Compliance-based adaptations in managed virtual systems

• US 8,234,641 B2
• Filed: 11/27/2007
• Issued: 07/31/2012
• Est. Priority Date: 10/17/2006
• Status: Active Grant

• Current Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Original Assignee: Managelq Incorporated
• Inventors: Fitzgerald, Joseph, Barenboim, Oleg
• Primary Examiner(s): Truong, Camquy
• Application Number:
  US11/945,935
• Publication Number:
  US 20080134177A1
• Time in Patent Office: 1,708 Days
• Field of Search: None
• US Class Current: 718/1
• CPC Class Codes: G06F 11/0712 in a virtual computing platform, e.g. logically partitioned systems
• CPC Class Codes: G06F 2009/4557 Distribution of virtual machine instances; Migration and load balancing
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 9/45533 Hypervisors; Virtual machine monitors
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Techniques are disclosed for controlling and managing virtual machines and other such virtual systems. VM execution approval is based on compliance with policies controlling various aspects of VM. The techniques can be employed to benefit all virtual environments, such as virtual machines, virtual appliances, and virtual applications. For ease of discussion herein, assume that a virtual machine (VM) represents each of these environments. In one particular embodiment, a systems management partition (SMP) is created inside the VM to provide a persistent and resilient storage for management information (e.g., logical and physical VM metadata). The SMP can also be used as a staging area for installing additional content or agentry on the VM when the VM is executed. Remote storage of management information can also be used. The VM management information can then be made available for pre-execution processing, including policy-based compliance testing.

Claims

1. An apparatus for enforcing a policy associated with a virtual machine, the apparatus comprising:

a computing device communicatively coupled to a virtual machine, the computing device being programmed to;

receive a virtual machine event request;

receive first data from within the virtual machine in response to receiving the virtual machine event request;

receive second different data from an environment outside the virtual machine in response to receiving the virtual machine event request;

detect internal non-compliance by the virtual machine of a first policy-based compliance scheme based on the first data;

detect external non-compliance by the virtual machine as provided in the environment of a second different policy-based compliance scheme based on second different data;

adapting the virtual machine to comply with the first policy-based compliance scheme by manipulating the virtual machine;

adapting the environment to comply with the second policy-based compliance scheme; and

processing the virtual machine event request after adapting the virtual machine and the environment.

2. The apparatus of claim 1, wherein the virtual machine event request includes a stop virtual machine request.

3. The apparatus of claim 1, wherein the virtual machine event request includes a pause virtual machine request.

4. The apparatus of claim 1, wherein the virtual machine event request includes a move virtual machine request.

5. The apparatus of claim 1, wherein the virtual machine event request includes a clone virtual machine request.

6. The apparatus of claim 1, wherein the virtual machine event request includes a create new virtual machine request.

7. The apparatus of claim 1, wherein the virtual machine event request includes a display virtual machine from template request.

8. The apparatus of claim 1, wherein the non-compliance includes at least one of software that has not been installed on the virtual machine, software that has been removed from the virtual machine, and software that has not been updated on the virtual machine.

9. The apparatus of claim 1, wherein adapting the virtual machine includes insertion of data into the virtual machine.

10. The apparatus of claim 1, wherein adapting the virtual machine includes at least one of updating a virus definition, installing anti-virus software, installing a security patch, executing an anti-virus scanning application, removing malware, and disabling malware.

11. The apparatus of claim 10, wherein the malware includes at least one of a virus, worm, trojan horse, rootkit, spyware, and adware.

12. The apparatus of claim 1, wherein adapting the virtual machine includes adjusting security settings associated with the virtual machine.

13. The apparatus of claim 1, wherein adapting the target virtual machine comprises deleting unauthorized content from the virtual machine.

14. The apparatus of claim 1, wherein adapting the virtual machine includes at least one of obtaining necessary licensing associated with the virtual machine and automatically issuing a notification to an administrator to obtain licensing associated with the virtual machine.

15. The apparatus of claim 1, wherein adapting the target virtual machine includes scheduling at least one of an agent and a process to carryout remedial action.

16. The apparatus of claim 15, wherein scheduling at least one of an agent or process includes at least one of requesting, transferring, downloading, and installing at least one of security updates for the virtual machine and security patches for the virtual machine.

17. The apparatus of claim 15, wherein scheduling at least one of an agent or process includes at least one of searching for and eradicating malware associated with the virtual machine.

18. The apparatus of claim 15, wherein scheduling at least one of an agent or process includes registering the virtual machine for use in a managed system.

19. The apparatus of claim 1, wherein adapting the virtual machine includes restricting access permissions, so that the virtual machine can only access certain content, resources, and areas of a managed system.

20. The apparatus of claim 1, wherein adapting the virtual machine includes at least one of adding, updating, and deleting user account information, so as to limit account authority associated with the virtual machine.

21. The apparatus of claim 1, wherein adapting the virtual machine includes validating adaptations made to the virtual machine.

22. The apparatus of claim 21, wherein validating adaptations made includes repeating policy-based compliance testing that was used to determine the virtual machine was non-compliant.

23. The apparatus of claim 1, wherein the virtual machine is at least one of a virtual application and a virtual appliance.

24. The apparatus of claim 1, wherein the virtual machine is part of a group that includes a plurality of virtual machines, and the computing device is programmed to adapt the virtual machine when a quorum of the plurality of virtual machines have been adapted.

25. The apparatus of claim 1, wherein the environment is at least one of a virtual machine manager, a host environment, a management agent, and an execution platform.