MOVEABLE ACCESS CONTROL LIST (ACL) MECHANISMS FOR HYPERVISORS AND VIRTUAL MACHINES AND VIRTUAL PORT FIREWALLS

• US 20080163207A1
• Filed: 01/03/2007
• Published: 07/03/2008
• Est. Priority Date: 01/03/2007
• Status: Active Grant

• Current Assignee: Daedalus Blue LLC
• Original Assignee: International Business Machines Corporation
• Inventors: Sahu, Sambit, Saha, Debanjan, Reumann, John, Verma, Dinesh Chandra
• Granted Patent: US 8,381,209 B2
• Time in Patent Office: Days
• US Class Current: 718/1
• CPC Class Codes: B81B 2201/0257 Microphones or microspeakers
• CPC Class Codes: B81B 7/0061 suitable for fluid transfer from the MEMS out of the package or vice versa, e.g. transfer of liquid, gas, sound
• CPC Class Codes: G06F 9/455 Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
• CPC Class Codes: G06F 9/45533 Hypervisors; Virtual machine monitors
• CPC Class Codes: G06F 9/5077 Logical partitioning of resources; Management or configuration of virtualized resources specific details on emulation or internal functioning of virtual machines G06F9/455
• CPC Class Codes: H01L 2224/32225 the item being non-metallic, e.g. insulating substrate with or without metallisation
• CPC Class Codes: H01L 2224/48091 Arched
• CPC Class Codes: H01L 2224/48137 the bodies being arranged next to each other, e.g. on a common substrate
• CPC Class Codes: H01L 2224/48227 connecting the wire to a bond pad of the item
• CPC Class Codes: H01L 2224/73265 Layer and wire connectors
• CPC Class Codes: H01L 24/73 Means for bonding being of different types provided for in two or more of groups H01L24/10, H01L24/18, H01L24/26, H01L24/34, H01L24/42, H01L24/50, H01L24/63, H01L24/71
• CPC Class Codes: H01L 2924/00 Indexing scheme for arrangements or methods for connecting or disconnecting semiconductor or solid-state bodies as covered by H01L24/00
• CPC Class Codes: H01L 2924/00012 Relevant to the scope of the group, the symbol of which is combined with the symbol of this group
• CPC Class Codes: H01L 2924/00014 the subject-matter covered by the group, the symbol of which is combined with the symbol of this group, being disclosed without further technical details
• CPC Class Codes: H01L 2924/01046 Palladium [Pd]
• CPC Class Codes: H01L 2924/01078 Platinum [Pt]
• CPC Class Codes: H01L 2924/01079 Gold [Au]
• CPC Class Codes: H01L 2924/19041 being a capacitor
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/0272 : Virtual private networks
• CPC Class Codes: H04L 63/101 : Access control lists [ACL]
• CPC Class Codes: H04L 63/20 : for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04R 1/04 : Structural association of microphone with electric circuitry therefor in deaf-aid sets H04R25/00
• CPC Class Codes: H04R 1/2869 : Reduction of undesired resonances, i.e. standing waves within enclosure, or of undesired vibrations, i.e. of the enclosure itself
• CPC Class Codes: H04R 19/005 : using semiconductor materials
• CPC Class Codes: H04R 31/006 : Interconnection of transducer parts of diaphragm and outer suspension by moulding H04R31/003

Abstract

A method (and system) which provides virtual machine migration with filtered network connectivity and control of network security of a virtual machine by enforcing network security and routing at a hypervisor layer at which the virtual machine partition is executed, and which is independent of guest operating systems.

Claims

1. A computer implemented method of controlling network security of a virtual machine, comprising:

enforcing network security and routing at a hypervisor layer.

2. A computer implemented method of virtual machine migration with filtered network connectivity, comprising:

enforcing network security and routing at a hypervisor layer which is independent of guest operating systems.

3. The method according to claim 2, wherein said enforcing includes at least one of:

dynamic updating of routing controls initiated by a migration of said virtual machine from a first device to a second device, and

dynamic updating of firewall network access controls initiated by a migration of said virtual machine from said first device to said second device.

4. The method according to claim 3, wherein said firewall network access controls comprise at least one of:

filtering at least one of a network layer, a data link layer, and a physical layer, and

a network address translation.

5. The method according to claim 2, further comprising:

migrating said virtual machine from a first hardware device to a second hardware device.

6. The method according to claim 5, further comprising:

establishing logical rules that govern an interaction of said migrated virtual machine with a network infrastructure.

7. The method according to claim 2, further comprising:

storing network access control lists at least one of with a serialized representation of the virtual machine and in a central repository.

8. The method according to claim 7, wherein said network access control lists are independent of guest operating systems.

9. The method according to claim 2, further comprising:

storing a network section in a virtual machine description file which is stored to a disk when said virtual machine is serialized.

10. The method according to claim 9, wherein said virtual machine description file further includes:

a media access control file.

11. The method according to claim 5, wherein said migrating includes at least one of:

migrating a peripheral state of said virtual machine, wherein said peripheral states includes a hardware resource being emulated, and

capturing an application state of said virtual machine, wherein said application state includes at least one of a state of a firewall and a state of a routing of said virtual machine.

12. The method according to claim 2, wherein said hypervisor layer includes a hypervisor at which a virtual machine partition is executed.

13. The method according to claim 2, further comprising:

copying network security and routing for said virtual machine to said hypervisor layer;

migrating said virtual machine from a first hardware device to a second hardware device;

updating routing controls for said virtual machine at the hypervisor level;

updating traffic filters for said virtual machine at the hypervisor level; and

advertising said migration of said virtual machine from said first hardware device to said second hardware device.

14. The method according to claim 13, further comprising at least one of:

routing network traffic for said virtual machine to said second hardware device based on said routing controls, and

granting access to said virtual machine on said second hardware device based on said traffic filters.

15. The method according to claim 13, wherein said updating traffic filters includes:

setting hypervisor firewalls to permit network traffic for said virtual machine to access said second hardware device.

16. The method according to claim 13, wherein said advertising is performed by said second hardware device.

17. The method according to claim 13, wherein said virtual machine retains a same internet protocol address after said migrating.

18. A method of deploying computing infrastructure in which computer-readable code is integrated into a computing system, and combines with said computing system to perform the method according to claim 2.

19. A signal-bearing medium tangibly embodying a program of recordable, machine-readable instructions executable by a digital processing apparatus to perform the method according to claim 2.

20. A system for virtual machine migration with filtered network connectivity and controlling network security of a virtual machine by enforcing network security and routing at a hypervisor layer, comprising:

a copying unit that copies network security and routing for said virtual machine to said hypervisor layer;

a migrating unit that migrates said virtual machine from a first hardware device to a second hardware device;

a first updating unit that updates routing controls for said virtual machine at the hypervisor level;

a second updating unit that updates traffic filters for said virtual machine at the hypervisor level; and

an advertising unit that advertises said migration of said virtual machine from said first hardware device to said second hardware device.

21. The system of claim 20, further comprising:

at least one of a router that routs network traffic for said virtual machine to said second hardware device based on said routing controls, and

a filter that grants access to said virtual machine on said second hardware device based on said traffic filters.

22. The system according to claim 20, wherein said second hardware device includes said advertising unit.

23. The system according to claim 20, wherein said first updating unit dynamically updates routing controls initiated by said migration of said virtual machine from the first device to the second device.

24. The system according to claim 20, wherein said second updating unit dynamically firewall network access controls initiated by said migration of said virtual machine from said first device to said second device.

25. The system according to claim 20, further comprising:

a logical rule unit that establishes logical rules that govern an interaction of said migrated virtual machine with a network infrastructure.

26. The system according to claim 20, further comprising:

a storage unit for storing network access control lists at least one of with a serialized representation of the virtual machine and in a central repository.

27. The system according to claim 20, further comprising:

a storage unit that stores a virtual machine description file when said virtual machine is serialized, said virtual machine description file including a network section and a media access control file.

28. The system according to claim 20, wherein said hypervisor layer includes a hypervisor at which a virtual machine partition is executed.