COMPLIANCE-BASED ADAPTATIONS IN MANAGED VIRTUAL SYSTEMS

• US 20080134177A1
• Filed: 11/27/2007
• Published: 06/05/2008
• Est. Priority Date: 10/17/2006
• Status: Active Grant

• Current Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Original Assignee: ManageIQ, Inc. (International Business Machines Corporation)
• Inventors: Barenboim, Oleg, Fitzgerald, Joseph
• Granted Patent: US 8,234,641 B2
• Time in Patent Office: Days
• US Class Current: 718/1
• CPC Class Codes: G06F 11/0712 in a virtual computing platform, e.g. logically partitioned systems
• CPC Class Codes: G06F 2009/4557 Distribution of virtual machine instances; Migration and load balancing
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 9/45533 Hypervisors; Virtual machine monitors
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Techniques are disclosed for controlling and managing virtual machines and other such virtual systems. VM execution approval is based on compliance with policies controlling various aspects of VM. The techniques can be employed to benefit all virtual environments, such as virtual machines, virtual appliances, and virtual applications. For ease of discussion herein, assume that a virtual machine (VM) represents each of these environments. In one particular embodiment, a systems management partition (SMP) is created inside the VM to provide a persistent and resilient storage for management information (e.g., logical and physical VM metadata). The SMP can also be used as a staging area for installing additional content or agentry on the VM when the VM is executed. Remote storage of management information can also be used. The VM management information can then be made available for pre-execution processing, including policy-based compliance testing.

Claims

1. A method for adapting virtual machines (VMs) for use in a managed system, comprising:

prior to executing a target VM, determining that the target VM is non-compliant with a policy-based compliance scheme; and

adapting the target VM to conform with the policy-based compliance scheme.

2. The method of claim 1 wherein determining that the target VM is non-compliant comprises:

getting metadata associated with the target VM;

getting compliance policies regarding the target VM; and

applying the compliance policies against the metadata to determine if the target VM is compliant with the VM compliance scheme.

3. The method of claim 1 wherein adapting the target VM comprises direct manipulation of VM content.

4. The method of claim 1 wherein adapting the target VM comprises direct manipulation of settings associated with at least one of the target VM and an execution platform of the VM.

5. The method of claim 1 wherein adapting the target VM comprises insertion of data into the target VM.

6. The method of claim 1 wherein adapting the target VM comprises at least one of:

updating virus definitions;

installing anti-virus software;

installing security patches;

executing an anti-virus scanning application;

removing malware; and

disabling malware.

7. The method of claim 6 wherein the malware includes at least one of a virus, worm, trojan horse, rootkit, spyware, and adware.

8. The method of claim 1 wherein adapting the target VM comprises adjusting security settings.

9. The method of claim 1 wherein adapting the target VM comprises deleting unauthorized content.

10. The method of claim 1 wherein adapting the target VM comprises at least one of:

obtaining necessary licensing; and

automatically issuing an email notification to an administrator to obtain licensing.

11. The method of claim 1 wherein adapting the target VM comprises:

scheduling at least one of an agent or process to carryout remedial action.

12. The method of claim 11 wherein scheduling at least one of an agent or process comprises:

at least one of requesting, transferring, downloading, and installing at least one of security updates and security patches.

13. The method of claim 11 wherein scheduling at least one of an agent or process comprises:

at least one of searching for and eradicating malware.

14. The method of claim 11 wherein scheduling at least one of an agent or process comprises:

registering the target VM for use in the managed system.

15. The method of claim 1 wherein adapting the target VM comprises:

restricting access permissions, so that the target VM can only access certain content, resources, and areas of the managed system.

16. The method of claim 1 wherein adapting the target VM comprises:

at least one of adding, updating, and deleting user account information, so as to limit account authority associate with the target VM.

17. The method of claim 1 wherein adapting the target VM comprises validating adaptations made.

18. The method of claim 17 wherein validating adaptations made comprises repeating policy-based compliance testing that was used to determine the target VM was non-compliant.

19. The method of claim 1 wherein determining that the target VM is non-compliant occurs after a VM start request is received and prior to executing the target VM in response to that VM start request.

20. The method of claim 1 wherein the target VM is a virtual application or a virtual appliance.

21. A system for adapting virtual machines (VMs) for use in a managed system, comprising:

an enforce module for, prior to execution of a target VM, determining that the target VM is non-compliant with a policy-based compliance scheme; and

an adapt module for, prior to execution of a target VM, adapting the target VM to conform with the policy-based compliance scheme.

22. One or more machine-readable mediums encoded with instructions, that when executed by one or more processors, cause the processor to carry out a process for adapting virtual machines (VMs) for use in a managed system, the process comprising:

prior to executing a target VM, determining that the target VM is non-compliant with a policy-based compliance scheme; and

adapting the target VM to conform with the policy-based compliance scheme.