Scalable techniques for data transfer between virtual machines

• US 20170187694A1
• Filed: 12/24/2015
• Published: 06/29/2017
• Est. Priority Date: 12/24/2015
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Ben-Zion Friedman, Eliezer Tamir
• Inventors: FRIEDMAN, BEN-ZION, TAMIR, ELIEZER
• Granted Patent: US 10,628,192 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 2009/4557 Distribution of virtual machine instances; Migration and load balancing
• CPC Class Codes: G06F 2009/45583 Memory management, e.g. access or allocation
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: G06F 9/54 Interprogram communication

Abstract

Scalable techniques for data transfer between virtual machines (VMs) are described. In an example embodiment, an apparatus may comprise circuitry, a virtual machine management component for execution by the circuitry to define a plurality of public virtual memory spaces and assign each one of the plurality of public virtual memory spaces to a respective one of a plurality of VMs including a first VM and a second VM, and a virtual machine execution component for execution by the circuitry to execute a first virtual machine process corresponding to the first VM and a second virtual machine process corresponding to the second VM, the first virtual machine process to identify data to be provided to the second VM by the first VM and provide the data to the second VM by writing to a public virtual memory space assigned to the first VM. Other embodiments are described and claimed.

Claims

1. An apparatus, comprising:

circuitry;

a virtual machine management component for execution by the circuitry to;

define a plurality of public virtual memory spaces; and

assign each one of the plurality of public virtual memory spaces to a respective one of a plurality of virtual machines including a first virtual machine and a second virtual machine; and

a virtual machine execution component for execution by the circuitry to execute a first virtual machine process corresponding to the first virtual machine and a second virtual machine process corresponding to the second virtual machine, the first virtual machine process to identify data to be provided to the second virtual machine by the first virtual machine and provide the data to the second virtual machine by writing to a public virtual memory space assigned to the first virtual machine.

2. The apparatus of claim 1, the first virtual machine process to encrypt the data and write the encrypted data to the public virtual memory space assigned to the first virtual machine.

3. The apparatus of claim 2, the second virtual machine process to retrieve the encrypted data from the public virtual memory space assigned to the first virtual machine and decrypt the encrypted data.

4. The apparatus of claim 2, the first virtual machine process to encrypt the data using a symmetric encryption key, the second virtual machine process to decrypt the encrypted data using the symmetric encryption key.

5. The apparatus of claim 4, the symmetric encryption key to comprise a dedicated key for use in encryption and decryption of data to be provided to the second virtual machine by the first virtual machine.

6. The apparatus of claim 4, the first virtual machine process to encrypt the symmetric encryption key using a public key of a private/public key pair, the second virtual machine process to decrypt the encrypted symmetric encryption key using a private key of the private/public key pair.

7. The apparatus of claim 6, the public key to comprise a dedicated key for use in encryption of symmetric encryption keys to be provided to the second virtual machine, the private key to comprise a dedicated key for use in decryption of encrypted symmetric encryption keys provided to the second virtual machine.

8. A method, comprising:

defining a plurality of public virtual memory spaces;

assigning each one of the plurality of public virtual memory spaces to a respective one of a plurality of virtual machines including a first virtual machine and a second virtual machine; and

executing, by processing circuitry, a first virtual machine process corresponding to the first virtual machine and a second virtual machine process corresponding to the second virtual machine, the first virtual machine process to identify data to be provided to the second virtual machine by the first virtual machine and provide the data to the second virtual machine by writing to a public virtual memory space assigned to the first virtual machine.

9. The method of claim 8, the first virtual machine process to encrypt the data and write the encrypted data to the public virtual memory space assigned to the first virtual machine.

10. The method of claim 9, the second virtual machine process to retrieve the encrypted data from the public virtual memory space assigned to the first virtual machine and decrypt the encrypted data.

11. The method of claim 9, the first virtual machine process to encrypt the data using a symmetric encryption key, the second virtual machine process to decrypt the encrypted data using the symmetric encryption key.

12. The method of claim 11, the symmetric encryption key to comprise a dedicated key for use in encryption and decryption of data to be provided to the second virtual machine by the first virtual machine.

13. The method of claim 11, the first virtual machine process to encrypt the symmetric encryption key using a public key of a private/public key pair, the second virtual machine process to decrypt the encrypted symmetric encryption key using a private key of the private/public key pair.

14. The method of claim 13, the public key to comprise a dedicated key for use in encryption of symmetric encryption keys to be provided to the second virtual machine, the private key to comprise a dedicated key for use in decryption of encrypted symmetric encryption keys provided to the second virtual machine.

15. At least one non-transitory computer-readable storage medium comprising a set of instructions that, in response to being executed on a computing device, cause the computing device to:

define a plurality of public virtual memory spaces;

assign each one of the plurality of public virtual memory spaces to a respective one of a plurality of virtual machines including a first virtual machine and a second virtual machine; and

execute a first virtual machine process corresponding to the first virtual machine and a second virtual machine process corresponding to the second virtual machine, the first virtual machine process to identify data to be provided to the second virtual machine by the first virtual machine and provide the data to the second virtual machine by writing to a public virtual memory space assigned to the first virtual machine.

16. The at least one non-transitory computer-readable storage medium of claim 15, the first virtual machine process to encrypt the data and write the encrypted data to the public virtual memory space assigned to the first virtual machine.

17. The at least one non-transitory computer-readable storage medium of claim 16, the second virtual machine process to retrieve the encrypted data from the public virtual memory space assigned to the first virtual machine and decrypt the encrypted data.

18. The at least one non-transitory computer-readable storage medium of claim 16, the first virtual machine process to encrypt the data using a symmetric encryption key, the second virtual machine process to decrypt the encrypted data using the symmetric encryption key.

19. The at least one non-transitory computer-readable storage medium of claim 18, the symmetric encryption key to comprise a dedicated key for use in encryption and decryption of data to be provided to the second virtual machine by the first virtual machine.

20. The at least one non-transitory computer-readable storage medium of claim 18, the first virtual machine process to encrypt the symmetric encryption key using a public key of a private/public key pair, the second virtual machine process to decrypt the encrypted symmetric encryption key using a private key of the private/public key pair.

21. The at least one non-transitory computer-readable storage medium of claim 20, the public key to comprise a dedicated key for use in encryption of symmetric encryption keys to be provided to the second virtual machine, the private key to comprise a dedicated key for use in decryption of encrypted symmetric encryption keys provided to the second virtual machine.

22. An apparatus, comprising:

means for defining a plurality of public virtual memory spaces;

means for assigning each one of the plurality of public virtual memory spaces to a respective one of a plurality of virtual machines including a first virtual machine and a second virtual machine; and

means for executing a first virtual machine process corresponding to the first virtual machine and a second virtual machine process corresponding to the second virtual machine, the first virtual machine process to identify data to be provided to the second virtual machine by the first virtual machine, encrypt the data, and write the encrypted data to a public virtual memory space assigned to the first virtual machine.

23. The apparatus of claim 22, the first virtual machine process to encrypt the data using a symmetric encryption key, the second virtual machine process to retrieve the encrypted data from the public virtual memory space and decrypt the encrypted data using the symmetric encryption key, the symmetric encryption key to comprise a dedicated key for use in encryption and decryption of data to be provided to the second virtual machine by the first virtual machine.

24. The apparatus of claim 23, the first virtual machine process to encrypt the symmetric encryption key using a public key of a private/public key pair, the second virtual machine process to decrypt the encrypted symmetric encryption key using a private key of the private/public key pair.

25. The apparatus of claim 24, the public key to comprise a dedicated key for use in encryption of symmetric encryption keys to be provided to the second virtual machine, the private key to comprise a dedicated key for use in decryption of encrypted symmetric encryption keys provided to the second virtual machine.