System And Method For Managing Virtual Machines

• US 20110016467A1
• Filed: 07/16/2009
• Published: 01/20/2011
• Est. Priority Date: 07/16/2009
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Computer Associates Think Inc. (Broadcom, Inc.)
• Inventors: Kane, John P.
• Granted Patent: US 8,578,374 B2
• Time in Patent Office: Days
• US Class Current: 718/1
• CPC Class Codes: G06F 2009/45575 Starting, stopping, suspending or resuming virtual machine instances
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects

Abstract

In some embodiments, a method for virtual machine management includes receiving a request for a first virtual machine from a virtual host. The method also includes comparing the request for the first virtual machine to a policy. The policy includes rules that govern access to a plurality of virtual machines. In addition, the method includes providing the virtual host access to a second virtual machine in response to comparing the request for the first virtual machine to the policy.

Claims

1. A computer-implemented method for virtual machine management executable on one or more processors, comprising:

receiving a request for a first virtual machine from a virtual host;

comparing the request for the first virtual machine to a policy, the policy comprising rules that govern access to a plurality of virtual machines; and

providing the virtual host access to a second virtual machine in response to comparing the request for the first virtual machine to the policy.

2. The method of claim 1, wherein comparing the request for the first virtual machine to the policy comprises determining if a user that initiated the request is allowed to access the first virtual machine.

3. The method of claim 1, wherein comparing the request for the first virtual machine to the policy comprises determining if a location describing the origin of the request is authorized to access the first virtual machine.

4. The method of claim 1, wherein comparing the request for the first virtual machine to the policy comprises determining if the request for the virtual machine was made during an authorized time interval.

5. The method of claim 1, further comprising:

receiving a request sent to an operating system from a virtual host for a third virtual machine;

comparing the request for the third virtual machine to the policy; and

directing the operating system to indicate to the virtual host that the third virtual machine is not available in response to comparing the request for the virtual machine to the policy.

6. The method of claim 1, further comprising modifying the policy in response to upgrading at least one virtual machine of the plurality of virtual machines.

7. The method of claim 1, wherein:

the first virtual machine comprises a particular version of a requested virtual machine;

comparing the request for the first virtual machine to the policy comprises determining if the particular version of the requested virtual machine is authorized for use according to the policy; and

providing the virtual host access to a second virtual machine comprises providing the virtual host access to a different version of the requested virtual machine than the particular version.

8. The method of claim 1, wherein:

receiving the request for the first virtual machine from the virtual host comprises receiving the request at a kernel level of an operating system; and

providing access to the second virtual machine comprises directing an operating system to provide the second virtual machine.

9. The method of claim 1, wherein:

the first virtual machine comprises a plurality of versions;

comparing the request for the first virtual machine to the policy comprises determining that a user that initiated the request is not allowed to access a latest version of the plurality of versions of the first virtual machine but is allowed to access an earlier version of the plurality of versions of the first virtual machine; and

providing the virtual host access to a second virtual machine comprises providing the virtual host access to the earlier version of the plurality of versions of the first virtual machine.

10. A system for virtual machine management, comprising:

a policy database comprising a plurality of policies, wherein the policies comprise rules that govern access to a plurality of virtual machines; and

a policy engine operable to;

receive a request for a first virtual machine formulated by a virtual host;

compare the request for the first virtual machine to a policy of the plurality of policies; and

indicate a second virtual machine in response to comparing the request for the first virtual machine to the policy.

11. The system of claim 10, further comprising a shim operable to:

receive the request for the first virtual machine from the virtual host;

transmit the request for the first virtual machine to the policy engine; and

provide the virtual host access to the indicated second virtual machine.

12. The system of claim 10, wherein comparing the request for the first virtual machine to the policy comprises determining if a user that initiated the request is allowed to access the first virtual machine.

13. The system of claim 10, wherein comparing the request for the first virtual machine to the policy comprises determining if a location describing the origin of the request is authorized to access the first virtual machine.

14. The system of claim 10, wherein comparing the request for the first virtual machine to the policy comprises determining if the request for the virtual machine was made during an authorized time interval.

15. The system of claim 11, wherein:

the policy engine is operable to;

receive a request for a third virtual machine;

compare the request for the third virtual machine to a second policy of the plurality of policies; and

indicate that a virtual machine should not be provided in response to comparing the request for the third virtual machine to the second policy; and

the shim is operable to;

receive the request for the third virtual machine, wherein the request for the third virtual machine is sent to an operating system from the virtual host; and

direct the operating system to indicate to the virtual host that the third virtual machine is not available in response to the indication by the policy engine that a virtual machine should not be provided.

16. The system of claim 11, wherein the shim is operable to receive the request for the first virtual machine at a kernel level of the operating system.

17. The system of claim 10, wherein the policy database is operable to allow the plurality of policies to be modified in response to upgrading at least one virtual machine of the plurality of virtual machines.

18. The system of claim 10, wherein:

the first virtual machine comprises a particular version of a requested virtual machine;

comparing the request for the first virtual machine to the policy comprises determining if the particular version of the requested virtual machine is authorized for use according to the policy; and

indicating the second virtual machine comprises indicating a different version of the requested virtual machine than the particular version.

19. The system of claim 10, wherein:

the first virtual machine comprises a plurality of versions;

comparing the request for the first virtual machine to the policy comprises determining that a user that initiated the request is not allowed to access a latest version of the plurality of versions of the first virtual machine but is allowed to access an earlier version of the plurality of versions of the first virtual machine; and

indicating the second virtual machine comprises indicating the earlier version of the plurality of versions of the first virtual machine.

20. A tangible, computer-readable medium comprising instructions that, when executed on one or more processors, are operable to:

receive a request for a first virtual machine from a virtual host;

compare the request for the first virtual machine to a policy, the policy comprising rules that govern access to a plurality of virtual machines; and

provide the virtual host access to a second virtual machine in response to comparing the request for the first virtual machine to the policy.

21. The medium of claim 20, wherein comparing the request for the first virtual machine to the policy comprises determining if a user that initiated the request is allowed to access the first virtual machine.

22. The medium of claim 20, wherein comparing the request for the first virtual machine to the policy comprises determining if a location describing the origin of the request is authorized to access the first virtual machine.

23. The medium of claim 20, wherein comparing the request for the first virtual machine to the policy comprises determining if the request for the virtual machine was made during an authorized time interval.

24. The medium of claim 20, wherein the instructions are further operable to:

receive a request sent to an operating system from a virtual host for a third virtual machine;

compare the request for the third virtual machine to the policy; and

direct the operating system to indicate to the virtual host that the third virtual machine is not available in response to comparing the request for the virtual machine to the policy.

25. The medium of claim 20, wherein:

the first virtual machine comprises a particular version of a requested virtual machine;

comparing the request for the first virtual machine to the policy comprises determining if the particular version of the requested virtual machine is authorized for use according to the policy; and

providing the virtual host access to a second virtual machine comprises providing the virtual host access to a different version of the requested virtual machine than the particular version.

26. The medium of claim 20, wherein:

receiving the request for the first virtual machine from the virtual host comprises receiving the request at a kernel level of an operating system; and

providing access to the second virtual machine comprises directing the operating system to provide the second virtual machine.

27. The medium of claim 20, wherein:

the first virtual machine comprises a plurality of versions;

comparing the request for the first virtual machine to the policy comprises determining that a user that initiated the request is not allowed to access a latest version of the plurality of versions of the first virtual machine but is allowed to access an earlier version of the plurality of versions of the first virtual machine; and

providing the virtual host access to a second virtual machine comprises providing the virtual host access to the earlier version of the plurality of versions of the first virtual machine.