Enforcement of compliance policies in managed virtual systems

• US 9,015,703 B2
• Filed: 11/27/2007
• Issued: 04/21/2015
• Est. Priority Date: 10/17/2006
• Status: Active Grant

• Current Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Original Assignee: ManageIQ, Inc. (International Business Machines Corporation)
• Inventors: Fitzgerald, Joseph, Barenboim, Oleg
• Primary Examiner(s): Wai, Eric C
• Application Number:
  US11/945,927
• Publication Number:
  US 20080134176A1
• Time in Patent Office: 2,702 Days
• US Class Current: 718/1
• CPC Class Codes: G06F 11/0712 in a virtual computing platform, e.g. logically partitioned systems
• CPC Class Codes: G06F 11/0727 in a storage system, e.g. in a DASD or network based storage system drivers for digital recording or reproducing units G06F3/06; circuits for error detection or correction within digital recording or reproducing units G11B20/18; for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS], H04L67/1097
• CPC Class Codes: G06F 11/0751 Error or fault detection not based on redundancy power supply failures G06F1/30; network fault management H04L41/06
• CPC Class Codes: G06F 11/0766 Error or fault reporting or storing
• CPC Class Codes: G06F 11/0793 Remedial or corrective actions recovery from an exception in an instruction pipeline G06F9/3861; by retry G06F11/1402; for recovering from a failure of a protocol instance or entity H04L69/40
• CPC Class Codes: G06F 2009/4557 Distribution of virtual machine instances; Migration and load balancing
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 9/45537 Provision of facilities of other operating environments, e.g. WINE I/O emulation G06F13/105
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: G06F 9/542 Event management; Broadcasting; Multicasting; Notifications

Abstract

Techniques are disclosed for controlling and managing virtual machines and other such virtual systems. VM execution approval is based on compliance with policies controlling various aspects of VM. The techniques can be employed to benefit all virtual environments, such as virtual machines, virtual appliances, and virtual applications. For ease of discussion herein, assume that a virtual machine (VM) represents each of these environments. In one particular embodiment, a systems management partition (SMP) is created inside the VM to provide a persistent and resilient storage for management information (e.g., logical and physical VM metadata). The SMP can also be used as a staging area for installing additional content or agentry on the VM when the VM is executed. Remote storage of management information can also be used. The VM management information can then be made available for pre-execution processing, including policy-based compliance testing.

Claims

1. An apparatus for enforcing a policy associated with a virtual machine, the apparatus comprising:

a memory device storing instructions; and

a computing device communicatively coupled to a virtual machine, the computing device including a processor operably coupled to the memory device, the processor executing the instructions to;

receive a virtual machine event request;

receive first data from within the virtual machine in response to receiving the virtual machine event request, wherein the first data was extracted from within the virtual machine prior to receiving the virtual machine event request, and the first data was stored prior to receiving the virtual machine event request for later processing after receiving the virtual machine event request;

receive second different data from an environment outside the virtual machine in response to receiving the virtual machine event request;

determine whether an internal non-compliance by the virtual machine of a first policy-based compliance scheme exists based on the first data that was stored prior to receiving the virtual machine event request;

determine whether an external non-compliance by the virtual machine as provided in the environment of a second different policy-based compliance scheme exists based on the second different data; and

in response to determining that at least one of an internal non-compliance and an external non-compliance exists, deny the virtual machine event request.

2. The apparatus of claim 1, wherein the virtual machine event request includes a stop virtual machine request.

3. The apparatus of claim 1, wherein the virtual machine event request includes a pause virtual machine request.

4. The apparatus of claim 1, wherein the virtual machine event request includes a move virtual machine request.

5. The apparatus of claim 1, wherein the virtual machine event request includes a clone virtual machine request.

6. The apparatus of claim 1, wherein the virtual machine event request includes a create new virtual machine request.

7. The apparatus of claim 1, wherein the virtual machine event request includes a deploy virtual machine from template request.

8. The apparatus of claim 1, wherein the internal non-compliance includes at least one of software that has not been installed on the virtual machine, software that has been removed from the virtual machine, and software that has not been updated on the virtual machine.

9. The apparatus of claim 1, wherein the virtual machine is at least one of a virtual application and a virtual appliance.

10. The apparatus of claim 1, wherein the environment is at least one of a virtual machine manager, a host environment, a management agent, and an execution platform.