Virtual environment manager

• US 20070089111A1
• Filed: 09/29/2006
• Published: 04/19/2007
• Est. Priority Date: 12/17/2004
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Knauerhase, Robert, Tewari, Vijay, Robinson, Scott
• Granted Patent: US 9,606,821 B2
• Time in Patent Office: Days
• US Class Current: 718/1
• CPC Class Codes: G06F 2009/45562 Creating, deleting, cloning virtual machine instances
• CPC Class Codes: G06F 2009/45566 Nested virtual machines
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 9/45545 Guest-host, i.e. hypervisor is an application program itself, e.g. VirtualBox
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations

Abstract

A virtual environment manager (“VEM”) simplifies the usability of virtual machines and provides users with an enhanced design for creating and/or for managing virtual machines (“VMs”). For example, a user can select description information and management information to be included in descriptors and according to which a VEM will create and manage various VM environments for various host environments. The VEM automatically creates the VM environments and host environments by sending descriptor description information and data files associated with the description information to virtual machine monitors (VMMs), which create the VM environments according to the description information. A VEM at each host may manage VM environments executed by the VMM, according to the descriptor management information. Thus, a set of descriptors to create and manage a set of VMs for a home computer may be easily modified by a user to create and manage a set of VMs for a work or laptop computer.

Claims

1. A method for creating a logically unified compute environment, comprising:

collecting a plurality of user identities of users of one or more virtual machine (VM) environments;

collecting a plurality of VM descriptors applicable to the plurality of user identities;

collecting a plurality of VM instantiations according to the VM descriptors.

2. The method of claim 1, further comprising creating the logically unified compute environment across one or more hosts.

3. The method of claim 1, further comprising creating the logically unified compute environment across a collection of one or more user identities

4. The method of claim 1, further comprising creating the logically unified compute environment across one or more VMMs.

5. The method of claim 4, wherein creating the logically unified compute environment across one or more VMMs further comprises:

hosting the first VM environment on a first virtual machine monitor (VMM);

hosting the second VM environment on a different second VMM;

sending the first descriptor and first data files to the first VMM;

sending the second descriptor and second data files to the second VMM;

referencing the first descriptor;

referencing the second descriptor;

accessing the first data files from a first data storage device;

accessing the second data files from a second data storage device,

wherein the first data is associated with the first descriptor and the second data is associated with the second descriptor.

6. The method of claim 1, further comprising:

using a virtual environment manager (VEM) to create a first virtual machine (VM) environment of the one or more VM environments according to a first descriptor of the plurality of VM descriptors;

using a virtual environment manager (VEM) to create a second virtual machine (VM) environment of the one or more VM environments according to a second descriptor of the plurality of VM descriptors,

wherein the second descriptor is a modified version of the first descriptor and the second VM environment includes one of constrained facets and extended facets on the behavior of the first VM environment.

7. The method of claim 6, wherein the VEM is a first VEM, and further comprising:

accessing the first virtual environment manager (VEM) only by using a unified single user sign-on;

one of sending and importing the first descriptor from the first virtual environment manager (VEM) to a second VEM; and

modifying the first descriptor at the second VEM to create the second descriptor.

8. The method of claim 6, wherein the constraining facets comprise a restriction of one of access to a hardware resource, functionality of a software application, a read data permission, a write data permission, a user sign on authentication for access, a user permission for use, and a management policy of the second VM environment as compared to the first VM environment.

9. The method of claim 8, wherein the first descriptor comprises first information describing the first VM environment, the second descriptor comprises second information describing the second VM environment, and the difference between the first descriptor and the second descriptor describes the constrained facets.

10. The method of claim 8, further comprising:

automatically creating the first VM environment on a first virtual machine monitor (VMM) host using first data associated with the first descriptor, without user selection of the first data;

automatically creating the second VM environment on a second virtual machine monitor (VMM) host using second data associated with the second descriptor, without user selection of the second data.

11. The method of claim 10, wherein automatically creating the second VM environment comprises the VEM substituting a translated action dictated by the descriptor to the second VMM, the translated action for an OS or application an action of the descriptor that the second VMM is not able to instantiate.

12. The method of claim 8, further comprising:

executing the first VM environment on a first VMM;

executing the second VM environment on a second VMM;

managing the first VM environment according to the first descriptor;

managing the second VM environment according to the second descriptor,

wherein managing the second VM environment comprises constraining the behavior of the second VM environment as compared to the first VM environment, according to the constrained facets;

linking the first VEM and the second VEM with one of a hard link and a soft link;

registering the second VEM for changes at the first VEM;

updating the second VM environment according to a change to the first VM environment.

13. The method of claim 6, further comprising:

executing one of the first VM environment and the second VM environment on a virtual machine monitor (VMM);

creating a third VM environment according to a third descriptor;

executing the third VM environment on the VMM;

managing the first VM environment according to the first descriptor;

managing the third VM environment according to the third descriptor;

authenticating a user sign on to the VMM;

providing the user a unification console to transparently access the first VM environment and the third VM environment in a unified desktop interface.

14. The method of claim 13, wherein constraining the behavior of the second VM environment comprises a restriction of one of access to a hardware resource, functionality of a software application, a read data permission, a write data permission, a user sign on authentication for access, and a user permission for use of a VM environment as compared to a behavior of the first VM environment.

15. The method of claim 14, wherein the first descriptor comprises:

description information for creating the first VM environment, the description information describing of one of access to a hardware resource, functionality of a software application, a read data permission, a write data permission, a user sign on authentication for access, and a user permission for use;

management information for managing the first VM environment, the management information describing a restriction of one of access to a hardware resource, functionality of a software application, a read data permission, a write data permission, a user sign on authentication for access, and a user permission for use of a VM environment.

16. The method of claim 13, further comprising:

referencing the first descriptor and the third descriptor at a VEM;

creating a VMM host environment comprising the first VM environment and the third VM environment;

accessing the VMM host environment according to an access control list (ACL).

17. The method of claim 13, wherein the VMM is a first VMM, and further comprising:

combining the third descriptor with the first descriptor to create the second descriptor, wherein the third descriptor includes information causing the constrained facets of the second descriptor;

executing the second VM environment on a second VMM;

managing the second VM environment on the second VMM according to the second descriptor.

18. The method of claim 6, further comprising:

using the virtual environment manager (VEM) to automatically abstract the second descriptor from virtual machine applications and data files of the first VM environment.

19. The method of claim 6, wherein using a virtual environment manager (VEM) to create a second virtual machine (VM) environment comprises resuming the second VM according to a second descriptor of the plurality of VM descriptors for a suspended VM.

20. The method of claim 6, wherein the extended facets comprise an extension of one of access to a hardware resource, functionality of a software application, a read data permission, a write data permission, a user sign on authentication for access, a user permission for use, and a management policy of the second VM environment as compared to the first VM environment.

21. The method of claim 1, further comprising:

using a virtual environment manager (VEM) to automatically translate first information of the first descriptor into second information of the second descriptor, wherein the second information allows the second VM environment to be executed on an operating system that is unable to execute the first VM environment.

22. A machine-accessible medium containing instructions that, when executed, cause a machine to:

sending a first descriptor and first data files to a first VMM;

sending a second descriptor and second data files to a second VMM.

wherein the second descriptor is a modified version of the first descriptor and the second descriptor describes constrained facets on the behavior of a second VM environment to be created according to the second descriptor, as compared to a first VM environment to be created according to the first descriptor.

23. The machine-accessible medium of claim 22, containing further instructions that, when executed, cause a machine to:

create a first virtual machine (VM) environment according to the first descriptor;

create a second virtual machine (VM) environment according to the second descriptor.

24. The machine-accessible medium of claim 22, containing further instructions that, when executed, cause a machine to:

reference the first descriptor;

reference the second descriptor;

access the first data files from a first data storage device;

access the second data files from a second data storage device,

wherein the first data is identified by the first descriptor and the second data is identified by the second descriptor.

25. A descriptor to create and manage virtual machine (VM) environments, comprising:

a description of resources accessible to a VM environment on a computing device having a virtual machine monitor (VMM);

a description of data files associated with the VM environment;

a description of user permissions for the VM environment;

an access control list for authenticating users to access the VM environment;

a management policy to enforce restrictions on the resources, data, and permissions during execution of the VM environment.

26. The descriptor of claim 25, wherein the resources comprise one of, hardware devices, circuitry, persistent data storage devices, memory, networking, operating systems, and software applications;

wherein the data files comprise one of addresses in the persistent data storage device, a file system, meta-data, audio data, video data, data blocks, and software applications;

wherein the user permissions include one of a read data permission, a write data permission, and execute permission, owner permissions, same group as owner permissions, and other than owner permissions;

wherein the authentication includes an access control list (ACL);

wherein the management policies include one of a personal management policy, a family management policy, a work management policy, a desktop computer management policy, a laptop computer management policy, and a corporate management policy.

27. The descriptor of claim 25, wherein the descriptor further comprises:

a description of log files to log usage histories;

a description of load balancing policies to ensure proper load balancing of execution time in a processor for the VM environment;

a description of an enforcement of autonomy policy to force local autonomy of a user of the VM environment.

28. A logically unified compute environment system for enhancing usability of virtual machine (VM) host environments, comprising:

a plurality of user identities of users of a plurality of VM environments on a server computer;

a descriptor module comprising a plurality of VM descriptors applicable to the a plurality of user identities to create and manage the VM environments;

data files associated with the descriptor module to create the VM environments;

a virtual environment manager (VEM) to create a first VM environment according to a first portion of the information and using a first set of the data files associated with the first portion of information, and to manage execution of the VM environments according to a second portion of the information.

29. The system of claim 28, wherein the VEM is a first VEM, and further comprising;

a second VM environment created according to a third portion of the information and a second set of the data files sent to a virtual machine monitor (VMM);

a third VM environment created by a second VEM from a modified version of the third portion of information and a third set of the data files.

30. The system of claim 29, wherein the second portion of information describes to the VEM to manage the VM environment by restricting one of access to a hardware resource, functionality of a software application, a read data permission, a write data permission, a user sign on authentication for access, a user permission for use, and a management policy of the second VM environment as compared to the second VM environment.