Sharing a java virtual machine

A JAVA virtual machine with multiple tenants is shared by allocating an IP address to each of the tenants, creating a separate virtual network interface for each of the tenants and configuring each separate virtual network interface with the respective separate IP address allocated for each tenant. For each of the tenants, network operations are performed via the virtual network interface created for that tenant, to provide for network isolation of each tenant sharing a JAVA virtual machine.

BACKGROUND

1. Technical Field

The invention relates to virtualization technology. More particularly, the invention relates to a method and system for sharing a JAVA virtual machine (JVM).

2. Description of the Related Art

Multi-tenant JAVA virtual machine (JVM) (JAVA is a registered trademark of Oracle America, Inc.) technology allows multiple tenant programs to run in a shared JAVA virtual machine. This technology will play an important role in high-density deployment within a cloud environment.

However, current multi-tenant JAVA virtual machines can not realize network isolation among multiple tenants. If a tenant is not configured correctly, network resources (such as ports) will have conflicts. In addition, since network isolation is not realized, the ability to control network resource over the tenants is very limited. For example, without isolation, it is hard to configure different firewall strategies for different tenants.

SUMMARY

Therefore, there is a need for a method and system for sharing a JAVA virtual machine, which can realize network isolation among multiple tenants sharing a JAVA virtual machine.

One or more embodiments of the invention provide a method for sharing a JAVA virtual machine having multiple tenants. The method comprises allocating an IP address to each of the multiple tenants, respectively. The method comprises creating a separate virtual network interface for each of the multiple tenants and configuring the allocated IP address, respectively, wherein, for each of the multiple tenants, its network operation is performed via the virtual network interface created for that tenant.

According to an embodiment of the invention, if an IP address of a tenant is bound to IPADDR_ANY, the method further comprise binding localhost of that tenant to another port which is different from a localhost port shared by all tenants and establishing a mapping between the another port and the localhost port shared by all tenants.

One or more embodiments of the invention also provide a system for sharing a JAVA virtual machine having multiple tenants. The system comprises an allocating unit configured to allocate an IP address to each of the multiple tenants, respectively. The system comprises a creating unit configured to create a separate virtual network interface for each of the multiple tenants and configure the allocated IP address, respectively, wherein, for each of the multiple tenants, its network operation is performed via the virtual network interface created for that tenant.

According to an embodiment of the invention, if an IP address of a tenant is bound to IPADDR_ANY, the system further comprises a binding unit configured to bind the localhost of that tenant to another port that is different from a localhost port shared by all tenants and an establishing unit configured to establish a mapping between the another port and the localhost port shared by all tenants.

With the method and system of the illustrative embodiments, network isolation among multiple tenants sharing a JAVA virtual machine can be realized.

DETAILED DESCRIPTION

In the following description, for purposes of explanation, one or more embodiments will be described in more detail with reference to the accompanying drawings, in which one or more embodiments of the present invention have been illustrated. It will be apparent, however, to one skilled in the art that the present invention can be implemented in various manners, and thus should not be construed to be limited to the embodiments disclosed herein.

Referring now toFIG. 1, in which a block diagram of a computer system/server12, which is applicable to implement one or more embodiments of the present invention, is shown. Computer system/server12is only illustrative and is not intended to suggest any limitation as to the scope of use or functionality of the one or more embodiments described herein.

Computer system/server12may also communicate with one or more external devices14including, but not limited to, a keyboard, a pointing device, a display24, one or more devices that enable a user to interact with computer system/server12, and/or any devices (e.g., network card, modem, etc.) that enable computer system/server12to communicate with one or more other computing devices. Such communication can occur via Input/Output (I/O) interfaces22. In addition, computer system/server12may communicate with one or more networks such as a local area network (LAN), a general wide area network (WAN), and/or a public network (e.g., the Internet) via network adapter20. As depicted, network adapter20communicates with the other components of computer system/server12via bus18. It should be understood that although not shown, other hardware and/or software components could be used in conjunction with computer system/server12. Examples of other hardware and/or software components may include, but are not limited to, microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data archival storage systems.

In addition to conventional computer system/server12shown inFIG. 1, one or more mobile electric devices may also be included for achieving one or more embodiments of the invention, including, but not limited to, mobile telephone, PDA, tablet computer and others. Typically, a mobile electric device has one or more input devices, including, but not limited to, a touch input device, such as, touch screen, touch panel, and others.

Those of ordinary skill in the art will appreciate that the hardware depicted inFIG. 1may vary. Furthermore, those of ordinary skill in the art will appreciate that the depicted example is not meant to imply architectural limitations with respect to the present invention.

FIGS. 2A-2Billustrate one example of a flowchart of a method200for sharing a JAVA virtual machine (JVM) according to an embodiment of the invention is shown. In the method illustrated inFIG. 2, the JVM is a multi-tenant JVM226that has multiple tenants220,222, and224, operating on a network228. In one example, method200starts at block202. Next, method200proceeds to block204. Block204illustrates allocating an IP address to each of the multiple tenants, respectively. For example, an IP address may be allocated to each of tenant220, tenant222, and tenant224. According to an embodiment of the invention, DHCP protocol may be utilized to allocate an IP address to each of the tenants, and the IP address of each tenant may be different from each other. In addition, any other possible approaches in the art may also be utilized to allocate an IP address to each of the multiple tenants.

Next, method200proceeds to a block206. Block206illustrates creating a separate virtual network interface for each of the multiple tenants and configuring the separate virtual network interface with the allocated IP address, respectively. For example, at block206, a separate virtual network interface230may be created for tenant220and configured to the IP address allocated to tenant220, a separate virtual network interface232may be created for tenant222and configured to the IP address allocated to tenant222, and a separate virtual network234may be created for tenant224and configured to the IP address allocated to tenant224. Next, block208illustrates, for each of the multiple tenants, performing each tenant's network operation via the virtual network interface created for that tenant.

According to an embodiment of the invention, multi-tenant JVM226may include a virtualization technology application program interface (API) for creating a separate virtual network interface for each of the multiple tenants on demand and configuring the separate virtual network interface with the allocated IP address for each respective tenant. An example of the virtualization technology application program interface may be libvirt. In one example, a libvirt layer may reside atop a linux host layer, which resides atop a node layer. Libvirt is an API that can create tools to manage guest OSs, which provides a VM monitoring program unknown by the native JVM API, to securely manage guest OSs running on a host. XML codes for configuring a virtual network by utilizing libvirt are given below. The codes below may be embodied as JAVA native invocation (JNI) as a tenant aware class library for supporting network isolation of tenants. By embodying the code as JNI, multi-tenant JVM226can utilize the JNI to create a virtual network interface for a tenant, on demand.

For network configuration:

One of ordinary skill in the art will appreciate that the example codes given above are merely illustrative. Similarly, the example of libvirt as an API given above is also for illustration, and the one or more embodiments of the invention are not limited to libvirt. Those skilled in the art may utilize other suitable API in the art, such as Microsoft® Windows® Hyper-v, to create a virtual network interface with the allocated IP address for each of the multiple tenants, respectively; the description given above should not be used to limit protection scope of claims. In addition, libvert may support virtualization to create a virtual network interface with the allocated IP address for each of the multiple tenants through a bridged mode, such as a shared physical device, where internally, the option to run in a routing mode or a bridged mode may be chosen at runtime, depending on the customer network environment.

According to an embodiment of the invention, next, block208illustrates performing each tenant's network operation via the virtual network interface created for that tenant. After an IP address is allocated and a separate virtual network interface is created for a tenant and the allocated IP address is configured, all network operations of the tenant will be intercepted and redirected transparently to the virtual network interface created for that tenant. Multi-tenant JVM226may identify a tenant via tenant context information. The tenant context information refers to, for a certain network operation request, identification describing a particular tenant related to that request. The tenant context describes to which tenant a network operation request belongs. The tenant context may be represented by a unique tenant identifier. With tenant context information, multi-tenant JVM226identifies a particular tenant related to a certain network operation request, and in turn redirects that network operation request to a virtual network interface created for that particular tenant, such that network operation of the tenant is performed via the virtual network interface created for that particular tenant.

According to an embodiment of the invention, next, block210illustrates a determination whether any tenant is terminated. At block210, if a tenant is terminated, then the process passes to block212. Block212illustrates reclaiming network resources allocated to a tenant, including, but not limited to, reclaiming the IP address allocated to that tenant and reclaiming the virtual network interface created for that tenant, and the process ends.

According to an embodiment of the invention, returning to block206, method200may include a process included in block206, and starting at block214. Block214illustrates a determination whether any IP address of any tenant is bound to a local host. At block214, if any IP address of any tenant is bound to a local host, method200further comprises the steps at block216of binding the localhost of that tenant to another port that is different from a localhost port shared by all tenants. Next, block218illustrates establishing a mapping between the another port and the localhost port shared by all tenants. Binding to IPADDR_ANY means binding a tenant to both the IP address allocated for a tenant and the localhost of a tenant itself. Since the localhost is shared by all tenants in a JVM, isolation among multiple tenants may be realized by binding the localhost of that tenant to another port which is different from a localhost port shared by all tenants, and establishing a mapping between the another port and the localhost port shared by all tenants. For example, if the IP address of a tenant is bound to IPADDR_ANY, it means that the tenant has bound its network operation to both of the allocated IP address and its localhost. In one example, in a JVM, the localhost port shared by all tenants is8080. In order to realize isolation among multiple tenants, the localhost of each tenant may be bound to another port which is different from localhost port8080shared by all tenants, for example, the localhost of a tenant may be bound to port9000and a mapping between port8080and port9000established at the tenant. In performing network operations, data sent onto the localhost of that tenant (i.e. data sent via localhost port8080) is actually sent onto localhost port9000. In addition, when receiving data from local host port8080, the tenant receives data from local host port9000, with multi-tenant JVM226assisting with an update of a source address once data is received. Similarly, if the IP address of another tenant is also bound to IPADDR_ANY, it means that the IP address of that tenant is also bound to its localhost. In order to realize isolation between the tenant mentioned above and the another tenant, the localhost of the another tenant may be bound to another port which is different from localhost port8080shared by all tenants and port9000bound to localhost of the tenant mentioned above. For example, the localhost of the tenant is bound to port12000, and a mapping between port8080and port12000is established at the another tenant. In performing network operations, data sent to the localhost of the another tenant (i.e. data sent via localhost port8080) is actually sent via localhost port12000. Isolation among multiple tenants is realized by multi-tenant JVM226by ensuring that the localhost of each of the multiple tenants bound to IPADDR_ANY has a different port range from each other. The mapping port is not visible to external parties.

In one example, in a class library of a JVM wrappers are included for bind, accept, receive and send. In one embodiment, the JVM wrappers of multi-tenant JVM226are updated to support network isolation for each tenant. In one implementation of a Bind method at the JAVA underlying layer, unlike conventional JDK, the Bind method of one embodiment of the invention, in response to the operation relates to an address of IPADDR_ANY, does nothing until real network transmission (such as Accept) occurs. In one example,FIG. 4illustrates a high-level logic flowchart of a process and program for handling an accept transmission. In one example, the process starts at block400and proceeds to block402. At block402, when real network transmission (such as Accept) occurs, an accept wrapper is triggered. Next, at block404, if it is determined that the operation does not relate to an address of IPADDR_ANY, the process passes to block416. Block416illustrates handling the accept wrapper without a setting to IPADDR_ANY, and the process ends. Otherwise, at block404, if it is determined that the operation relates to an address of IPADDR_ANY, then the process passes to block406. Block406illustrates querying the IP allocation information from the tenant context. Next block408illustrates creating two sockets, with one socket used to listen to IP address allocated for tenant and the other socket used to listen to localhost. At block410, if the connection occurs on the first socket, a first thread is created and forwarded to the accept wrapper from the designated IP address and at block412, if the connection occurs on the second socket, a second thread is created and forwarded to the accept wrapper from the local host. Block414illustrates returning any socket thread created, to the caller. For example, assuming that a tenant performs an Accept operation through Bind IPADDR_ANY, if a remote connection occurs on an IP address allocated to that tenant, then a socket matching with that IP address is returned, and no special processing will be performed for any subsequent network operations occurring on that socket. Otherwise, if the connection occurs on the localhost, a socket matching with the localhost of that tenant is returned, wherein, the port in the socket matching with the localhost is the aforementioned another port which is different from the localhost port shared by all tenants, and the another port may be determined via the mapping as mentioned above.

FIG. 3illustrates one example of a block diagram of a system300for sharing a JAVA virtual machine according to an embodiment of the invention, wherein the JAVA virtual machine has multiple tenants. As shown, system300for sharing a JAVA virtual machine comprises an allocating unit302configured to allocate an IP address to each of multiple tenants, respectively. In addition, system300comprises a creating unit304configured to create a separate virtual network interface for each of the multiple tenants and configure the allocated IP address, respectively, wherein, for each of the multiple tenants, its network operation is performed via the virtual network interface created for that tenant.

According to an embodiment of the invention, creating unit304utilizes a virtualization technology application program interface to create a separate virtual network interface for each of the multiple tenants and configure the allocated IP address, respectively. An example of a virtualization technology application program interface includes but not limited to libvirt.

According to an embodiment of the invention, system300further comprises a reclaiming unit306configured to reclaim network resources allocated to a tenant in response to the tenant being terminated, including, but not limited to, reclaiming the IP address allocated for that tenant and reclaiming the virtual network interface created for that tenant.

According to an embodiment of the invention, the multiple tenants are each identified via tenant context information312.

According to an embodiment of the invention, if an IP address of a tenant is bound to IPADDR_ANY, system300further comprises a binding unit308configured to bind the localhost of that tenant to another port that is different from a localhost port shared by all tenants and an establishing unit310configured to establish a mapping between the another port and the localhost port shared by all tenants.