ENFORCEMENT OF COMPLIANCE POLICIES IN MANAGED VIRTUAL SYSTEMS

• US 20080134176A1
• Filed: 11/27/2007
• Published: 06/05/2008
• Est. Priority Date: 10/17/2006
• Status: Active Grant

• Current Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Original Assignee: Managelq Incorporated
• Inventors: Barenboim, Oleg, Fitzgerald, Joseph
• Granted Patent: US 9,015,703 B2
• Time in Patent Office: Days
• US Class Current: 718/1
• CPC Class Codes: G06F 11/0712 in a virtual computing platform, e.g. logically partitioned systems
• CPC Class Codes: G06F 11/0727 in a storage system, e.g. in a DASD or network based storage system drivers for digital recording or reproducing units G06F3/06; circuits for error detection or correction within digital recording or reproducing units G11B20/18; for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS], H04L67/1097
• CPC Class Codes: G06F 11/0751 Error or fault detection not based on redundancy power supply failures G06F1/30; network fault management H04L41/06
• CPC Class Codes: G06F 11/0766 Error or fault reporting or storing
• CPC Class Codes: G06F 11/0793 Remedial or corrective actions recovery from an exception in an instruction pipeline G06F9/3861; by retry G06F11/1402; for recovering from a failure of a protocol instance or entity H04L69/40
• CPC Class Codes: G06F 2009/4557 Distribution of virtual machine instances; Migration and load balancing
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 9/45537 Provision of facilities of other operating environments, e.g. WINE I/O emulation G06F13/105
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: G06F 9/542 Event management; Broadcasting; Multicasting; Notifications

Abstract

Techniques are disclosed for controlling and managing virtual machines and other such virtual systems. VM execution approval is based on compliance with policies controlling various aspects of VM. The techniques can be employed to benefit all virtual environments, such as virtual machines, virtual appliances, and virtual applications. For ease of discussion herein, assume that a virtual machine (VM) represents each of these environments. In one particular embodiment, a systems management partition (SMP) is created inside the VM to provide a persistent and resilient storage for management information (e.g., logical and physical VM metadata). The SMP can also be used as a staging area for installing additional content or agentry on the VM when the VM is executed. Remote storage of management information can also be used. The VM management information can then be made available for pre-execution processing, including policy-based compliance testing.

Claims

1. A method for enforcing a virtual machine (VM) compliance scheme, comprising:

getting compliance policies regarding a target VM; and

prior to executing the target VM, applying the compliance policies against the target VM to determine if the target VM is compliant with the VM compliance scheme.

2. The method of claim 1 further comprising:

getting metadata associated with a target VM, wherein applying the compliance policies includes applying the compliance policies against the metadata.

3. The method of claim 2 wherein the metadata is content metadata associated with the target VM, and getting compliance policies regarding the target VM includes getting compliance policies regarding content of the target VM.

4. The method of claim 2 wherein getting metadata includes accessing a management partition in the target VM, the management partition for storing management data including the metadata.

5. The method of claim 2 wherein getting metadata includes accessing an enterprise storage facility for storing management data including the metadata.

6. The method of claim 2 wherein getting metadata includes accessing a remote VM management server for storing management data including the metadata.

7. The method of claim 2 wherein getting metadata comprises:

making a copy of the target VM;

executing the VM copy in an isolated environment;

interrogating the executing VM copy to extract the metadata; and

storing the metadata.

8. The method of claim 7 wherein getting metadata further comprises:

prior to the executing step, modifying the VM copy to make the VM copy executable;

after the interrogating step, stopping the executing VM copy; and

discarding the VM copy.

9. The method of claim 2 wherein getting metadata comprises:

exporting the target VM to a portable storage media;

mounting the VM portable storage media as a virtual drive at a test location;

interrogating the target VM to gather the metadata; and

storing the metadata.

10. The method of claim 2 wherein getting metadata comprises:

starting an agent on an execution platform of the target VM;

mounting one or more disk files of the target VM to a Network File System (NFS) associated with the execution platform;

accessing, by the agent, the one or more disk files;

interrogating, by the agent, the one or more disk files to gather the metadata; and

storing, by the agent, the metadata.

11. The method of claim 10 wherein getting metadata further comprises:

unmounting one or more disk files of the target VM from the NFS.

12. The method of claim 2 wherein getting metadata comprises extracting the metadata from the target VM in real-time.

13. The method of claim 2 wherein the metadata is pre-extracted metadata that is stored and accessible to the method.

14. The method of claim 2 wherein the metadata includes physical and logical metadata.

15. The method of claim 2 wherein getting metadata comprises:

attempting to read the metadata from the target VM;

in response to the metadata being unavailable on the target VM, attempting to read the metadata from a storage location external to the target VM; and

in response to the metadata being unavailable externally to the target VM, extracting the metadata in real-time.

16. The method of claim 2 wherein applying the compliance policies against the target VM further comprises:

comparing signatures of the metadata against at least one of blacklist signatures, whitelist signatures, and greylist signatures.

17. The method of claim 2 wherein at least one or more compliance policies with which the target VM must comply to execute are signature-based policies, and applying the compliance policies against the target VM comprises:

comparing, at least one signature of the metadata against at least one signature-based policy;

wherein the comparison generates a result upon which a compliancy determination is made.

18. The method of claim 17 wherein the signatures used in comparisons are computed using one or more hashing functions.

19. The method of claim 17 wherein fuzzy matching is used in the comparison to allow for degrees of matching.

20. The method of claim 1 wherein at least one or more compliance policies with which the target VM must comply to execute are signature-based policies, and applying the compliance policies against the target VM comprises:

comparing a system signature against at least one signature-based policy, wherein the system signature is based on the one or more signatures reflective of VM content;

wherein the comparison generates a result upon which a compliancy determination is made.

21. The method of claim 1 wherein applying the compliance policies comprises:

comparing signatures reflective of VM content against at least one of blacklist signatures, whitelist signatures, and greylist signatures.

22. The method of claim 1 further comprising:

in response to the target VM being compliant with the VM compliance scheme, executing the target VM in an execution platform.

23. The method of claim 1 further comprising the preliminary steps of:

intercepting a request to at least one of start and resume the target VM; and

preventing the target VM from executing until the target VM is determined to be compliant with the VM compliance scheme.

24. The method of claim 1 further comprising:

in response to at least one of the target VM and an execution platform of the target VM being non-compliant with the VM compliance scheme, taking remedial action.

25. The method of claim 24 wherein the remedial action includes at least one of:

preventing the target VM from executing until the target VM is determined to be compliant with the VM compliance scheme;

allowing the target VM to execute with warnings issued to alert an operator console or auditing system of the non-compliancy;

issuing an alert with details about why VM execution was prevented, including which policy or policies disqualified the target VM from execution;

allowing the target VM to execute and correct non-compliances to bring itself into compliance; and

allowing the target VM to execute in an isolated environment.

26. The method of claim 24 wherein the remedial action includes at least one of:

scheduling at least one of an agent or process to carryout remedial action;

registering the target VM for use in a managed system associated with the VM compliance scheme;

adjusting security settings;

deleting unauthorized content;

obtaining necessary licensing;

restricting access permissions, so that the target VM can only access certain content, resources, and areas of the managed system; and

at least one of adding, updating, and deleting user account information, so as to limit account authority associated with the target VM.

27. The method of claim 1 further comprising:

prior to executing the target VM, applying one or more of the compliance policies to an execution platform of the target VM to determine if the execution platform is compliant with the VM compliance scheme; and

in response to the execution platform not being non-compliant, preventing the target VM from executing.

28. The method of claim 1 further comprising:

prior to executing the target VM, applying one or more of the compliance policies to a requesting user of the target VM to determine if the user is compliant with the VM compliance scheme; and

in response to a detected non-compliancy associated with the requesting user, preventing the target VM from executing.

29. The method of claim 1 wherein at least one of the compliance policies requires the target VM to be registered before it is used, the method further comprising:

prior to executing the target VM, determining if the target VM is registered for use; and

in response to the target VM not being registered for use, preventing the target VM from executing until the target VM is registered.

30. The method of claim 1 further comprising:

checking license information against metadata indicating which applications are installed on the target VM; and

in response to one or more requisite licenses not being available, preventing the target VM from executing until requisite licenses are available.

31. The method of claim 1 wherein at least one of the compliance policies requires the target VM to operate during a specified time window, the method further comprising:

prior to executing the target VM, determining if the time window is satisfied; and

in response to the time window not being satisfied, preventing the target VM from executing until the window is satisfied.

32. The method of claim 1 wherein at least one of the compliance policies requires the target VM to operate in a particular context, the method further comprising:

prior to executing the target VM, determining if the target VM will be used in the context; and

in response to the target VM not being used in the context, preventing the target VM from executing.

33. The method of claim 1 wherein the method is applied to a plurality of target VMs as part of an initiation of those VMs into a managed system associated with the VM compliance scheme.

34. The method of claim 1 wherein the target VM can only be executed by an execution platform that is included in a managed system associated with the VM compliance scheme.

35. The method of claim 1 wherein an execution platform that is included in a managed system associated with the VM compliance scheme will only execute VMs registered for use in the managed system.

36. The method of claim 1 wherein applying the compliance policies occurs after a VM start request is received and prior to executing the target VM in response to that VM start request.

37. The method of claim 1 wherein prior to applying the compliance policies, the method further comprises:

arbitrating the compliance policies for priority, conflict, or deadlocks.

38. The method of claim 1 wherein the target VM is a virtual application or a virtual appliance.

39. A system for enforcing a virtual machine (VM) compliance scheme, comprising:

an enforcement module for getting compliance policies regarding a target VM, and prior to executing the target VM, applying the compliance policies against the target VM to determine if the target VM is compliant with the VM compliance scheme.

40. The system of claim 39 wherein the enforcement module applies the compliance policies by comparing signatures reflective of VM content against at least one of blacklist signatures, whitelist signatures, and greylist signatures.

41. The system of claim 39 wherein the target VM can only be executed by an execution platform that is included in a managed system associated with the VM compliance scheme.

42. The system of claim 39 wherein an execution platform that is included in a managed system associated with the VM compliance scheme will only execute VMs registered for use in the managed system.

43. One or more machine-readable mediums encoded with instructions, that when executed by one or more processors, cause the processor to carry out a process for enforcing a virtual machine (VM) compliance scheme, the process comprising:

getting compliance policies regarding a target VM; and

prior to executing the target VM, applying the compliance policies against the target VM to determine if the target VM is compliant with the VM compliance scheme.

44. The one or more machine-readable mediums of claim 43 wherein applying the compliance policies comprises:

comparing signatures reflective of VM content against at least one of blacklist signatures, whitelist signatures, and greylist signatures.

45. The one or more machine-readable mediums of claim 43 wherein the target VM can only be executed by an execution platform that is included in a managed system associated with the VM compliance scheme.

46. The one or more machine-readable mediums of claim 43 wherein an execution platform that is included in a managed system associated with the VM compliance scheme will only execute VMs registered for use in the managed system.