Flexible access control for a virtual computer device, virtual computer system, and virtual computer program, and method for controlling the same

• US 8,776,054 B2
• Filed: 06/12/2009
• Issued: 07/08/2014
• Est. Priority Date: 07/22/2008
• Status: Active Grant

• Current Assignee: NEC Corporation
• Original Assignee: NEC Corporation
• Inventors: Takahashi, Hideyuki
• Primary Examiner(s): Kawsar, Abdullah Al
• Application Number:
  US12/996,921
• Publication Number:
  US 20110088031A1
• Time in Patent Office: 1,852 Days
• Field of Search: None
• US Class Current: 718/1
• CPC Class Codes: G06F 2009/45579 I/O management, e.g. providing access to device drivers or storage
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: G06F 9/468 Specific access rights for resources, e.g. using capability register
• CPC Class Codes: G06F 9/5077 Logical partitioning of resources; Management or configuration of virtualized resources specific details on emulation or internal functioning of virtual machines G06F9/455

Abstract

Lack of freedom in the operation of terminals has been a problem. On the other hand, there has been concern that allowing freedom of operation would negatively impact systems. A virtual computer device is provided with a memory unit and a CPU. The CPU executes an access program, which has the CPU input from or output to the memory unit in accordance with a received input/output request, and a VM monitor which implements a virtual computer in the CPU. Under the control of the VM monitor, the CPU executes a VM program which sends a input/output request to the access program, and via the access program, has the CPU input from or output to the storage device.

Claims

1. A virtual computer device comprising:

a memory unit which includes a first memory area for a virtual memory storing a guest operating system (OS) including a virtual machine (VM) program executing on the guest OS and a virtual disk of a virtual computer, and a second memory area, which is different than said first memory area and stores a host OS, an application program, an access program and a file to be accessed by the host OS and the application program; and

a CPU which executes, under the control of the host OS, the access program that performs input from or output to the second memory area, the application program, and a VM monitor to execute the VM program on the guest OS under control of the VM monitor and

wherein the VM program stored in the first memory area performs input from or output to the second memory area using the access program via the VM monitor and the host OS.

2. The virtual computer device according to claim 1, which executes the access program to perform input from or output to a predetermined range of the second memory area, but not to memory areas in the second memory area that are outside said predetermined range.

3. The virtual computer device according to claim 2, which executes the VM program to output information inputted from a terminal to the second memory area using the access program, or to display on the terminal, information inputted from the second memory area using the access program.

4. The virtual computer device according to claim 3, wherein the memory unit includes a memory which comprises:

an external storage which includes an area associated with the first memory area which is used as a virtual disk, and an area associated with the second memory area which is occupied by a file of the host OS.

5. A virtual computer system including a virtual computer device according to claim 4 and the terminal.

6. A computer readable non-transitory medium having recorded thereon a virtual computer program, which includes an access program and a virtual machine (VM) program, and which when executed by a computer comprising a memory unit which includes a first memory area for a virtual memory storing a guest operating system (OS) including a VM program executing on the guest OS and a virtual disk of a virtual computer and a second memory area, which is different than said first memory area and stores a host OS, an application program, an access program, and a file to be accessed by the host OS and the application program,

executes, under the control of the host OS, a VM monitor, the application program, and the access program;

executes the VM program on the guest OS, under the control of the VM monitor;

executes the access program, that performs input from or output to said second memory area; and

wherein the VM program stored on the first memory area performs input from or output to the second memory area using the access program via the VM monitor and the host OS.

7. The computer readable non-transitory medium according to claim 6, having recorded thereon the virtual computer program, wherein the access program is executed by the computer to perform input from or output to a predetermined range of the second memory area, but not to memory areas in the second memory area that are outside said predetermined range.

8. The computer readable non-transitory medium according to claim 7, having recorded thereon the virtual computer program, wherein the VM program is executed by the computer to output information inputted from a terminal to the second memory area using the access program, or to display on the terminal, information inputted from the second memory area using the access program.

9. A control method, which when used on a computer comprising a memory unit that includes a first memory area for a virtual memory storing a guest operating system (OS) including a virtual machine (VM) program executing on the guest OS and a virtual disk of a virtual computer, and a second memory area different than said first memory area and stores a host OS, an application program, an access program and a file to be accessed by the host OS and the application program comprises:

executing, under the control of the host OS, a VM monitor, the application program, and the access program;

executing, the VM program on the guest OS, under the control of the VM monitor; and

executing the access program, that performs input from or output to the second memory area; and

wherein the VM program stored on the first memory area performs input from or output to the second memory area using the access program via the VM monitor and the host OS.

10. The control method according to claim 9, wherein the computer executes the access program to perform input from or output to a predetermined range of the second memory area, but not to memory areas in the second memory area that are outside said predetermined range.

11. The control method according to claim 10, wherein the computer executes the VM program to output information, inputted from a terminal, to the second memory area using the access program, or to display on the terminal, information inputted from the second memory area using the access program.