Endpoint-Hosted Hypervisor Management

• US 20110107331A1
• Filed: 11/01/2010
• Published: 05/05/2011
• Est. Priority Date: 11/02/2009
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Loer, Peter B., Mealins, Jason E., Evans, James B., Kus, Benjamin J., Goodrow, Dennis S., Williams, Amrit T., Toto, Gregory M., Fan, Jonathan S.
• Granted Patent: US 8,621,460 B2
• Time in Patent Office: Days
• US Class Current: 718/1
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 9/45541 Bare-metal, i.e. hypervisor runs directly on hardware
• CPC Class Codes: H04W 4/50 Service provisioning or reconfiguring
• CPC Class Codes: H04W 4/60 Subscription-based services using application servers or record carriers, e.g. SIM application toolkits

Abstract

A client hypervisor comprises a virtual agent that runs outside of a system OS and that allows device management independent of the OS and user. The virtual agent is tied to a device and not a specific instance of the OS. Such client hypervisors expose new functionality to ease managing systems. Some of these capabilities come from the persistence and privileges outside the OS. In some embodiments of the invention, this new management functionality is exposed to allow device management via new virtualization concepts, such as multiple VMs per system, VM replacement, snapshot/rollback, etc.

Claims

1. An apparatus for endpoint-hosted hypervisor management, comprising;

a hypervisor-resident, policy-based, virtual management agent running in a privileged context and configured to manage at least one host OS from outside said OS, said host OS comprising a virtual machine (VM) running on an underlying hardware-based device.

2. The apparatus of claim 1, said agent comprising a management layer between said operating system and said hardware-based device.

3. The apparatus of claim 1, said agent configured to execute virtual machine management operations for any of provisioning, end-of-life, removable device management, emergency partition, protected process, configuration persistence, multiple VMs, encrypted VMs, and off-line patching.

4. The apparatus of claim 1, said agent configured to execute a relevance-based computing model, to interact with one or more inspectors, and to implement actions to address systems-management operations.

5. The apparatus of claim 1, said agent configured to interact with a hypervisor-based virtual data-drive for segregation and management of user-data separate from said hardware device.

6. The apparatus of claim 5, wherein said data drive is configured for any of separating specific data from said VM, sharing data between a plurality of VMs, storing user and/or application data;

and wherein said data drive is configured to be backed up, copied, or moved as a container.

7. The apparatus of claim 5, wherein said data drive is configured to mount a VM as a file system to collect files left on another VM.

8. The apparatus of claim 1, wherein said agent interacts with a relay component running in a virtual management layer;

and further comprising a networking configuration for said agent and relay functions.

9. The apparatus of claim 8, wherein said relay component function provides services to a virtual management agent as well as agents residing in guest VMs managed by said virtual management agent.

10. The apparatus of claim 1, said agent configured as one or more endpoint hypervisors and virtual management agents for dynamic grid computing by way of virtual computing appliances.

11. The apparatus of claim 1, further comprising:

a client hosted virtual desktop running within said underlying hardware-based device, said client hosted virtual desktop comprising said hypervisor;

wherein said hypervisor is configured to support an administrative environment comprising a virtual management appliance, said virtual management appliance comprising said management agent, a virtual relay, and a virtual management platform;

said hypervisor also configured to support at least one virtual machine having a respective virtual machine agent.

12. The apparatus of claim 11, further comprising:

an emergency VM configured to;

allow user access to said hardware based device if a primary VM is corrupted, infected, or otherwise compromised; and

emulate said hardware based device for ease-of-management and/or ease-of-deployment.

13. The apparatus of claim 11, further comprising:

a virtual data drive configured to perform any of;

separating specific data from a VM;

sharing data between VMs;

storing user and/or application data;

being backed up, copied, and/or moved as a container; and

mounting a VM as a file system to collect files left on another VM.

14. The apparatus of claim 13, said virtual data drive comprising:

a user data drive configured to store specific user information separate from a VM;

wherein user data is portable between VMs and hardware based devices.

15. The apparatus of claim 11, further comprising:

a protected agent configured to control and protect said hardware based devices against tampering;

wherein with said protected agent users are allowed to gain control of said hardware based devices; and

wherein with administrators can disable said protected agent;

wherein said protected agent is configured to allow said virtual machine agent to look inside said VM to ensure that a VM agent is running; and

wherein if said VM agent is not running, the virtual machine agent can take any of the following actions;

report a violation;

pop a message to a VM user;

restrict network access;

stop/pause said VM; and

install/start said agent.

16. The apparatus of claim 15, further comprising:

a heartbeat for a protected agent, wherein said protected agent is configured to allow said virtual machine agent to monitor a VM agent;

wherein said virtual machine agent is configured to listen on an event channel;

wherein said VM agent repeatedly sends a heartbeat message on said event channel;

wherein if said virtual machine a does not receive a heartbeat message for a predetermined time period, a fixlet becomes relevant that indicates that said VM agent is not working; and

wherein if said virtual machine agent notices that a VM agent is not running in said VM, remediation actions are taken that include any of mounting a CD/USB drive to start or install said VM agent, stopping said VM, and cutting off network access.

17. The apparatus of claim 11, further comprising:

a parent relay configured for inspection;

wherein said virtual management platform interfaces with said hypervisor to allow inspection of said hardware based device; and

wherein said virtual management platform interfaces with said hypervisor to allow management of hardware based system.

18. The apparatus of claim 11, said hypervisor comprising a plurality of client hypervisor APIs which support a plurality of client hypervisor use cases, wherein said APIs comprise any of:

physical device inspection;

VM inspection, image management;

disk management;

device management;

network management;

introspection; and

snapshot/freeze/rollback.

19. The apparatus of claim 18, said use cases comprising any of:

VM deployment;

emergency VM;

user data drive;

offline patching;

device management;

protected agent; and

agent with virtual relay.

20. A computer implemented method for endpoint-hosted hypervisor management, comprising the steps of;

providing a hypervisor-resident, policy-based, virtual management agent;

running said virtual management agent in a privileged context; and

configuring said virtual management agent to manage at least one host OS from outside said OS, wherein said host OS comprises a virtual machine (VM) running on an underlying hardware-based device.

21. The method of claim 20, further comprising the steps of:

providing a client hosted virtual desktop running within said underlying hardware-based device, said client hosted virtual desktop comprising said hypervisor;

configuring said hypervisor to support an administrative environment comprising a virtual management appliance, said virtual management appliance comprising said management agent, a virtual relay, and a virtual management platform;

said hypervisor also configured to support at least one virtual machine having a respective virtual machine agent.

22. The method of claim 21, further comprising the steps of:

configuring said hypervisor to provide a plurality of client hypervisor APIs which support a plurality of client hypervisor use cases, wherein said APIs comprise any of;

physical device inspection;

VM inspection, image management;

disk management;

device management;

network management;

introspection; and

snapshot/freeze/rollback.

23. The method of claim 22, said use cases comprising any of:

VM deployment;

emergency VM;

user data drive;

offline patching;

device management;

protected agent; and

agent with virtual relay.