Apparatus and method for monitoring communication performed by a virtual machine

• US 8,856,786 B2
• Filed: 06/11/2012
• Issued: 10/07/2014
• Est. Priority Date: 06/29/2011
• Status: Expired due to Fees

• Current Assignee: Fujitsu Limited
• Original Assignee: Fujitsu Limited
• Inventors: Kikuchi, Shunsuke, Imai, Yuji
• Primary Examiner(s): NGUYEN, VAN H
• Application Number:
  US13/493,405
• Publication Number:
  US 20130007740A1
• Time in Patent Office: 848 Days
• Field of Search: None
• US Class Current: 718/1
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 11/301 where the computing system is a virtual computing platform, e.g. logically partitioned systems virtual machines G06F9/45533; logical partitioning of resources G06F9/5077
• CPC Class Codes: G06F 11/3072 where the reporting involves data filtering, e.g. pattern matching, time or event triggered, adaptive or policy-based reporting
• CPC Class Codes: G06F 2009/45591 Monitoring or debugging support
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: H04L 12/2874 Processing of data for distribution to the subscribers
• CPC Class Codes: H04L 12/4633 Interconnection of networks using encapsulation techniques, e.g. tunneling
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 41/0895 Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements
• CPC Class Codes: H04L 41/5012 determining service availability, e.g. which services are available at a certain point in time
• CPC Class Codes: H04L 63/00 Network architectures or network communication protocols for network security cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00; network architectures or network communication protocols for wireless network security H04W12/00; security arrangements for protecting computers or computer systems against unauthorised activity G06F21/00
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

An apparatus stores, in association with each of one or more services to be provided, a communication monitoring rule under which communication performed for providing the each of the one or more services is to be monitored. The apparatus communicates with another apparatus that is operable to run a virtual machine and run a virtual router relaying communication performed by the virtual machine. When a service to be provided by the virtual machine is selected from among the one or more services, the apparatus controls the virtual router to monitor communication performed by the virtual machine according to the communication monitoring rule associated with the selected service, by sending the communication monitoring rule to the virtual router.

Claims

1. An apparatus for monitoring communication performed by a virtual machine, the apparatus comprising:

a memory to store, in association with each of one or more services, a communication monitoring rule under which communication performed for providing the each of the one or more services is to be monitored; and

a processor to;

communicate with another apparatus that is configured to run a first virtual machine and run a virtual router relaying the communication performed by the first virtual machine, and

control, when a first service to be provided by the first virtual machine is selected from among the one or more services by a user, the virtual router to monitor communication performed by the first virtual machine according to the communication monitoring rule associated with the selected first service, by sending the communication monitoring rule to the virtual router.

2. The apparatus of claim 1, wherein

the memory is further configured to store list information, the list information storing identification information identifying a first interface that is included in the virtual router and communicably coupled to the first virtual machine, in association with the selected first service;

and

the processor is configured to control the virtual router to monitor communication performed via the first interface according to the communication monitoring rule, by referring to the list information.

3. The apparatus of claim 2, wherein

the virtual router is provided with a second interface that is communicably coupled to a user-side network to which the user belongs;

the processor is configured to control the virtual router to monitor communication performed between the first and second interfaces according to the communication monitoring rule, by referring to the list information.

4. The apparatus of claim 2, wherein

the virtual router is provided with a second interface that is communicably coupled to a second virtual machine providing a second service being used by the user that has selected the first service;

the processor is configured to control the virtual router to monitor communication performed between the first and second interfaces according to the communication monitoring rule, by referring to the list information.

5. The apparatus of claim 1, wherein

the processor send the communication monitoring rule associated with the selected first service to the virtual router before the first virtual machine begins providing the selected first service.

6. A non-transitory computer readable recording medium having stored therein a program for causing a computer to execute a process comprising:

storing, in association with each of one or more services to be provided, a communication monitoring rule under which communication performed for providing the each of the one or more services is to be monitored;

communicating with an apparatus that is configured to run a virtual machine and run a virtual router relaying communication performed by the virtual machine; and

controlling, when a service to be provided by the virtual machine is selected from among the one or more services, the virtual router to monitor communication performed by the virtual machine according to the communication monitoring rule associated with the selected service, by sending the communication monitoring rule to the virtual router.

7. A method for monitoring communication performed by a virtual machine, the method comprising:

storing, in association with each of one or more services to be provided, a communication monitoring rule under which communication performed for providing the each of the one or more services is to be monitored;

communicating with an apparatus that is configured to run a virtual machine and run a virtual router relaying communication performed by the virtual machine; and

controlling, when a service to be provided by the virtual machine is selected from among the one or more services, the virtual router to monitor communication performed by the virtual machine according to the communication monitoring rule associated with the selected service, by sending the communication monitoring rule to the virtual router.