Method and apparatus for providing computer services

• US 7,448,079 B2
• Filed: 07/03/2001
• Issued: 11/04/2008
• Est. Priority Date: 07/05/2000
• Status: Expired due to Fees

• Current Assignee: Ernst & Young LLP
• Original Assignee: Ernst & Young LLP
• Inventors: Tremain, Geoffrey Donald
• Primary Examiner(s): Moazzami, Nasser
• Assistant Examiner(s): Cervetti, David Garcia
• Application Number:
  US09/898,286
• Publication Number:
  US 20020069369A1
• Time in Patent Office: 2,681 Days
• Field of Search: 713/201, 713/200, 726/14
• US Class Current: 726/14
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones
• CPC Class Codes: H04L 63/0218 Distributed architectures, e.g. distributed firewalls
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 67/01 Protocols

Abstract

An apparatus and method are disclosed for providing one or more computer services to a plurality of customers (A,B,C). At least one virtual machine (VS) is set up on a real computer (30) for each of the customers (A,B,C) at the request of each of the customers (A,B,C). The or each virtual machine (VS) for each of the customers (A,B,C) has a specification specified by the respective customer (A,B,C).

Claims

1. Apparatus operated by a computer service provider and providing one or more computer services for a plurality of customers of the computer service provider, the apparatus comprising:

a real computer, operated by a computer service provider and coupled to a real network, on which is set up at the request of each of a plurality of customers of the computer service provider at least one virtual machine for each of said customers;

wherein said at least one virtual machine for each of said customers is configured to provide one or more computer services over the real network for each respective customer; and

wherein said at least one virtual machine for each of said customers comprises a specification specified by and configurable by the respective customer, and further comprises a separate operating system running thereon.

2. Apparatus according to claim 1, wherein plural virtual machines are set up within the real computer for at least one of said customers.

3. Apparatus according to claim 1, wherein the or each virtual machine for at least one of said customers is connected to a virtual network set up for said at least one customer within the real computer.

4. Apparatus according to claim 3, comprising a virtual intrusion detection device for detecting an attack on the virtual network.

5. Apparatus according to claim 1, wherein at least one virtual machine is connected to a virtual firewall that is connectable to an external network to which customers and/or other users can connect such that access to said at least one virtual machine by a customer or other user via a said external network can only take place through a virtual firewall.

6. Apparatus according to claim 5, wherein the or at least one of the virtual firewalls is implemented by a virtual machine on the real computer, said virtual firewall virtual machine running firewall software.

7. Apparatus according to claim 1, wherein the or each virtual machine for a particular customer is connected to a virtual firewall that is dedicated to that customer'"'"'s virtual machine or machines, each virtual firewall being connectable to an external network to which each of said customers and/or other users can connect such that access to a virtual machine by a customer or other user via a said external network can only take place through a virtual firewall provided for that virtual machine or machines.

8. Apparatus according to claim 7, wherein each virtual firewall is set up within the real computer, the or each virtual machine for each customer being connected to a first port of the virtual firewall that is dedicated to that customer'"'"'s virtual machine or machines, each virtual firewall having a second port connected to a virtual network that is set up within the real computer and that is connectable to an external network.

9. Apparatus according to claim 8, wherein the second port of each virtual firewall is connected to the same virtual network that is set up within the real computer and that is connectable to an external network.

10. Apparatus according to claim 1, comprising a plurality of real data storage devices and at least one virtual storage subsystem that is configured to allow said real data storage devices to emulate one or more virtual storage devices.

11. Apparatus according to claim 10, wherein the at least one virtual storage subsystem is configured to emulate at least one respective virtual storage device for each customer.

12. Apparatus according to claim 10, comprising a detection device for detecting evidence of malicious software or hostile attack signatures on the at least one virtual storage subsystem.

13. Apparatus according to claim 1, wherein the apparatus is configurable to provide at least one of the services selected from:

file, data and archiving services;

applications hosting services;

database hosting services;

data warehouse services;

knowledge management hosting services;

digital media production services;

intellectual property and streaming media services;

simple web hosting services;

complex e-Commerce web hosting services;

high performance computation services;

electronic messaging and conferencing services; and

, learning neuro-computer services.

14. Apparatus according to claim 1, comprising virtual private network software to provide an encrypted communication channel for communication between at least some of said virtual machines.

15. Apparatus according claim 1, comprising virtual private network software to provide an encrypted communication channel for communication between at least one virtual machine and an external computer.

16. Apparatus according claim 1, comprising virtual private network software to provide an encrypted communication channel for communication between a first virtual network and a second virtual network.

17. Apparatus according to claim 1, comprising virtual private network software to provide an encrypted communication channel for communication between a virtual network and an external computer.

18. Apparatus according claim 1, wherein the real computer comprises plural physical computers.

19. In combination, a first apparatus according to claim 1 and a second apparatus that is substantially identical to said first apparatus, the first and second apparatus being connected by a communications channel so that the second apparatus can provide for redundancy of the first apparatus thereby to provide for disaster recovery if the first apparatus fails.

20. Apparatus according to claim 1, wherein at least one of said virtual machines provides at least a virtual central processor unit.

21. Apparatus according to claim 1, wherein at least one of said virtual machines is created using a virtual machine abstraction program.

22. Apparatus according to claim 1, wherein at least one of said virtual machines is created using machine simulation/emulation software.

23. Apparatus according to claim 1, wherein the one or more computer services for the respective customers are provided over a virtual network which is implemented over said real network.

24. Apparatus according to claim 1, wherein the real computer is arranged such that the specification of said at least one virtual machine for each of said customers is specified by and configurable by the respective customer over said real network or another real network.

25. Apparatus according to claim 24, wherein the real computer is arranged such that the specification of said at least one virtual machine for each of said customers is specified by and configurable by the respective customer over a virtual network which is implemented on said real network or said another real network.

26. Apparatus according to claim 1, further comprising a system configurator program that accepts said specification from each of said customers, said configurator program being operable to modify, based on said specification, the configuration of said at least one virtual machine.

27. A method of providing one or more computer services for a plurality of customers of a computer service provider, the method comprising the steps of:

a service provider setting up on a real computer, at the request of each of said customers, at least one virtual machine for each of said customers of the computer service provider whereby each virtual machine for each of said customers is configured to provide one or more computer services over a real network for each respective customer;

the real computer accepting specification and configuration information for the virtual machines from each of said customers whereby the specification of each of the virtual machines is specified by and configurable by the respective customer, each virtual machine comprising a separate operating system running thereon.

28. A method according to claim 27, comprising the step of setting up plural virtual machines within the real computer for at least one of said customers.

29. A method according to claim 27, comprising the steps of setting up a virtual network for at least one of said customers within the real computer, and connecting the or each virtual machine for said at least one customer to said virtual network.

30. A method according to claim 29, comprising the step of using a virtual intrusion detection device for detecting an attack on the virtual network.

31. A method according to claim 27, comprising the steps of connecting at least one virtual machine to a virtual firewall, and connecting the or each virtual firewall to an external network to which customers and/or other users can connect such that access to a virtual machine by a customer or other user via a said external network can only take place through a virtual firewall.

32. A method according to claim 27, comprising the step of connecting the or each virtual machine for a particular customer to a virtual firewall that is dedicated to that customer'"'"'s virtual machine or machines, and connecting each virtual firewall to an external network to which each of said customers and/or other users can connect such that access to a virtual machine by a customer or other user via a said external network can only take place through a virtual firewall provided for that virtual machine or machines.

33. A method according to claim 32, wherein each virtual firewall is set up within the real computer, the or each virtual machine for each customer being connected to a first port of the virtual firewall that is dedicated to that customer'"'"'s virtual machine or machines, each virtual firewall having a second port connected to a virtual network that is set up within the real computer and that is connected to an external network.

34. A method according to claim 33, wherein the second port of each virtual firewall is connected to the same virtual network that is set up within the real computer and that is connectable to an external network.

35. A method according to claim 27, comprising the step of configuring at least one virtual storage subsystem to allow multiple real data storage devices to emulate one or more virtual storage devices.

36. A method according to claim 35, comprising the step of configuring the at least one virtual storage subsystem to emulate at least one respective virtual storage device for each customer.

37. A method according to claim 35, comprising the step of using a detection device for detecting evidence of malicious software or hostile attack signatures on the at least one virtual storage subsystem.

38. A method according to claim 27, wherein the services provided include at least one of the services selected from:

file, data and archiving services;

applications hosting services;

database hosting services;

data warehouse services;

knowledge management hosting services;

digital media production services;

intellectual property and streaming media services;

simple web hosting services;

complex e-Commerce web hosting services;

high performance computation services;

electronic messaging and conferencing services; and

, learning neuro-computer services.

39. A method according to claim 27, comprising the step of using virtual private network software to provide an encrypted communication channel for communication between at least some of said virtual machines.

40. A method according to claim 27, comprising the step of using virtual private network software to provide an encrypted communication channel for communication between at least one virtual machine and an external computer.

41. A method according to claim 27, comprising the step of using virtual private network software to provide an encrypted communication channel for communication between a first virtual network and a second virtual network.

42. A method according to claim 27, comprising the step of using virtual private network software to provide an encrypted communication channel for communication between a virtual network and an external computer.

43. A method according to claim 27, comprising the step of moving said at least one virtual machine from a first real computer to a second real computer.

44. A method according to claim 27, wherein at least one of said virtual machines provides at least a virtual central processor unit.

45. A method according to claim 27, wherein at least one of said virtual machines is created using a virtual machine abstraction program.

46. A method according to claim 27, wherein at least one of said virtual machines is created using machine simulation/emulation software.

47. A method according to claim 27, wherein said real computer accepting said specification comprises accepting said specification over said real network or another real network.

48. A method according to claim 47, wherein said real computer accepting said specification comprises accepting said specification over a virtual network which is implemented over said real network or said another real network.

49. A method of operating a real computer on behalf of a plurality of customers of an operator of the real computer, the method comprising the steps of:

operating a plurality of virtual machines on the real computer so as to provide respective computer services for the respective customers over a real network; and

receiving at each of said plural virtual machines a specification specified by and configurable by a respective one of the customers of the operator of the real computer in accordance with a computer service to be provided by the virtual machine on behalf of that customer;

wherein each of said virtual machines comprises a separate operating system running thereon.

50. A method according to claim 49, comprising the step of operating plural virtual machines within the real computer for at least one of said customers.

51. A method according to claim 49, comprising the step of operating a virtual network for at least one of said customers within the real computer, the or each virtual machine for said at least one customer being connected to said virtual network.

52. A method according to claim 51, comprising the step of using a virtual intrusion detection device for detecting an attack on the virtual network.

53. A method according to claim 49, wherein at least one virtual machine is connected to a virtual firewall, the or each virtual firewall being connected to an external network to which customers and/or other users can connect such that access to a virtual machine by a customer or other user via a said external network can only take place through a virtual firewall.

54. A method according to claim 49, wherein the or each virtual machine for a particular customer is connected to a virtual firewall that is dedicated to that customer'"'"'s virtual machine or machines, each virtual firewall being connected to an external network to which each of said customers and/or other users can connect such that access to a virtual machine by a customer or other user via a said external network can only take place through a virtual firewall provided for that virtual machine or machines.

55. A method according to claim 54, wherein each virtual firewall is set up within the real computer, the or each virtual machine for each customer being connected to a first port of the virtual firewall that is dedicated to that customer'"'"'s virtual machine or machines, each virtual firewall having a second port connected to a virtual network that is set up within the real computer and that is connected to an external network.

56. A method according to claim 55, wherein the second port of each virtual firewall is connected to the same virtual network that is set up within the real computer and that is connectable to an external network.

57. A method according to claim 49, wherein at least one virtual storage subsystem is provided and configured to allow multiple real data storage devices to emulate one or more virtual storage devices.

58. A method according to claim 57, wherein the at least one virtual storage subsystem is configured to emulate at least one respective virtual storage device for each customer.

59. A method according to claim 57, wherein a detection device is used for detecting evidence of malicious software or hostile attack signatures on the at least one virtual storage subsystem.

60. A method according to claim 49, wherein the services provided include at least one of the services selected from:

file, data and archiving services;

applications hosting services;

database hosting services;

data warehouse services;

knowledge management hosting services;

digital media production services;

intellectual property and streaming media services;

simple web hosting services;

complex e-Commerce web hosting services;

high performance computation services;

electronic messaging and conferencing services; and

, learning neuro-computer services.

61. A method according to claim 49, comprising the step of using virtual private network software to provide an encrypted communication channel for communication between at least some of said virtual machines.

62. A method according to claim 49, comprising the step of using virtual private network software to provide an encrypted communication channel for communication between at least one virtual machine and an external computer.

63. A method according to claim 49, comprising the step of using virtual private network software to provide an encrypted communication channel for communication between a first virtual network and a second virtual network.

64. A method according to claim 49, comprising the step of using virtual private network software to provide an encrypted communication channel for communication between a virtual network and an external computer.

65. A method according to claim 49, comprising the step of moving said at least one virtual machine from a first real computer to a second real computer.

66. A method according to claim 49, wherein at least one of said virtual machines provides at least a virtual central processor unit.

67. A method according to claim 49, wherein at least one of said virtual machines is created using a virtual machine abstraction program.

68. A method according to claim 49, wherein at least one of said virtual machines is created using machine simulation/emulation software.

69. A method according to claim 49, wherein receiving at each of said plural virtual machines said specification comprises receiving said specification over said real network or another real network.

70. A method according to claim 69, wherein receiving at each of said plural virtual machines said specification comprises receiving said specification over a virtual network which is implemented over said real network or said another real network.

71. A method of providing for a plurality of customers of an operator of a real computer one or more computer services selected from:

file, data and archiving services;

applications hosting services;

database hosting services;

data warehouse services;

knowledge management hosting services;

digital media production services;

intellectual property and streaming media services;

simple web hosting services;

complex e-Commerce web hosting services;

high performance computation services;

electronic messaging and conferencing services; and

, learning neuro-computer services;

the method comprising the steps of;

said operator setting up on said real computer at the request of each of said customers at least one virtual machine for each of said customers of the operator to provide one or more computer services for each of said customers over a real network; and

receiving at said at least one virtual machine for each of said customers a specification determined in accordance with the computer service or services requested by said customer and configurable by said customer, said at least one virtual machine having a separate operating system running thereon.

72. A method according to claim 71, comprising the step of moving said at least one virtual machine from a first real computer to a second real computer.

73. A method according to claim 71, wherein receiving at said at least one virtual machine for each of said customers a specification comprises receiving said specification over said real network or another real network.

74. A method according to claim 73, wherein receiving at said at least one virtual machine for each of said customers a specification comprises receiving said specification over a virtual network which is implemented over said real network or said another real network.