Wrapped nested virtualization

• US 9,342,343 B2
• Filed: 03/12/2014
• Issued: 05/17/2016
• Est. Priority Date: 03/15/2013
• Status: Active Grant

• Current Assignee: Adventium Enterprises LLC
• Original Assignee: Adventium Enterprises LLC
• Inventors: Sonnek, Jason D.
• Primary Examiner(s): Puente, Emerson
• Assistant Examiner(s): Kamran, Mehran
• Application Number:
  US14/206,036
• Publication Number:
  US 20140282539A1
• Time in Patent Office: 797 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 2009/45566 Nested virtual machines
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects

Abstract

A number of embodiments can include a Layer 0(L0) VMM configured to provide a first number of services and a Layer 1(L1) virtual machine (VM) that is running on the L0 VMM. A number of embodiments can also include a L1 VMM that is running on the L1 VM. A number of embodiments can include configuring the L1 VMM to provide a second number of services to a target VM, second number of services being different than the first number of services. A number of embodiments can also include configuring the target VM to execute a user application.

Claims

1. A system comprising:

a first Layer 0 (L0) virtual machine monitor (VMM) configured to host a first Layer 1 (L1) virtual machine (VM) and provide a first number of services, wherein the first L0 VMM is running on a processing resource of a first physical device that is part of a first cloud platform;

a second L0 VMM that is hosted on a second physical device that is part of a second cloud platform; and

a number of Layer 2 (L2) service VMs, a L2 migration manager VM, and a target L2 VM hosted on an L1 VMM that is hosted on the first L1 VM;

wherein the target L2 VM is configured to execute a user application;

wherein the number of L2 service VMs are configured to provide a second number of services to the target L2 VM;

wherein the second number of services are different than the first number of services;

wherein the L2 migration management VM is configured to manage a migration of the number of L2 service VMs, the L2 migration management VM, and the target L2 VM to a second Layer 1 VM running on the second L0 VMM; and

wherein the number of L2 service VMs are configured to provide input/output (I/O) encryption capabilities, integrity monitoring, and data processing confidentiality services to the target L2 VM.

2. The system of claim 1, wherein the migration of the number of L2 service VMs, the L2 migration management VM, and the target L2 VM to the second L0 VMM is part of a moving target defense.

3. The system of claim 1, wherein the second number of services are provided without modifying the target L2 VM.

4. The system of claim 1, wherein the first L0 VMM and the second L0 VMM are different types of VMMs.

5. The system of claim 1, wherein the migration is a live migration that migrates the number of L2 service VMs, the L2 migration management VM, and the target L2 VM in real time.