Method and System For Traffic Management Via Virtual Machine Migration

• US 20110023114A1
• Filed: 11/11/2009
• Published: 01/27/2011
• Est. Priority Date: 07/22/2009
• Status: Active Grant

• Current Assignee: Avago Technologies International Sales Pte Limited (Broadcom, Inc.)
• Original Assignee: Broadcom Corporation (Broadcom, Inc.)
• Inventors: Currivan, Bruce, Johas Teener, Michael, Kim, Yongbum, Diab, Wael William, Karaoguz, Jeyhan, Ma, Kenneth
• Granted Patent: US 8,613,085 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: G06F 9/4856 resumption being on a different machine, e.g. task migration, virtual machine migration G06F9/5088 takes precedence
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

Aspects of a method and system for traffic management via virtual machine migration include detecting an abnormal traffic pattern in traffic communicated by a first virtual machine that utilizes a first set of network resources. Responsive to the detection of the abnormal pattern, a second virtual machine that utilizes a second set of network resources may be initialized. The second virtual machine may take over functions performed by the first virtual machine and initialization of the second virtual machine is based on an analysis of the traffic. The second virtual machine may be initialized utilizing stored virtual machine sate information in instances that the abnormal traffic is a result of a malicious attack. The second virtual machine may be initialized utilizing current virtual machine state information in instances that the abnormal traffic is not a result of a malicious attack.

Claims

1. A method for networking, the method comprising:

performing by one or more circuits in a management device of a network;

detecting an abnormal traffic pattern in traffic communicated by a first virtual machine that utilizes a first set of network resources;

responsive to said detecting said abnormal pattern, initializing a second virtual machine that utilizes a second set of network resources, wherein;

said second virtual machine takes over functions performed by said first virtual machine; and

said initialization of said second virtual machine is based on an analysis of said traffic.

2. The method according to claim 1, comprising initializing said second virtual machine utilizing stored virtual machine sate information in instances that said abnormal traffic is a result of a malicious attack.

3. The method according to claim 1, comprising initializing said second virtual machine utilizing current virtual machine state information in instances that said abnormal traffic is not a result of a malicious attack.

4. The method according to claim 1, comprising allocating a third set of resources to be utilized by a third virtual machine, wherein said third virtual machine performs said analysis.

5. The method according to claim 4, comprising communicating said traffic associated with said first virtual machine to said third virtual machine via a tunneling connection.

6. The method according to claim 1, comprising pausing communication of said traffic by said first virtual machine subsequent to said detecting of said abnormal pattern.

7. The method according to claim 1, comprising tagging or marking traffic communicated by said first virtual machine subsequent to said detecting of said abnormal pattern.

8. The method according to claim 1, wherein said first set of resources comprises cache, one or more buffers, and/or one or more memories, and said information associated with said first virtual machine comprises contents of said cache, buffers, and/or said memories.

9. The method according to claim 1, wherein a portion of said first set of resources reside on different devices in said network.

10. The method according to claim 1, wherein a portion of said second set of resources reside on different devices in said network.

11. The method according to claim 1, wherein a portion of said third set of resources reside on different devices in said network.

13. The system according to claim 1, wherein said one or more circuits are operable to initialize said second virtual machine utilizing stored virtual machine sate information in instances that said abnormal traffic is a result of a malicious attack.

14. The system according to claim 1, wherein said one or more circuits are operable to initialize said second virtual machine utilizing current virtual machine state information in instances that said abnormal traffic is not a result of a malicious attack.

15. The system according to claim 1, wherein said one or more circuits are operable to allocate a third set of resources to be utilized by a third virtual machine, wherein said third virtual machine performs said analysis.

16. The system according to claim 4, wherein said one or more circuits are operable to communicate said traffic associated with said first virtual machine to said third virtual machine via a tunneling connection.

17. The system according to claim 1, wherein said one or more circuits are operable to pause communication of said traffic by said first virtual machine subsequent to said detecting of said abnormal pattern.

18. The system according to claim 1, wherein said one or more circuits are operable to tag or marking traffic communicated by said first virtual machine subsequent to said detecting of said abnormal pattern.

19. The system according to claim 1, wherein said first set of resources comprises cache, one or more buffers, and/or one or more memories, and said information associated with said first virtual machine comprises contents of said cache, buffers, and/or said memories.

20. The system according to claim 1, wherein a portion of said first set of resources reside on different devices in said network.

21. The system according to claim 1, wherein a portion of said second set of resources reside on different devices in said network.

22. The system according to claim 1, wherein a portion of said third set of resources reside on different devices in said network.

12. A system for networking, the system comprising:

one or more circuits for use in a management device of a network, wherein said one or more circuits are operable to;

detect an abnormal traffic pattern in traffic communicated by a first virtual machine that utilizes a first set of network resources;

responsive to said detecting said abnormal pattern, initialize a second virtual machine that utilizes a second set of network resources, wherein;

said second virtual machine takes over functions performed by said first virtual machine; and

said initialization of said second virtual machine is based on an analysis of said traffic.