SECURE PATCH UPDATES OF A VIRTUAL MACHINE IMAGE IN A VIRTUALIZATION DATA PROCESSING SYSTEM

• US 20100287544A1
• Filed: 07/22/2008
• Published: 11/11/2010
• Est. Priority Date: 07/22/2008
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Thomas, John J., Guizan, Justo M., Bradfield, Andrew J., Willner, Barry E.
• Granted Patent: US 9,361,089 B2
• Time in Patent Office: Days
• US Class Current: 717/172
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/54 by adding security routines or objects to programs
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57
• CPC Class Codes: G06F 9/44 Arrangements for executing specific programs
• CPC Class Codes: G06F 9/445 Program loading or initiating bootstrapping G06F9/4401; security arrangements for program loading or initiating G06F21/57
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects

Abstract

Virtual Machine (VM) images in a virtualized environment are updated through the use of patches. A virtualization data processing system includes a hypervisor that manages a VM image. The hypervisor is configured to retrieve a patch for an instance of the VM image from a secure site. The hypervisor blocks all other network access to the VM image. The hypervisor is configured to apply the patch to the instance of the VM image and unblock all network access to the VM image

Claims

1. A virtualization data processing system comprising:

a hypervisor; and

a virtual machine (VM) image managed by the hypervisor;

wherein the hypervisor is configured to retrieve a patch to an instance of a VM image from a secure site and block all other network access to the VM image.

2. The system of claim 1, wherein the hypervisor comprises patch updating logic to retrieve the patch to the instance of the VM image from the secure site.

3. The system of claim 1, wherein the hypervisor is further configured to apply the patch to the instance of the VM image and unblock all network access to the VM image.

4. The system of claim 1, wherein the VM image comprises a computer operating system.

5. The system of claim 4, further comprising computer middleware executing within the VM image.

6. The system of claim 4, further comprising a computer application executing within the VM image.

7. The system of claim 4, further comprising an application server executing within the VM image.

8. A method for patch updating a virtual machine (VM) image, the method comprising:

retrieving a patch to an instance of a VM image from a secure site; and

,

blocking all other network access to the VM image.

9. The method of claim 8, further comprising:

applying the patch to the instance of the VM image; and

,

unblocking network access to the VM image.

10. The method of claim 8, wherein blocking all other network access to the VM image comprises prompting a user to manually select blocking all other network access.

11. The method of claim 8, wherein blocking all other network access to the VM image comprises detecting a need to patch the instance of the VM image and automatically blocking all other network access to the VM image.

12. The method of claim 8, further comprising checking for an availability of the patch from a compiled list of secure patch updating web sites.

13. The method of claim 8, wherein retrieving a patch to an instance of a VM image from a secure site comprises identifying the remote secure site from which to retrieve the patch to the instance of the VM image.

14. A computer program product for patch updating a VM image, the computer program product comprising:

a computer usable medium having computer usable program code embodied therewith, the computer usable medium comprising;

computer usable program code for retrieving a patch to an instance of a VM image from a secure site; and

,

computer usable program code for blocking all other network access to the VM image.

15. The computer program product of claim 14, further comprising:

computer usable program code for applying the patch to the instance of the VM image; and

,

computer usable program code for unblocking network access to the VM image.

16. The computer program product of claim 14, wherein the computer usable program code for blocking all other network access to the VM image comprises computer usable program code for prompting a user to manually select blocking all other network access.

17. The computer program product of claim 14, wherein the computer usable program code for blocking all other network access to the VM image comprises computer usable program code for detecting a need to patch the instance of the VM image and automatically blocking all other network access to the VM image.

18. The computer program product of claim 14, further comprising computer usable program code for checking for an availability of the patch from a compiled list of secure patch updating web sites.

19. The computer program product of claim 14, wherein the computer usable program code for retrieving a patch to an instance of a VM image from a secure site comprises computer usable program code for identifying the remote secure site from which to retrieve the patch to the instance of the VM image.