Richer Model of Cloud App Markets

• US 20150106803A1
• Filed: 10/15/2013
• Published: 04/16/2015
• Est. Priority Date: 10/15/2013
• Status: Active Grant

• Current Assignee: AT&T Intellectual Property I LP (AT&T, Inc.), Rutgers University
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.), Rutgers University
• Inventors: Srivastava, Abhinav, Ganapathy, Vinod
• Granted Patent: US 9,542,216 B2
• Time in Patent Office: Days
• US Class Current: 718/1
• CPC Class Codes: G06F 2009/45566 Nested virtual machines
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 2009/45591 Monitoring or debugging support
• CPC Class Codes: G06F 2009/45595 Network integration; Enabling network access in virtual machine instances
• CPC Class Codes: G06F 8/60 Software deployment
• CPC Class Codes: G06F 9/455 Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
• CPC Class Codes: G06F 9/45533 Hypervisors; Virtual machine monitors
• CPC Class Codes: G06F 9/45545 Guest-host, i.e. hypervisor is an application program itself, e.g. VirtualBox
• CPC Class Codes: G06F 9/4555 Para-virtualisation, i.e. guest operating system has to be modified
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: G06F 9/50 Allocation of resources, e.g. of the central processing unit [CPU]
• CPC Class Codes: G06F 9/5072 Grid computing
• CPC Class Codes: G06Q 30/0609 Buyer or seller confidence or verification
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

In a cloud app market, a cloud infrastructure customer can purchase apps for performing services such as rootkit detection and network security for a customer virtual machine run by the cloud infrastructure customer. A cloud infrastructure provider executes a provider virtual machine monitor or hypervisor on cloud infrastructure. The cloud app is provided with a customer virtual machine monitor nested on the provider virtual machine monitor. The customer virtual machine, together with a nested management domain of the customer, execute on the customer virtual machine monitor.

Claims

1. A method for implementing a cloud-based app market, comprising:

by a cloud infrastructure provider, providing a customer virtual machine monitor for use by a cloud infrastructure customer in executing a work virtual machine and in executing a management virtual machine, the customer virtual machine monitor being nested on a provider virtual machine monitor, the management virtual machine permitting implementation of privileged services by the cloud infrastructure customer; and

by the cloud infrastructure provider, providing, for instantiation by the cloud infrastructure customer, a virtual machine app for execution on the customer virtual machine monitor, the virtual machine app having privileges for accessing privileged information from a work virtual machine under control of the cloud infrastructure customer, the virtual machine app containing a virtual machine app operating system separate from the work virtual machine operating system, the virtual machine app further containing instructions for performing a service based on the privileged information from the work virtual machine.

2. The method of claim 1 wherein the virtual machine app is a function of the management virtual machine.

3. The method of claim 1 wherein the provider virtual machine monitor provides hardware level support for nesting and the customer virtual machine monitor executes on the provider virtual machine monitor.

4. The method of claim 1 wherein the provider virtual machine monitor does not provide hardware level support for nesting and the customer virtual machine monitor executes on a second-level virtualization layer that executes on the provider virtual machine monitor and emulates privileged operations for the customer virtual machine monitor.

5. The method of claim 4 wherein the second-level virtualization layer is a driver for interacting with paravirtualized device interfaces.

6. The method of claim 1 wherein the instructions for performing a service based on the privileged information from the work virtual machine comprise instructions for conducting two-way communication between the work virtual machine and the virtual machine app.

7. The method of claim 6 wherein the instructions comprise instructions for performing a service selected from a group consisting of a checkpointing service, an antivirus service and an intrusion detection service.

8. The method of claim 1, wherein the instructions for performing a service based on the privileged information from the work virtual machine comprise instructions for operating on an output of the work virtual machine.

9. The method of claim 8 wherein the instructions comprise instructions for performing a service selected from a group consisting of a forensic analysis service and a network security service.

10. The method of claim 1 wherein the instructions for performing a service based on the privileged information from the work virtual machine further comprise instructions for passing the privileged information from the virtual machine app to a second virtual machine app for performing an additional analysis.

11. Computer readable media comprising one or more storage devices, the computer readable media having stored thereon computer readable instructions for execution by processors in a cloud infrastructure provided by a cloud infrastructure provider, wherein execution of the computer readable instructions causes the processors to perform operations comprising:

instantiating a customer virtual machine monitor nested on a provider virtual machine monitor, a customer work virtual machine being configured to execute on the customer virtual machine monitor;

instantiating a management virtual machine executing on the customer virtual machine monitor, the management virtual machine permitting implementation of privileged services by a cloud infrastructure customer;

instantiating a virtual machine app for execution on the customer virtual machine monitor, the virtual machine app having privileges for accessing privileged information from a work virtual machine under control of the cloud infrastructure customer, the virtual machine app containing a virtual machine app operating system separate from the work virtual machine operating system, the virtual machine app further containing instructions for performing a service based on the privileged information from the work virtual machine.

12. The computer readable media of claim 11 wherein the virtual machine app is a function of the management virtual machine.

13. The computer readable media of claim 11 wherein the provider virtual machine monitor provides hardware level support for nesting and the customer virtual machine monitor executes on the provider virtual machine monitor.

14. The computer readable media of claim 11 wherein the provider virtual machine monitor does not provide hardware level support for nesting and the customer virtual machine monitor executes on a second-level virtualization layer that executes on the provider virtual machine monitor and emulates privileged operations for the customer virtual machine monitor.

15. The computer readable media of claim 14 wherein the second-level virtualization layer is a driver for interacting with paravirtualized device interfaces.

16. The computer readable media of claim 11 wherein the instructions for performing a service based on the privileged information from the work virtual machine comprise instructions for conducting two-way communication between the work virtual machine and the virtual machine app.

17. The computer readable media of claim 16 wherein the instructions comprise instructions for performing a service selected from a group consisting of a checkpointing service, an antivirus service and an intrusion detection service.

18. The computer readable media of claim 11, wherein the instructions for performing a service based on the privileged information from the work virtual machine comprise instructions for operating on an output of the work virtual machine.

19. The computer readable media of claim 18 wherein the instructions comprise instructions for performing a service selected from a group consisting of a forensic analysis service and a network security service.

20. The computer readable media of claim 11 wherein the instructions for performing a service based on the privileged information from the work virtual machine further comprise instructions for passing the privileged information from the virtual machine app to a second virtual machine app for performing an additional analysis.