Controlling virtual overlay infrastructure

• US 9,596,239 B2
• Filed: 10/28/2005
• Issued: 03/14/2017
• Est. Priority Date: 10/29/2004
• Status: Active Grant

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Inventors: Edwards, Nigel, Goldsack, Patrick, Lain, Antonio, Baldwin, Adrian John
• Primary Examiner(s): PETRANEK, JACOB ANDREW
• Application Number:
  US11/718,122
• Publication Number:
  US 20090241108A1
• Time in Patent Office: 4,155 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 9/45533 Hypervisors; Virtual machine monitors
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources

Abstract

A system has a virtual overlay infrastructure mapped onto physical resources for processing, storage and network communications, the virtual infrastructure having virtual entities for processing, storage and network communications. Virtual infrastructures of different users share physical resources but are isolated. Each infrastructure has its own infrastructure controller to create and configure the infrastructure. It has a user accessible part (CFC) for configuration of that user'"'"'s infrastructure, and a user inaccessible part (UFC) able to access the mapping and the physical resources. This increases user control to ease system administration, while maintaining security by limiting access to the mapping.

Claims

1. A system comprising:

physical resources; and

one or more virtual overlay infrastructures comprising virtual machines mapped onto the physical resources, wherein each of the one or more virtual overlay infrastructures comprises an infrastructure controller that is implemented by one or more virtual machines, and

wherein the infrastructure controller for each of the one or more virtual overlay infrastructures includes,

a user accessible part to allow a user of a respective virtual overlay infrastructure to request for a configuration of the respective virtual overlay infrastructure, and

a user inaccessible part to prevent the user from accessing the physical resources and prevent the user from controlling a mapping of the virtual machines in the respective virtual overlay infrastructure onto the physical resources.

2. The system of claim 1, wherein the user inaccessible part is to enforce a policy limiting the configuration of the respective virtual overlay infrastructure.

3. The system of claim 1, wherein the infrastructure controller is to monitor applications, running on the virtual overlay infrastructure.

4. The system of claim 1, wherein the user inaccessible part is to control the mapping.

5. The system of claim 1, wherein the user accessible part is to allow the user to access virtual data processing and storage network entities in the respective virtual overlay infrastructure.

6. The system of claim 1, wherein the user accessible part is to allow the user to send requests to the user inaccessible part to access system management entities including the mapping and the physical resources.

7. A non-transitory computer readable medium storing machine readable instructions, which when executed by a processor perform a method of providing an infrastructure controller for each of one or more virtual overlay infrastructures, wherein each of the one or more virtual overlay infrastructures comprises virtual machines mapped onto physical resources, the machine readable instructions comprising code to:

provide a user accessible part to allow a user of a respective virtual overlay infrastructure to request for a configuration of the respective virtual overlay infrastructure; and

provide a user inaccessible part to prevent the user from accessing the physical resources and prevent the user from controlling a mapping of the virtual machines in the respective virtual overlay infrastructure onto the physical infrastructure,

wherein the user accessible part is to allow the user to send requests to the user inaccessible part to access system management entities including the mapping and the physical resources.

8. The non-transitory computer readable medium of claim 7, wherein the machine readable instructions comprise code to provide the user inaccessible part to enforce a policy limiting the configuration of the respective virtual overlay infrastructure via the user inaccessible part.

9. The non-transitory computer readable medium of claim 7, wherein the machine readable instructions further comprise code to monitor applications running on the virtual overlay infrastructure.

10. The non-transitory computer readable medium of claim 7, wherein the machine readable instructions further comprise code to provide the user inaccessible part to control the mapping.

11. The non-transitory computer readable medium of claim 7, wherein the machine readable instructions further comprise code to provide the user accessible part to allow the user to access virtual data processing and storage network entities in the respective virtual overlay infrastructure.

12. A method of providing an infrastructure controller for each of one or more virtual overlay infrastructures, wherein each of the one or more virtual overlay infrastructures comprises virtual machines mapped onto physical resources, the method comprising:

providing, by one or more processors, a user accessible part to allow a user of a respective virtual overlay infrastructure to request for a configuration of the respective virtual overlay infrastructure; and

providing a user inaccessible part to prevent the user from accessing the physical resources and prevent the user from controlling a mapping of the virtual machines onto the physical resources,

wherein the user accessible part is to allow the user to send requests to the user inaccessible part to access system management entities including the mapping and the physical resources.