DATA CENTER WITH CONTINUOUS WORLD SWITCH SECURITY

• US 20130198743A1
• Filed: 01/26/2012
• Published: 08/01/2013
• Est. Priority Date: 01/26/2012
• Status: Active Grant

• Current Assignee: Empire Technology Development LLC (Allied Inventors Management, LLC)
• Original Assignee: Empire Technology Development LLC (Allied Inventors Management, LLC)
• Inventors: Kruglick, Ezekiel
• Granted Patent: US 8,789,047 B2
• Time in Patent Office: Days
• US Class Current: 718/1
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 9/45533 Hypervisors; Virtual machine monitors
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

Technologies related to continuous world switch security are generally described. In some examples, a world switch indicator may indicate whether continuous world switch security is on or off for a cloud customer. A hypervisor world switch security setting may be activated and deactivated, according to the world switch indicator, to optionally allow world switches and not context switches between virtual machines executed by a cloud server. Continuous world switch security may optionally be controlled by a cloud customer. Load balancing, cloud customer billing and other techniques are also disclosed to accommodate the activation/deactivation of continuous world switch security.

Claims

1. A server configured to execute tasks within one or more virtual machines, and to activate continuous world switch security for one or more of the tasks, the server comprising:

one or more processor cores, each processor core comprising a processor and a cache memory; and

a hypervisor executable by the one or more processor cores of the server, and configured to manage execution of virtual machines by the server, wherein;

the hypervisor is capable of context switches between virtual machines executable by the server;

the hypervisor is capable of world switches between virtual machines executable by the server;

the hypervisor is configured to implement a hypervisor world switch security setting associated with a task, so that;

when the hypervisor world switch security setting is on, the hypervisor is configured to allow world switches, and not context switches, between a virtual machine including the task and other virtual machines executable by the server; and

when the hypervisor world switch security setting is off, the hypervisor is configured to allow world switches and context switches between a virtual machine including the task and other virtual machines executable by the server.

2. The server of claim 1, further comprising a task launcher configured to activate the hypervisor world switch security setting in the hypervisor in response to a world switch indicator associated with a cloud customer.

3. The server of claim 2, wherein the task launcher is configured to communicate continuous world switch security information to a billing subsystem.

4. The server of claim 2, wherein the task launcher is configured to check at least one condition, in addition to the world switch indicator, prior to activating the hypervisor world switch security setting in the hypervisor, and to activate the hypervisor world switch security setting when the condition is satisfied.

5. The server of claim 4, wherein the condition comprises a multiple cloud customer condition, wherein the virtual machines presently executable by the server are associated with more than one cloud customer.

6. The server of claim 1, wherein each processor core has a processor state defined at least in part by a state of the cache memory, and wherein context switches between virtual machines allow at least a portion of a processor state associated with a first virtual machine to remain during execution of a next virtual machine, and wherein world switches between virtual machines eliminate at least a cache, register, or pipeline state associated with a first virtual machine when switching a to execution of the next virtual machine.

7. The server of claim 1, wherein the hypervisor is configured to implement the hypervisor world switch security setting by including a trap handler configured to:

detect, during execution of a first virtual machine, a next virtual machine processor command from a next virtual machine;

refer to a hypervisor world switch security setting for one or more of the first virtual machine and the next virtual machine; and

trap the next virtual machine processor command when the hypervisor world switch security setting is on for one or more of the first virtual machine and the next virtual machine.

8. The server of claim 1, further comprising a load balance manager configured to allocate additional processing resources including one or more of processing time, processor cores, and memory resources to virtual machines including tasks for which continuous world switch security is activated.

9. The server of claim 1, further comprising a load balance manager configured to group tasks for which continuous world switch security is activated.

10. The server of claim 1, wherein the hypervisor is configured to initiate world switches between virtual machines using a hardware virtualization assistance tool provided by one or more of the processor cores.

11. A method performed by a server comprising a hypervisor configured to manage execution of virtual machines, wherein the hypervisor is configured to initiate context switches between virtual machines executable by one or more processor cores of the server, wherein the hypervisor is configured to initiate world switches between virtual machines executable by the one or more processor cores, and wherein the hypervisor is configured to implement continuous world switch security for one or more of the virtual machines, the method comprising:

detecting, by the server, a world switch indicator associated with a task;

activating, by the server, a hypervisor world switch security setting in the hypervisor in response to detecting that the world switch indicator requires world switches, and not context switches, between a virtual machine including the task and other virtual machines executable by the server; and

when the hypervisor world switch security setting is on, allowing, by the hypervisor, world switches, and not context switches, between a virtual machine including the task and other virtual machines executable by the server.

12. The method of claim 11, wherein the detecting is performed by a task launcher by referencing a world switch indicator associated with a cloud customer.

13. The method of claim 12, further comprising communicating, by the task launcher, continuous world switch security information to a billing subsystem.

14. The method of claim 12, further comprising checking, by the task launcher, at least one condition, in addition to the world switch indicator, prior to activating the hypervisor world switch security setting in the hypervisor, and activating the hypervisor world switch security setting when the condition is satisfied.

15. The method of claim 14, wherein the condition comprises a multiple cloud customer condition, wherein the virtual machines presently executable by the server are associated with more than one cloud customer.

16. The method of claim 11, wherein each processor core has a processor state defined at least in part by a state of the cache memory, and wherein context switches between virtual machines allow at least a portion of a processor state associated with a first virtual machine to remain during execution of a next virtual machine, and wherein world switches between virtual machines eliminate at least a cache, register, or pipeline state associated with a first virtual machine when switching processor core to execution of the next virtual machine.

17. The method of claim 11, further comprising, during execution of a first virtual machine, detecting a next virtual machine processor command from a next virtual machine, and referring to a hypervisor world switch security setting for one or more of the first virtual machine and the next virtual machine, and trapping the next virtual machine processor command when the hypervisor world switch security setting is on for one or more of the first virtual machine and the next virtual machine.

18. The method of claim 11, further comprising allocating additional processing resources including one or more of processing time, processor cores, and memory resources to a virtual machine including tasks for which continuous world switch security is on.

19. The method of claim 11, further comprising grouping tasks for which continuous world switch security is on.

20. The method of claim 11, further comprising using a hardware virtualization assistance tool provided by one or more of the processor cores to initiate a world switch between virtual machines.

21. A computer readable medium including computer executable instructions implementing a hypervisor configured to apply continuous world switch security for one or more virtual machines, comprising:

instructions implementing a hypervisor, wherein;

the hypervisor is configured to initiate context switches between virtual machines executable by one or more processor cores included in a server;

the hypervisor is configured to initiate world switches between virtual machines executable by the server;

the hypervisor is configured to implement a hypervisor world switch security setting associated with a task, so that;

when the hypervisor world switch security setting is on, the hypervisor is configured to allow world switches, and not context switches, between a virtual machine including the task and other virtual machines executable by the server; and

when the hypervisor world switch security setting is off, the hypervisor is configured to allow world switches and context switches between a virtual machine including the task and other virtual machines executable by the server.

22. The computer readable medium of claim 21, further comprising instructions implementing a task launcher that sets the hypervisor world switch security setting in the hypervisor in response to a world switch indicator associated with a cloud customer.

23. The computer readable medium of claim 22, wherein the task launcher communicates continuous world switch security information to a billing subsystem.

24. The computer readable medium of claim 22, wherein the task launcher is configured to check at least one condition, in addition to the world switch indicator, prior to activating the hypervisor world switch security setting in the hypervisor, and to activate the hypervisor world switch security setting in the hypervisor when the condition is satisfied.

25. The computer readable medium of claim 24, wherein the condition comprises a multiple cloud customer condition, wherein the virtual machines presently executable by the server are associated with more than one cloud customer.

26. The computer readable medium of claim 21, wherein each processor core has a processor state defined at least in part by a state of the cache memory, and wherein context switches between virtual machines allow at least a portion of a processor state associated with a first virtual machine to remain during execution of a next virtual machine, and wherein world switches between virtual machines eliminate at least a cache, register, or pipeline state associated with a first virtual machine when switching processor core to execution of the next virtual machine.

27. The computer readable medium of claim 21, wherein the hypervisor is configured to implement the hypervisor world switch security setting by including instructions implementing a trap handler, comprising:

instructions to detect, during execution of a first virtual machine, a next virtual machine processor command from a next virtual machine, and refer to a hypervisor world switch security setting for one or more of the first virtual machine and the next virtual machine, and trap the next virtual machine processor command when the hypervisor world switch security setting is on for one or more of the first virtual machine and the next virtual machine.

28. The computer readable medium of claim 21, further comprising instructions implementing a load balance manager configured to allocate additional processing resources including one or more of processing time, processor cores, and memory resources to virtual machines including tasks for which the continuous world switch security is activated.

29. The computer readable medium of claim 21, further comprising instructions implementing a load balance manager configured to group tasks for which continuous world switch security is activated.

30. The computer readable medium of claim 21, wherein the hypervisor is configured to initiate world switches between virtual machines using a hardware virtualization assistance tool provided by one or more of the processor cores.

31-68. -68. (canceled)