc.)
• Original Assignee: Dell Products LP (Dell Technologies Inc.)
• Inventors: Abels, Timothy, Dhawan, Puneet
• Application Number:
  US11/239,750
• Publication Number:
  US 20070079307A1
• Time in Patent Office: Days
• US Class Current: 718/1
• CPC Class Codes: G06F 2009/4557 Distribution of virtual machine instances; Migration and load balancing
• CPC Class Codes: G06F 2009/45595 Network integration; Enabling network access in virtual machine instances
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: H04L 2101/622 Layer-2 addresses, e.g. medium access control [MAC] addresses
• CPC Class Codes: H04L 61/2596 Translation of addresses of the same type other than IP, e.g. translation from MAC to MAC addresses
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/63 Routing a service request depending on the request content or context

Abstract

A system and method is disclosed for the secure transfer of data by carrier virtual machines between participating physical hosts through a virtual network (VNET) implemented on one or more internal and/or external networks. The method of the invention can provide additional security controls, comprising parameters that may include, but are not limited to, time-to-live (TTL), access control lists (ACLs), usage policies, directory roles, etc. Additionally, access to one or more of a plurality of carrier virtual machine payloads by security groups, individual access, subdivided individual access, and MIME-like subdivision of a VM-encapsulated payload may be controlled, thereby providing the carrier VM the ability to carry many secured payloads. In addition, VM packets, a group of packets, a single VM, or subpackets within a VM between network endpoints, or at a predetermined intermediary network point, may be quarantined to realize further security. Individual or combinations of these functionalities on carrier virtual machines, and by extension, application and/or one or more sets of secure data may be implemented.

Claims

1. A system for transferring data on a network, comprising:

a first information handling system operably connected to said network;

a first virtual machine implemented on said first information handling system, said first virtual machine comprising a payload; and

a second information handling system operably connected to said network;

wherein said first virtual machine is operable to migrate from said first information handling system to said second information handling system, thereby transporting said payload over said network.

2. The system of claim 1, wherein said payload comprises an application.

3. The system of claim 2, wherein said application comprises a software program that executes within said first virtual machine.

4. The system of claim 1, wherein said payload comprises a second virtual machine.

5. The system of claim 1, wherein said first virtual machine comprises a routing and policy wrapper.

6. The system of claim 5, wherein said second information handling system is operable to use said routing and policy wrapper to translate between physical network addresses and virtual network addresses.

7. The system of claim 6, wherein said first virtual machine has an operational lifetime governed by a time-to-live parameter.

8. The system of claim 7, further comprising an autorun script operating on said payload.

9. A method for transferring data on a network, comprising:

implementing a first virtual machine on a first information handling system operably connected to said network, said first virtual machine comprising a payload; and

migrating said first virtual machine from said first information handling system to a second information handling system, thereby transporting said payload over said network.

10. The method of claim 9, wherein said payload comprises an application.

11. The method of claim 10, wherein said application comprises a software program that executes within said first virtual machine.

12. The method of claim 9, wherein said payload comprises a second virtual machine.

13. The method of claim 9, wherein said first virtual machine comprises a routing and policy wrapper.

14. The method of claim 13, wherein said second information handling system is operable to use said routing and policy wrapper to translate between physical network addresses and virtual network addresses.

15. The method of claim 14, wherein said first virtual machine has an operational lifetime governed by a time-to-live parameter.

16. The method of claim 15, further comprising an autorun script operating on said first virtual machine.

17. A system for transferring data over a network, comprising:

a first information handling system operably connected to said network;

a first virtual machine implemented on said first information handling system, said first virtual machine comprising a payload; and

a second information handling system operably connected to said network;

wherein said first virtual machine is operable to migrate from said first information handling system to said second information handling system, thereby transporting said payload over said network; and

wherein said second information handling system is operable to generate a second virtual machine and to transfer said payload from said first virtual machine to said second virtual machine.

18. The system according to claim 17, further comprising a third information handling system, wherein said second virtual machine is operable to migrate from said second information handling system to said third information handling system.

19. The system of claim 18, wherein said first virtual machine virtual machine has an operational lifetime governed by a time-to-live parameter.

20. The system of claim 19, further comprising an autorun script operating on the host environment of said first virtual machine, thereby securing said environment.