Managing virtual machines with system-wide policies

• US 20070250833A1
• Filed: 04/14/2006
• Published: 10/25/2007
• Est. Priority Date: 04/14/2006
• Status: Active Grant

• Current Assignee: ServiceNow Incorporated
• Original Assignee: Microsoft Corporation
• Inventors: Araujo, Nelson, Yourtee, Kendra, Polonsky, Eugene, Wahlert, Brian, Monterrubio, Angel, Dhasmana, Abhishek, Parry, John, Giberson, Lloyd
• Granted Patent: US 8,015,563 B2
• Time in Patent Office: Days
• US Class Current: 718/1
• CPC Class Codes: G06F 2009/45562 Creating, deleting, cloning virtual machine instances
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects

Abstract

An administrative authority for virtual machines can send one or more delegated policy settings to a virtual machine manager. The virtual machine manager can in turn send management instructions that include the one or more policy settings to one or more virtual machine hosts. As such, a user'"'"'s request for a virtual machine at a virtual machine host can be granted or denied based on the delegated policy settings. The policy settings can be updated periodically, and can include additional information about starting, stopping, expiring, saving, or even deleting virtual machines by particular users, as well as users accessing from particular locations. In addition, an agent operating at the virtual machine host can monitor and report virtual machine activity, to ensure unauthorized virtual machines are quickly stopped and reviewed until authorized.

Claims

1. At a virtual machine manager in a computerized environment, the virtual machine manager being configured to manage one or more virtual machines at one or more virtual machine hosts, a method of automatically managing the creation and operation of the one or more virtual machines through delegated authority, comprising the acts of:

receiving electronic control instructions from a virtual machine authority, the control instructions comprising one or more policy settings;

passing the one or more policy settings to a configuration store;

receiving a user request to create a virtual machine in accordance with one or more parameters;

determining from the one or more policy settings that the user request can be granted; and

sending electronic management instructions to a virtual machine host, wherein the management instructions identify that the requested virtual machine can be created in accordance with the one or more parameters.

2. The method as recited in claim 1, wherein the virtual machine manager and the virtual machine host are different physical machines.

3. The method as recited in claim 1, wherein the one or more policy settings limit operation of any of the one or more virtual machines at the virtual machine host to any of a storage, memory, or processing resource parameter.

4. The method as recited in claim 1, further comprising an act of receiving a change to the one or more policy settings from the virtual machine authority.

5. The method as recited in claim 4, further comprising an act of sending electronic updated management instructions to the virtual machine host, the updated management instructions restricting the virtual machine host differently from the prior management instructions.

6. The method as recited in claim 4, wherein the one or more policy settings define at least one of:

(i) one or more users that can create a virtual machine at the virtual machine host;

(ii) one or more users that can share the virtual machine;

(iii) one or more users that can modify the configuration of the virtual machine;

(iv) or one or more roles for any of the one or more users.

7. The method as recited in claim 4, wherein the one or more policy settings define at least one of:

(i) one or more users that can start operation of a virtual machine at the virtual machine host;

(ii) one or more users that can pause operation of a virtual machine at the virtual machine host;

(iii) one or more users that can resume operation of a virtual machine at the virtual machine host;

or

(iv) one or more users that can stop operation of a virtual machine at the virtual machine host

8. The method as recited in claim 4, wherein the one or more policy settings define at least one of:

(i) one or more users that can save a virtual machine to a virtual machine library;

or

(ii) one or more users that can delete a virtual machine from the virtual machine library.

9. The method as recited in claim 4, wherein the one or more policy settings define one or more expiration points for one or more virtual machines at the virtual machine host.

10. The method as recited in claim 4, wherein the one or more policy settings restrict any of the one or more users to accessing any of the one or more virtual machines at the virtual machine host from a geographic boundary, a local area network boundary, or a wide area network boundary.

11. The method as recited in claim 4, wherein the virtual machine host is a member of a virtual machine host group that includes the virtual machine host and one or more different virtual machine hosts;

wherein the virtual machine manager sends the management instructions to any of the virtual machine host or a plurality of virtual machine hosts in the host group.

12. The method as recited in claim 11, wherein at least one of the one or more users has one or more privileges at the virtual machine host and one or more different privileges at a different virtual machine host in the host group, such that the at least one user has an aggregation of privileges for the host group.

13. The method as recited in claim 1, further comprising an act of identifying an unauthorized virtual machine at the virtual machine host;

wherein the unauthorized virtual machine is any one of;

(i) an unknown virtual machine;

or

(ii) a virtual machine operating outside of the one or more policy settings in the configuration store.

14. The method as recited in claim 13, further comprising an act of sending a lock instruction to the virtual machine host, wherein the lock instruction halts the unauthorized virtual machine from further operation.

15. The method as recited in claim 14, further comprising an act of releasing the unauthorized virtual machine upon identifying that the unauthorized virtual machine is operating in accordance with an update to the one or more policy settings.

16. At a virtual machine host in a computerized environment in which the virtual machine host manages one or more virtual machines in accordance with authority delegated from a virtual machine manager, a method of automatically managing the creation and operation of the one or more virtual machines through the delegated authority, comprising the acts of:

receiving electronic management instructions from a virtual machine manager, the management instructions comprising one or more policy settings for the virtual machine host;

receiving one or more electronic requests to create a virtual machine in accordance with one or more parameters;

identifying from the one or more policy settings that at least one of the one or more requests can be granted;

creating the virtual machine in accordance with the at least one request; and

identifying one or more operating characteristics of each of one or more virtual machines installed at the virtual machine host.

17. The method as recited in claim 16, further comprising the acts of:

sending the one or more operating characteristics to the virtual machine manager; and

receiving an electronic instruction to halt operation of one of the one or more virtual machines.

18. The method as recited in claim 16, wherein the virtual machine host and the virtual machine manager are on the same physical machines.

19. The method as recited in claim 16, further comprising an act of receiving any of the one or more electronic requests to create a virtual machine through a web interface provided by the virtual machine host.

20. At a virtual machine manager in a computerized environment, the virtual machine manager being configured to manage one or more virtual machines at one or more virtual machine hosts, a computer program product having computer-executable instructions stored thereon that, when executed, cause one or more processors to perform a method of automatically managing the creation and operation of the one or more virtual machines through delegated authority, comprising the acts of:

receiving electronic control instructions from a virtual machine authority, the control instructions comprising one or more policy settings;

passing the one or more policy settings to a configuration store;

receiving a user request to create a virtual machine in accordance with one or more parameters;

determining from the one or more policy settings that the user request can be granted; and

sending electronic management instructions to a virtual machine host, wherein the management instructions identify that the requested virtual machine can be created in accordance with the one or more parameters.