Enforcement of compliance policies in managed virtual systems
First Claim
1. An apparatus for enforcing a policy associated with a virtual machine, the apparatus comprising:
- a memory device storing instructions; and
a computing device communicatively coupled to a newly created virtual machine, the computing device including a processor operably coupled to the memory device, the processor executing the instructions to;
receive a virtual machine event request, wherein the virtual machine event request includes a start virtual machine request for the virtual machine, which is prevented from being started from when the virtual machine is newly created until the virtual machine is determined to be compliant with a plurality of compliance based schemes;
receive first data from within the virtual machine in response to receiving the virtual machine event request;
receive second different data from an environment outside the virtual machine in response to receiving the virtual machine event request;
determine whether an internal non-compliance by the virtual machine of a first policy-based compliance scheme exists based on the first data;
determine whether an external non-compliance by the virtual machine as provided in the environment of a second different policy-based compliance scheme exists based on the second different data; and
in response to determining that at least one of an internal non-compliance and an external non-compliance exists, deny the virtual machine event request.
2 Assignments
0 Petitions
Accused Products
Abstract
Techniques are disclosed for controlling and managing virtual machines and other such virtual systems. VM execution approval is based on compliance with policies controlling various aspects of VM. The techniques can be employed to benefit all virtual environments, such as virtual machines, virtual appliances, and virtual applications. For ease of discussion herein, assume that a virtual machine (VM) represents each of these environments. In one particular embodiment, a systems management partition (SMP) is created inside the VM to provide a persistent and resilient storage for management information (e.g., logical and physical VM metadata). The SMP can also be used as a staging area for installing additional content or agentry on the VM when the VM is executed. Remote storage of management information can also be used. The VM management information can then be made available for pre-execution processing, including policy-based compliance testing.
-
Citations
14 Claims
-
1. An apparatus for enforcing a policy associated with a virtual machine, the apparatus comprising:
-
a memory device storing instructions; and a computing device communicatively coupled to a newly created virtual machine, the computing device including a processor operably coupled to the memory device, the processor executing the instructions to; receive a virtual machine event request, wherein the virtual machine event request includes a start virtual machine request for the virtual machine, which is prevented from being started from when the virtual machine is newly created until the virtual machine is determined to be compliant with a plurality of compliance based schemes; receive first data from within the virtual machine in response to receiving the virtual machine event request; receive second different data from an environment outside the virtual machine in response to receiving the virtual machine event request; determine whether an internal non-compliance by the virtual machine of a first policy-based compliance scheme exists based on the first data; determine whether an external non-compliance by the virtual machine as provided in the environment of a second different policy-based compliance scheme exists based on the second different data; and in response to determining that at least one of an internal non-compliance and an external non-compliance exists, deny the virtual machine event request. - View Dependent Claims (2, 3, 4)
-
-
5. A computer implemented method for enforcing a policy associated with a virtual machine, comprising:
-
storing a plurality of policies associated with a newly created virtual machine, including at least a first policy and a second policy, the virtual machine including; at least one virtual disk, and at least one configuration file; receiving a virtual machine event request, wherein the virtual machine event request includes a start virtual machine request for the virtual machine, which is prevented from being started from when the virtual machine is newly created until the virtual machine is determined to be compliant with a plurality of compliance based schemes; and enforcing the plurality of policies associated with the virtual machine, after the virtual machine event request is received and prior to executing the virtual machine, by; receiving first data from within the virtual machine in response to receiving the virtual machine event request; applying the first policy to the first data to determine whether non-compliance exists within the first virtual machine of the first policy; receiving second data from outside the virtual machine in response to receiving the virtual machine event request; applying the second policy to the second data to determine whether non-compliance exists outside the first virtual machine of the second policy; and in response to determining that non-compliance exists at least one of within the first virtual machine and outside the first virtual machine, denying the virtual machine event request. - View Dependent Claims (6, 7, 8, 9, 10, 11, 12, 13)
-
-
14. A system for enforcing a policy associated with a virtual machine, the system comprising:
-
at least one processor; and at least one computer readable medium encoded with instructions, which when executed by the at least one processor, cause the at least one processor to; store a plurality of policies associated with a newly created virtual machine, including at least a first policy and a second policy, the virtual machine including; at least one virtual disk, and at least one configuration file; receive a virtual machine event request, wherein the virtual machine event request includes a start virtual machine request for the virtual machine, which is prevented from being started from when the virtual machine is newly created until the virtual machine is determined to be compliant with a plurality of compliance based schemes; and enforce the plurality of policies associated with the virtual machine, after the virtual machine event request is received and prior to executing the virtual machine, by; receiving first data from within the virtual machine in response to receiving the virtual machine event request; applying the first policy to the first data to determine whether non-compliance exists within the first virtual machine of the first policy; receiving second data from outside the virtual machine in response to receiving the virtual machine event request; applying the second policy to the second data to determine whether non-compliance exists outside the first virtual machine of the second policy; and in response to determining that non-compliance exists at least one of within the first virtual machine and outside the first virtual machine, denying the virtual machine event request.
-
Specification