Abstract:
When copying a guest from a source virtual environment to a target virtual environment, policy control of the target environment is provided. A configuration specification is created based on the source virtual environment and the guest to be copied. The configuration specification contains specific policies and/or requirements of the guest. The guest and the configuration specification are copied to the target virtual environment. The target virtual environment is examined to determine whether it is compliant with the copied configuration specification. If so, the copied guest runs in the target virtual environment. If not, the target virtual environment can be modified to be in compliance with the configuration specification.

Description:
TECHNICAL FIELD 
     This invention pertains generally to computer virtualization, and more specifically to providing policy control of a target virtual environment when porting a guest. 
     BACKGROUND 
     In the world of virtual computing, a guest can be migrated to a different, compatible virtual environment (e.g., an environment comprising one or more guests, a physical or virtual host, and a virtualization component such as a hypervisor). However, when a guest is copied from one virtual environment to another, the target virtual environment might not be compliant with the policies/requirements of the guest. For example, the guest might require a specific amount of memory or disk space that the target virtual environment does not have available, or the guest might have specific network communication requirements that are not met by the target virtual environment. While the guest can verify its own configuration, it lacks the ability to ensure that a virtual environment in which it runs is complaint with its own policy requirements. It would be desirable to address this shortcoming. 
     SUMMARY 
     When copying a guest from a source virtual environment to a target virtual environment, policy control of the target virtual environment is provided. A configuration specification is created based on the source virtual environment and the guest to be copied. The configuration specification contains specific policies and/or requirements of the guest. The guest and the configuration specification are copied to the target virtual environment. The target virtual environment is examined to determine whether it is compliant with the copied configuration specification. If so, the copied guest runs in the target virtual environment. If not, the target virtual environment can be modified to be in compliance with the configuration specification. 
     The features and advantages described in this summary and in the following detailed description are not all-inclusive, and particularly, many additional features and advantages will be apparent to one of ordinary skill in the relevant art in view of the drawings, specification, and claims hereof. Moreover, it should be noted that the language used in the specification has been principally selected for readability and instructional purposes, and may not have been selected to delineate or circumscribe the inventive subject matter, resort to the claims being necessary to determine such inventive subject matter. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         FIG. 1  is a block diagram illustrating a system for providing policy control of a target virtual environment when porting a guest, according to some embodiments of the present invention. 
         FIG. 2  is a flowchart illustrating steps for providing policy control of a target virtual environment when porting a guest, according to some embodiments of the present invention. 
     
    
    
     The Figures depict embodiments of the present invention for purposes of illustration only. One skilled in the art will readily recognize from the following discussion that alternative embodiments of the structures and methods illustrated herein may be employed without departing from the principles of the invention described herein. 
     DETAILED DESCRIPTION 
       FIG. 1  illustrates a system for providing policy control of a target virtual environment  109   target  when porting a guest  101 , according to some embodiments of the present invention. It is to be understood that although various components are illustrated in  FIG. 1  as separate entities, each illustrated component represents a collection of functionalities which can be implemented as software, hardware, firmware or any combination of these. Where a component is implemented as software, it can be implemented as a standalone program, but can also be implemented in other ways, for example as part of a larger program, as a plurality of separate programs, as a kernel loadable module, as one or more device drivers or as one or more statically or dynamically linked libraries. 
     In the embodiment illustrated in  FIG. 1 , a first (source) virtual environment  109   source  is shown which comprises a hypervisor  103  and two guests  101  running on a single (host) physical computer  105  and a (host) operating system  107  running on that physical computer  105 .  FIG. 1  also illustrates a second (target) virtual environment  109   target  in which three guests  101  and a hypervisor  103  run on a host  105 . As illustrated in  FIG. 1  and described in detail below, one of the guests  101  of the source virtual environment  109   source  is copied to the target virtual environment  109   target . It is to be understood that a virtual environment  109  can include a single guest  101 , or a much larger number of guests  101  than illustrated in the examples in  FIG. 1 . 
     In various virtualization scenarios, the hypervisor  103  can act as an interface between the guests  101  and the host operating system  107  for some or all of the functions of the guests  101 . In other virtualization implementations, there is no underlying host operating system  107  running on the physical computer  105 . In those situations, the hypervisor  103  acts as an interface between the guests  101  and the hardware of the physical computer  105 . Even where a host operating system  107  is present, the hypervisor  103  sometimes interfaces directly with the hardware for certain services. In some virtualization scenarios, the host  105  itself is in the form of a guest  101  (i.e., a virtual host) running on another host  105 . 
     In various embodiments of the present invention, the hypervisor  103  can interact with a host operating system  107  and/or directly with the (physical or virtual) hardware of the host computer  105  as desired. It is to be further understood that the services described herein as being performed by a hypervisor  103  are, under certain virtualization scenarios, performed by a component with a different name, such as “supervisor virtual machine,” “virtual machine manager (VMM),” “service partition,” or “domain 0 (dom0).” The name used to denote the component(s) performing specific functionality is not important. 
     As illustrated in  FIG. 1 , a copying component  111  running at the hypervisor  103  level in the source virtual environment  109   source  creates a configuration specification  113  as part of the process of creating a guest  101  to export. This configuration specification  113  is based on the configuration of the source virtual environment  109   source  and the guest  101  to be copied, and optionally also on any additional local policy directives (not illustrated) indicating specific factors to include. In other words, the copying component  111  analyzes the current configuration of the guest  101  being copied and the source virtual environment  109   source , and creates a corresponding configuration specification  113 . The configuration specification  113  includes specific policies and/or requirements of the guest  101  (e.g., memory or disk requirements, network requirements, file system configuration, hardware configuration, etc.). Where desired, policy directives local to the source virtual environment  109   source  can provide specific instructions to the copying component  111 , indicating configuration specific information to include in the configuration specification  113 . 
     In some embodiments, a signing component  115  signs the configuration specification  113  with a key  117 . This key  117  can be part of a Public Key Infrastructure (PKI) signing chain in more complex configurations. (A PKI is an arrangement that binds public keys with respective user identities by means of a certificate authority.) The signature  119  on the configuration specification  113  can be used to prevent malicious use thereof as described below. 
     When a guest  101  is copied to the target virtual environment  109   target , the corresponding configuration specification  113  is transported therewith. When a guest  101  is imported, a compliance component  121  running at the hypervisor  103  level in the target virtual environment  109   target  processes the configuration specification  113 . If the target virtual environment  109   target  is not compliant with the configuration specification  113 , the compliance component  121  configures the target virtual environment  109   target  accordingly (or blocks the import of the guest  101  if it is not practicable or desirable to make such modifications to the target virtual environment  109   target ). 
     Where desired for security purposes, the hypervisor  103  also checks the signature  119 , and only respects the configuration specification  113  if it is signed by a trusted virtual environment  109 . This level of security check can prevent breaches such as, e.g., a party exporting a guest  101  and subsequently tampering with the configuration specification  113  to change the target virtual environment  109   target . This type of malicious behavior could be used to take control of priority, privilege, network access, etc. 
     To provide an additional level of security, the use of signed configuration specifications  113  can be combined with encryption of the guest  101 . At export time, the copying component  111  can encrypt the guest  101 , e.g., by using a key  117  stored at a centrally managed location  123  which is accessible only to trusted virtual environments  109 . The compliance component  121  can access the key  117  and decrypt the guest  101  upon receipt. This additional step further prevents someone from exporting the guest  101  and loading it on an unauthorized virtual environment  109 . 
       FIG. 2  illustrates steps for providing policy control of a target virtual environment  109   target  ( FIG. 1 ) when copying a guest  101  ( FIG. 1 ), according to some embodiments of the present invention. The copying component  111  ( FIG. 1 ) creates  201  a configuration specification  113  ( FIG. 1 ) based on the source virtual environment  109   source  ( FIG. 1 ) and the guest  101  ( FIG. 1 ) to be copied. The signing component  115  ( FIG. 1 ) signs  203  the configuration specification  113  ( FIG. 1 ). The copying component  111  ( FIG. 1 ) makes  205  a copy of the guest  101  ( FIG. 1 ) to be ported, and copies  207  the guest  101  ( FIG. 1 ) and the signed configuration specification  113  ( FIG. 1 ) to the target virtual environment  109   target  ( FIG. 1 ). 
     The compliance component  121  ( FIG. 1 ) of the target virtual environment  109   target  ( FIG. 1 ) checks  209  the signature  119  ( FIG. 1 ) of the imported configuration specification  113  ( FIG. 1 ). If the compliance component  121  ( FIG. 1 ) cannot authenticate the configuration specification  113  ( FIG. 1 ), it does not modify  211  the target virtual environment  109   target  ( FIG. 1 ). On the other hand, if the configuration specification  113  ( FIG. 1 ) has a valid signature  119  ( FIG. 1 ), the compliance component  121  ( FIG. 1 ) determines whether the target virtual environment  109   target  ( FIG. 1 ) is in compliance, and makes  213  any specified modifications. The copied guest  101  ( FIG. 1 ) can now run  215  in the target virtual environment  109   target  ( FIG. 1 ). 
     As will be understood by those familiar with the art, the invention may be embodied in other specific forms without departing from the spirit or essential characteristics thereof. Likewise, the particular naming and division of the portions, modules, agents, managers, components, functions, procedures, actions, layers, features, attributes, methodologies and other aspects are not mandatory or significant, and the mechanisms that implement the invention or its features may have different names, divisions and/or formats. Furthermore, the portions, modules, agents, managers, components, functions, procedures, actions, layers, features, attributes, methodologies and other aspects of the invention can be implemented as software, hardware, firmware or any combination of the three. Wherever a component of the present invention is implemented as software, the component can be implemented as a script, as a standalone program, as part of a larger program, as a plurality of separate scripts and/or programs, as a statically or dynamically linked library, as a kernel loadable module, as a device driver, and/or in every and any other way known now or in the future to those of skill in the art of computer programming. Additionally, the present invention is in no way limited to implementation in any specific programming language, or for any specific operating system or environment. Where the present invention is implemented in whole or in part in software, the software components thereof can be stored on computer readable media as computer program products. Any form of computer readable medium can be used in this context, such as magnetic or optical storage media. Additionally, software portions of the present invention can be instantiated (for example as object code or executable images) within the memory of any programmable computing device. Accordingly, the disclosure of the present invention is intended to be illustrative, but not limiting, of the scope of the invention, which is set forth in the following claims.