Enforcement of compliance policies in managed virtual systems

• US 9,710,482 B2
• Filed: 02/02/2015
• Issued: 07/18/2017
• Est. Priority Date: 10/17/2006
• Status: Active Grant

• Current Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Original Assignee: ManageIQ, Inc. (International Business Machines Corporation)
• Inventors: Fitzgerald, Joseph, Barenboim, Oleg
• Primary Examiner(s): Wai, Eric C
• Application Number:
  US14/611,491
• Publication Number:
  US 20150150006A1
• Time in Patent Office: 897 Days
• Field of Search: None
• CPC Class Codes: G06F 11/0712 in a virtual computing platform, e.g. logically partitioned systems
• CPC Class Codes: G06F 11/0727 in a storage system, e.g. in a DASD or network based storage system drivers for digital recording or reproducing units G06F3/06; circuits for error detection or correction within digital recording or reproducing units G11B20/18; for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS], H04L67/1097
• CPC Class Codes: G06F 11/0751 Error or fault detection not based on redundancy power supply failures G06F1/30; network fault management H04L41/06
• CPC Class Codes: G06F 11/0766 Error or fault reporting or storing
• CPC Class Codes: G06F 11/0793 Remedial or corrective actions recovery from an exception in an instruction pipeline G06F9/3861; by retry G06F11/1402; for recovering from a failure of a protocol instance or entity H04L69/40
• CPC Class Codes: G06F 16/188 Virtual file systems
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 9/45533 Hypervisors; Virtual machine monitors
• CPC Class Codes: G06F 9/45537 Provision of facilities of other operating environments, e.g. WINE I/O emulation G06F13/105

Abstract

Techniques are disclosed for controlling and managing virtual machines and other such virtual systems. VM execution approval is based on compliance with policies controlling various aspects of VM. The techniques can be employed to benefit all virtual environments, such as virtual machines, virtual appliances, and virtual applications. For ease of discussion herein, assume that a virtual machine (VM) represents each of these environments. In one particular embodiment, a systems management partition (SMP) is created inside the VM to provide a persistent and resilient storage for management information (e.g., logical and physical VM metadata). The SMP can also be used as a staging area for installing additional content or agentry on the VM when the VM is executed. Remote storage of management information can also be used. The VM management information can then be made available for pre-execution processing, including policy-based compliance testing.

Claims

1. An apparatus for enforcing a policy associated with virtual appliances, the apparatus comprising:

a memory device storing instructions; and

a computing device communicatively coupled to a newly created virtual appliance, the computing device including a processor operably coupled to the memory device, the processor executing the instructions to;

receive a virtual appliance event request, wherein the virtual appliance event request includes a start virtual appliance request for the virtual appliance, which is prevented from being started from when the virtual appliance is newly created until the virtual appliance is determined to be compliant with a plurality of compliance based schemes;

receive first data from within the virtual appliance in response to receiving the virtual appliance event request;

receive second different data from an environment outside the virtual appliance in response to receiving the virtual appliance event request;

determine whether an internal non-compliance by the virtual appliance of a first policy-based compliance scheme exists based on the first data;

determine whether an external non-compliance by the virtual appliance as provided in the environment of a second different policy-based compliance scheme exists based on the second different data; and

in response to determining that at least one of an internal non-compliance and an external non-compliance exists, deny the virtual appliance event request.

2. The apparatus of claim 1, wherein the internal non-compliance includes at least one of software that has not been installed on the virtual appliance, software that has been removed from the virtual appliance, and software that has not been updated on the virtual appliance.

3. The apparatus of claim 1, wherein the environment is at least one of a virtual machine manager, a host environment, a management agent, and an execution platform.

4. The apparatus of claim 1, wherein determining at least one of the internal non-compliance and the external non-compliance includes computing signatures used for comparison using at least one hashing function.

5. The apparatus of claim 1, wherein determining at least one of the internal non-compliance and the external non-compliance includes performing at least one of an exact pattern matching comparison and a fuzzy pattern matching comparison.

6. The apparatus of claim 1, wherein the first data received from within the virtual appliance is content metadata associated with the virtual appliance and the second data received from outside the virtual appliance is at least one of registry data associated with the virtual appliance and license data associated with the virtual appliance.

7. The apparatus of claim 1, wherein the request is denied in response to an execution platform being non-compliant.

8. A computer implemented method for enforcing a policy associated with virtual appliances, comprising:

storing a plurality of policies associated with a newly created virtual appliance, including at least a first policy and a second policy, the virtual appliance including;

at least one virtual disk, and

at least one configuration file;

receiving a virtual appliance event request, wherein the virtual appliance event request includes a start virtual appliance request for the virtual appliance, which is prevented from being started from when the virtual appliance is newly created until the virtual appliance is determined to be compliant with a plurality of compliance based schemes; and

enforcing the plurality of policies associated with the virtual appliance, after the virtual appliance event request is received and prior to executing the virtual appliance, by;

receiving first data from within the virtual appliance in response to receiving the virtual appliance event request;

applying the first policy to the first data to determine whether non-compliance exists within the virtual appliance of the first policy;

receiving second data from outside the virtual appliance in response to receiving the virtual appliance event request;

applying the second policy to the second data to determine whether non-compliance exists outside the virtual appliance of the second policy; and

in response to determining that non-compliance exists at least one of within the virtual appliance and outside the virtual appliance, denying the virtual appliance event request.

9. The computer implemented method of claim 8, wherein at least one of applying the first policy to the first data and applying the second policy to the second data includes performing a pattern matching comparison.

10. The computer implemented method of claim 9, wherein the pattern matching comparison is an exact pattern matching comparison.

11. The computer implemented method of claim 9, wherein the pattern matching comparison is a fuzzy pattern matching comparison.

12. The computer implemented method of claim 8, wherein the first data received from within the virtual appliance is content metadata associated with the virtual appliance.

13. The computer implemented method of claim 12, wherein applying the first policy to the first data includes comparing at least one signature of the first data against at least one signature based policy.

14. The computer implemented method of claim 8, wherein signatures used for comparison are computed using at least one hashing function.

15. The computer implemented method of claim 8, wherein the second data received from outside the virtual appliance is at least one of registry data associated with the virtual appliance and license data associated with the virtual appliance.

16. The computer implemented method of claim 8, wherein the request is denied in response to an execution platform being non-compliant.

17. A system for enforcing a policy associated with virtual appliances, the system comprising:

at least one processor; and

at least one computer readable medium encoded with instructions, which when executed by the at least one processor, cause the at least one processor to;

store a plurality of policies associated with a newly created virtual appliance, including at least a first policy and a second policy, the virtual appliance including;

at least one virtual disk, and

at least one configuration file;

receive a virtual appliance event request, wherein the virtual appliance event request includes a start virtual appliance request for the virtual appliance, which is prevented from being started from when the virtual appliance is newly created until the virtual appliance is determined to be compliant with a plurality of compliance based schemes; and

enforce the plurality of policies associated with the virtual appliance, after the virtual appliance event request is received and prior to executing the virtual appliance, by;

receiving first data from within the virtual appliance in response to receiving the virtual appliance event request;

applying the first policy to the first data to determine whether non-compliance exists within the virtual appliance of the first policy;

receiving second data from outside the virtual appliance in response to receiving the virtual appliance event request;

applying the second policy to the second data to determine whether non-compliance exists outside the virtual appliance of the second policy; and

in response to determining that non-compliance exists at least one of within the virtual appliance and outside the virtual appliance, denying the virtual appliance event request.

18. The system of claim 17, wherein determining at least one of the internal non-compliance and the external non-compliance includes performing at least one of an exact pattern matching comparison and a fuzzy pattern matching comparison.

19. The system of claim 17, wherein the first data received from within the virtual appliance is content metadata associated with the virtual appliance and the second data received from outside the virtual appliance is at least one of registry data associated with the virtual appliance and license data associated with the virtual appliance.

20. The system of claim 17, wherein the request is denied in response to an execution platform being non-compliant.