Communication method of virtual machines and server-end system

A communication method of virtual machines and a server-end system are provided. A virtual hardware address is assigned to a virtual machine when the virtual machine are established, wherein the virtual hardware address includes a tenant identity. A validation procedure for a packet is performed when the virtual machine desires to communicate with another virtual machine by transmitting the packet, so as to determine whether the virtual hardware addresses of the source-end and the destination-end in the packet have the same tenant identity. If the both virtual hardware addresses have the same tenant identity, the packet is transmitted to the another virtual machine.

CROSS-REFERENCE TO RELATED APPLICATION

This application claims the priority benefit of Taiwan application serial no. 101122840, filed Jun. 26, 2012. The entirety of the above-mentioned patent application is hereby incorporated by reference herein and made a part of this specification.

BACKGROUND OF THE INVENTION

1. Field of the Invention

The invention generally relates to a communication technique, and more particularly, to a communication method of virtual machines capable of separating packet flows of virtual machines run by different tenants and a server-end system.

2. Description of Related Art

Along with the development of technologies, virtual machines have been broadly applied to various computer fields, such as the analysis of behavior of malware in personal computers. Generally, a computer host can run multiple virtual machines at the same time, and these virtual machines ran by the same computer host are expected to be independent of each other. When virtual machines belonging to different tenants are run on the same computer, the virtual machines may capture wrong packets if packet flows of these virtual machines are not properly separated.

For example, a tenant A runs two virtual machines (for example, a virtual machine M and a virtual machine N) on a computer host X to analyze how a malware distributes malicious packets, and a tenant B runs another virtual machine (for example, a virtual machine K) on the computer host X to carry out network traffic analysis and research. The virtual machine (for example, the virtual machine K) of the tenant B may produces an abnormal experimental result if it receives any malicious packet distributed by a virtual machine (for example, the virtual machine M) run by the tenant A. Thereby, how to effectively separate packet flows of virtual machines run by different tenants has become a major subject in the industry.

SUMMARY OF THE INVENTION

Accordingly, the invention is directed to a communication method of virtual machines and a server-end system, in which virtual machines run by different tenants are effectively managed and separated.

One aspect of the invention provides a communication method of virtual machines adapted to a server-end system. The server-end system includes a plurality of hosts and a plurality of virtual machines. The communication method of virtual machines includes following steps. When the virtual machines are established, a plurality of virtual hardware addresses is respectively assigned to the virtual machines, wherein each of the virtual hardware addresses includes a tenant identity of the corresponding virtual machine. When a first virtual machine among the virtual machines desires to communicate with a second virtual machine among the virtual machines, a packet is transmitted through the first virtual machine, wherein the packet includes a first virtual hardware address of the first virtual machine and a second virtual hardware address of the second virtual machine, and the first virtual hardware address and the second virtual hardware address are among the virtual hardware addresses. When a communication module receives the packet, a validation procedure is performed on the packet. The validation procedure includes following step. When the first virtual hardware address and the second virtual hardware address have the same tenant identity, the packet is transmitted to the second virtual machine.

Another aspect of the invention provides a server-end system including a management device and a plurality of hosts. The management device assigns a plurality of virtual hardware addresses respectively to a plurality of virtual machines when the virtual machines are established, wherein each of the virtual hardware addresses includes a tenant identity of the corresponding virtual machine. The hosts run the virtual machines, and each of the hosts includes a network interface unit and a processing unit. The hosts communicate with each other through their network interface units. The processing unit is coupled to the network interface unit. The processing unit activates the corresponding virtual machine and drives a communication module. When a first virtual machine among the virtual machines desires to communicate with a second virtual machine among the virtual machines, the first virtual machine transmits a packet, wherein the packet includes a first virtual hardware address of the first virtual machine and a second virtual hardware address of the second virtual machine, and the first virtual hardware address and the second virtual hardware address are among the virtual hardware addresses. When the communication module corresponding to the first virtual machine or the second virtual machine receives the packet, the communication module performs a validation procedure on the packet, and the communication module transmits the packet when the first virtual hardware address and the second virtual hardware address have the same tenant identity.

These and other exemplary embodiments, features, aspects, and advantages of the invention will be described and become more apparent from the detailed description of exemplary embodiments when read in conjunction with accompanying drawings.

DESCRIPTION OF THE EMBODIMENTS

In order to effectively identify packets respectively sent by different virtual machines run by a same tenant when the virtual machines communicate with each other, a communication method of virtual machines is provided by embodiments of the invention. In the communication method of virtual machines, the tenant identities in the virtual hardware addresses carried by a packet that are corresponding to a virtual machine transmitting the packet and a virtual machine expected to receive the packet are validated through a predetermined validation procedure to determine whether the virtual machines belong to the same tenant. Thereby, packet flows of virtual machines run by different tenants can be effectively managed and separated. In addition, a server-end system adopting the communication method of virtual machines is further disclosed in embodiments of the invention. Below, exemplary embodiments of the invention will be described with reference to accompanying drawings.

First Embodiment

FIG. 1is a diagram of a server-end system according to the first embodiment of the invention. Referring toFIG. 1, the server-end system10includes a management device11, a host12, and a host13. It should be noted that even though only the host12and the host13are illustrated inFIG. 1, the server-end system10may actually include a greater or smaller number of hosts. In other words, the number of hosts in the server-end system10is not limited in the invention, and one implementing an embodiment of the invention should be able to adjust the number of the hosts according to the actual or design requirement.

The management device11may be a server-end host or a typical computer host configured to execute functions such as main control console (MCC) of the server-end system10. For example, the management device11is configured to manage the operation of the entire server-end system10. In the present embodiment, the management device11includes at least a processor, a memory, and a network interface card.

The host12and the host13are respectively a typical computer host and respectively run one or more virtual machines. Herein a virtual machine is run in the operating system (OS) of a computer host and is usually used for simulating a real computer host.

In the present embodiment, the host12includes at least a network interface unit121and a processing unit122, and the host13includes a network interface unit131and a processing unit132. The network interface unit121and the network interface unit131respectively include a network interface card, and the host12and the host13communicate with each other through the network interface unit121and the network interface unit131.

The processing unit122and the processing unit132are respectively coupled to the network interface unit121and the network interface unit131. The processing unit122and the processing unit132respectively activate one or more virtual machines run by the host12and the host13. In the present embodiment, the processing unit122and the processing unit132may be respectively a micro-processor, an embedded controller, or a central processing unit (CPU). However, the type of the processing unit122and the processing unit132is not limited in the invention. Additionally, similar to the management device11, the host12and the host13may respectively include a memory.

Following exemplary embodiments will be described with reference to the server-end system10in the embodiment illustrated inFIG. 1.

Second Embodiment

FIG. 2is a diagram of a server-end system according to the second embodiment of the invention. Referring toFIG. 2, for the convenience of description, in the present embodiment, it is assumed that the processing unit122and the processing unit132respectively run a virtual machine222and a virtual machine232, and the processing unit122further runs a communication module224. In the present embodiment, the communication module224performs a validation procedure on a received packet to determine whether the virtual machines respectively transmitting and receiving the packet belong to the same tenant and continues to execute a corresponding operation. In addition, the implementation of the communication module224is not limited in the invention. In other words, the communication module224may be implemented as a hardware circuit, a firmware, or a software to execute aforementioned function.

FIG. 3is a flowchart of a communication method of virtual machines according to the second embodiment of the invention. Referring toFIG. 2andFIG. 3, when the virtual machine222and the virtual machine232are established, virtual hardware addresses of the virtual machine222and the virtual machine232are respectively assigned to the processing unit122and the processing unit132through the management device11to be used for identifying the virtual machine222and the virtual machine232. For example, referring to bothFIG. 2andFIG. 3, the processing unit122notifies the management device11that the virtual machine222has been established and run in the host12and requests to obtain the virtual hardware address corresponding to the virtual machine222from the management device11through the network interface unit121. After that, the management device11assigns an unused virtual hardware address to the processing unit122as the virtual hardware address of the virtual machine222according to a virtual hardware address correspondence table (step S303). The processing unit132can obtain the virtual hardware address of the virtual machine232from the management device11in a similar way, which can be referred to foregoing description and will not be described herein.

It should be noted that in an embodiment of the invention, different virtual machines have different virtual hardware addresses (similar to physical hardware addresses), and each virtual hardware address includes a tenant identity of the tenant running the corresponding virtual machine or any identity for identifying the person or organization running the corresponding virtual machine.

When the virtual machine222desires to communicate with the virtual machine232, the virtual machine222transmits a packet (for example, an Internet packet) (step S305). Herein the packet contains the virtual hardware address of the virtual machine222and the virtual hardware address of the virtual machine232. The virtual hardware address of the virtual machine222and the virtual hardware address of the virtual machine232can be respectively assigned in advance by the management device11or obtained by the virtual machine222and the virtual machine232themselves, such that the source virtual machine and the destination virtual machine of the packet can be determined during the transmission of the packet. Below, a virtual hardware address will be explained in detail with reference to an example.

FIG. 4is a diagram of a virtual hardware address according to the second embodiment of the invention. Referring toFIG. 4, in the present embodiment, the virtual hardware address400includes a field401, a field403, and a field405. The field401records a system information, the field403records a tenant identity, and the field405records a virtual machine identity. The system information indicates information related to the virtual hardware address400. For example, the system information contains bit numbers of the field401, the field403, and the field405. The tenant identity is the identity of the tenant running the virtual machine corresponding to the virtual hardware address400. Namely, different tenants have different tenant identities. Thus, the tenant of the virtual machine corresponding to the virtual hardware address400can be identified according to the tenant identity in the virtual hardware address400. The virtual machine identity is the identity of the virtual machine corresponding to the virtual hardware address400.

In the present embodiment, the tenant identity and the virtual machine identity may be recorded in a virtual hardware address correspondence table or another similar table in the management device11. The virtual hardware address400may be implemented as a media access control (MAC) address. For example, a 48-bit MAC address is divided into 3 bit groups (i.e., fields). The first bit group has 8 bits and is used for recording the system information. The second bit group has 24 bits and is used for recording the tenant identity. The third bit group has 16 bits and is used for recording the virtual machine identity. Thus, during the transmission of the packet, whether the virtual machine transmitting the packet and the virtual machine expected to receive the packet belong to the same tenant can be quickly determined by comparing the tenant identity in the virtual hardware address of the source end and the tenant identity in the virtual hardware address of the destination end carried by the packet, and after that, the packet can be further transmitted or discarded according to foregoing determination result.

However, in the present embodiment, the fields of the virtual hardware address and the information recorded in these fields are not limited to foregoing description. For example, the virtual hardware address400may further include a department field (not shown) for recording a department identity. The department identity indicates the department (for example, a department in a company or an organization) corresponding to the virtual machine having the virtual hardware address400. Thus, whether the virtual machine transmitting the packet and the virtual machine expected to receive the packet belong to the same tenant and the same department (or only the same department, which is determined according to the actual requirement) can be quickly determined by comparing the tenant identities and the department identities in the source virtual hardware address and the destination virtual hardware address carried by the packet, and after that, the packet can be further transmitted or discarded according to the determination result.

Referring toFIG. 2andFIG. 3again, after the virtual machine222transmits a packet to communicate with the virtual machine232, the communication module224run by the processing unit122determines whether the packet is received (step S307). If the packet is received in step S307, the communication module224may temporarily store the packet and perform a validation procedure on the packet to determine whether the virtual machine222and the virtual machine232belong to the same tenant through the validation procedure (step S309).

During the validation procedure, the communication module224determines whether the virtual hardware address of the virtual machine222and the virtual hardware address of the virtual machine232have the same tenant identity (step S311). If the virtual hardware address of the virtual machine222and the virtual hardware address of the virtual machine232have the same tenant identity, the communication module224determines that the virtual machine222and the virtual machine232belong to the same tenant and continues to transmit the packet to the virtual machine232through the network interface unit121(step S313).

On the other hand, if the virtual hardware address of the virtual machine222and the virtual hardware address of the virtual machine232have different tenant identities, the communication module224determines that the virtual machine222and the virtual machine232belong to different tenants. Accordingly, in order to prevent interference between packet flows of the virtual machine222and the virtual machine232, the communication module224discards this packet (step S315).

Additionally, when the packet is transmitted to the host13running the virtual machine232, the virtual machine232directly receives the packet. By now, the current packet transmission operation between virtual machines is completed.

FIG. 5is a diagram of a validation procedure according to the second embodiment of the invention. Referring toFIG. 2andFIG. 5, for the convenience of description, the validation procedure will not be described herein by taking the virtual machine222and the virtual machine232as examples. Herein it is assumed that the virtual hardware address522of the virtual machine222is 101010101010 and the virtual hardware address532of the virtual machine232is 110010100100. Regarding the virtual hardware address522, the field5221records a system information1010, the field5222records the tenant identity1010of the virtual machine222, and the field5223records the virtual machine identity1010of the virtual machine222. Regarding the virtual hardware address532, the field5321records a system information1100, the field5322records the tenant identity1010of the virtual machine232, and the field5323records the virtual machine identity0100of the virtual machine232.

First, the communication module224executes an exclusive-OR (XOR) operation on the virtual hardware address522(101010101010) of the virtual machine222and the virtual hardware address532(110010100100) of the virtual machine232. For example, the XOR operation is executed on the virtual hardware address522and the virtual hardware address532through a XOR operation module501to obtain a first number sequence541(011000001110). Then, the communication module224executes an AND operation on the first number sequence541(011000001110) and a predetermined number sequence542(000011110000). For example, the AND operation is executed on the virtual hardware address522and the virtual hardware address532through an AND operation module502to obtain a second number sequence543(000000000000). InFIG. 5, the XOR operation module501and the AND operation module502are respectively a hardware circuit or a software algorithm which can execute the corresponding function. In addition, the predetermined number sequence542is substantially determined according to the positions or the fields of the tenant identity in the virtual hardware address522of the virtual machine222and the virtual hardware address532of the virtual machine232.

Taking the predetermined number sequence542inFIG. 5as an example, because the tenant identities of the virtual machine222and the virtual machine232are respectively recorded in the field5222of the virtual hardware address522and the field5322of the virtual hardware address532and the field5222and the field5322are corresponding to the field5412of the first number sequence541and the field5422of the predetermined number sequence542, after the AND operation is executed on the predetermined number sequence542and the second number sequence543, whether the tenant identities of the virtual machine222and the virtual machine232recorded in the field5222and the field5322for recording are the same or different can be quickly determined by simply setting all bits in the field5422of the predetermined number sequence542to the value “1” and any bit not in the field5422of the predetermined number sequence542to the value “0”.

Finally, the communication module224determines whether the second number sequence543satisfies a predetermined rule544. If the second number sequence542satisfies the predetermined rule544, the communication module224continues to transmit the packet to the virtual machine232. TakingFIG. 5as an example, since the second number sequence543(000000000000) satisfies the predetermined rule544(000000000000), the communication module224transmits the packet to the virtual machine232. If the second number sequence542does not satisfy the predetermined rule, the communication module224discards the packet.

It should be noted herein that the validation procedure described above is only an implementation of the validation procedure in the invention. In other words, the validation procedure in the invention is not limited to the implementation described above, and any technique capable of comparing the tenant identities in two virtual hardware addresses through a hardware circuit or a software algorithm is within the scope of the invention.

Third Embodiment

The server-end system in the present embodiment is substantially the same as or similar to the server-end system10described in foregoing embodiment. Thus, the operation details of various internal components of the server-end system in the present embodiment will not be described herein. In the present embodiment, the validation procedure is performed by a communication module in the host running the destination virtual machine.

FIG. 6is a diagram of a server-end system according to the third embodiment of the invention. Referring toFIG. 6, in the present embodiment, the processing unit132runs the communication module234. The communication module234is similar to the communication module224. Thus, the operation of the communication module234will not be described herein, and any other question can be answered by referring to foregoing descriptions of the communication module224and the validation procedure.

The communication method of virtual machines in the present embodiment can be understood with reference toFIG. 3and following description. Referring toFIG. 3andFIG. 6, when the virtual machine222and the virtual machine232are established, the virtual hardware addresses of the virtual machine222and the virtual machine232are respectively assigned by the management device11to the processing unit122and the processing unit132(step S303). When the virtual machine222desires to communicate with the virtual machine232, the virtual machine222transmits a packet (step S305). The difference between the present embodiment and the second embodiment is that in the present embodiment, the validation procedure is performed by the communication module234in the host13that runs the virtual machine232.

As described above, the communication module234run by the processing unit132determines whether the packet is received (step S307). For example, the communication module234determines whether the packet is received through the network interface unit131. If in step S307the communication module234determines that the packet is received, the communication module234may temporarily store the packet and perform the validation procedure on the packet to determine whether the virtual machine222and the virtual machine232belong to the same tenant through the validation procedure (step S309).

Similar to the communication module224inFIG. 2, the communication module234in the present embodiment determines whether the virtual hardware address of the virtual machine222and the virtual hardware address of the virtual machine232have the same tenant identity (step S311). If the communication module234determines that the virtual hardware address of the virtual machine222and the virtual hardware address of the virtual machine232have the same tenant identity, it directly transmits the packet to the virtual machine232(step S313). By now, the packet transmission operation between virtual machines is completed.

On the other hand, if the communication module234determines that the virtual hardware address of the virtual machine222and the virtual hardware address of the virtual machine232do not have the same tenant identity, the communication module234discards the packet (step S315) so that the current packet transmission operation between the virtual machines fails.

The validation procedure in the present embodiment is the same as or similar to that in the second embodiment therefore will not be described herein.

Fourth Embodiment

The server-end system in the present embodiment is substantially the same as the server-end system10in foregoing embodiment. Thus, the operation details of various internal components of the server-end system in the present embodiment will not be described herein. In the present embodiment, besides the validation procedure performed at the source end, a validation procedure is further performed at the destination end.

FIG. 7is a diagram of a server-end system according to the fourth embodiment of the invention. Referring toFIG. 7, in the present embodiment, besides the virtual machine222and the virtual machine232, the processing unit122and the processing unit132further respectively run a communication module224and a communication module234. The operation and implementation of the communication module224and the communication module234have been respectively described in detail in the second embodiment and the third embodiment therefore will not be described herein.

FIG. 8is a flowchart of a communication method of virtual machines according to the fourth embodiment of the invention. Referring toFIG. 7andFIG. 8, when the virtual machine222and the virtual machine232are established, virtual hardware addresses of the virtual machine222and the virtual machine232are respectively assigned by the management device11to the processing unit122and the processing unit132to be respectively used for identifying the virtual machine222and the virtual machine232(step S803).

At the source end, when the virtual machine222desires to communicate with the virtual machine232, a packet (for example, an Internet packet) is transmitted through the virtual machine222(step S805). Herein the packet contains the virtual hardware address of the virtual machine222and the virtual hardware address of the virtual machine232such that the source virtual machine and the destination virtual machine can be identified during the transmission of the packet. In addition, the virtual hardware address of the virtual machine222and the virtual hardware address of the virtual machine232respectively include the tenant identities of the tenants running the virtual machine222and the virtual machine232.

As described above, the communication module224run by the processing unit122determines whether the packet is received (step S807). If in step S807the communication module224determines that the packet is received, the communication module224may temporarily store the packet and perform a validation procedure on the packet to determine whether the virtual machine222and the virtual machine232belong to the same tenant through the validation procedure (step S809).

Similar to that described above, in the present embodiment, the communication module224determines whether the virtual hardware address of the virtual machine222and the virtual hardware address of the virtual machine232have the same tenant identity (step S811). If the virtual hardware address of the virtual machine222and the virtual hardware address of the virtual machine232have the same tenant identity, the communication module224continues to transmit the packet to the host13at the destination end through the network interface unit121(step S813). If the virtual hardware address of the virtual machine222and the virtual hardware address of the virtual machine232have different tenant identities, the communication module224discards the packet (step S815) so that the current packet transmission operation between virtual machines fails.

At the destination end, the communication module234run by the processing unit132determines whether the packet is received (step S817). For example, the communication module234determines whether the packet is received through the network interface unit131. If in step S817the communication module234determines that the packet is received, the communication module234may temporarily store the packet and perform a validation procedure on the packet to determine whether the virtual machine222and the virtual machine232belong to the same tenant through the validation procedure (step S819). To be specific, the communication module234determines whether the virtual hardware addresses of the virtual machine222and the virtual machine232in the packet have the same tenant identity (step S821). If the virtual hardware address of the virtual machine222and the virtual hardware address of the virtual machine232have the same tenant identity, the communication module234transmits the packet to the virtual machine232(step S823). By now, the current packet transmission operation between virtual machines is completed.

On the other hand, if the virtual hardware address of the virtual machine222and the virtual hardware address of the virtual machine232do not have the same tenant identity, the communication module234discards the packet (step S825) so that the current packet transmission operation between virtual machines fails.

It should be mentioned that when two virtual machines run by the same host desire to communicate with each other, the validation procedure is performed by the communication module in the same host. For example, when a virtual machine A desires to communicate with a virtual machine B, a packet is transmitted by the virtual machine A. A validation procedure is performed by the communication module in the host. The packet is transmitted to the virtual machine B after it passes the validation of the communication module.

Moreover, in the embodiments described above, when the packet transmitted by a virtual machine is a broadcast packet, since the packet is not transmitted between two specific virtual machines, no validation procedure is performed on the broadcast packet. For example, when a virtual machine transmits a broadcast packet, the virtual machine can set all the bits in the destination virtual hardware address of the broadcast packet to the value “1”. When the communication module detects that all the bits in the destination virtual hardware address in a received packet have the value “1”, it directly determines that the packet is a broadcast packet and transmits the packet through broadcasting.

In the embodiments described above, one or more validation procedures are performed on a packet transmitted between virtual machines, and whether the source virtual machine transmitting the packet and the destination virtual machine expected to receive the packet belong to the same tenant and/or the same department is determined by comparing the tenant identities and/or department identities in the virtual hardware addresses respectively corresponding to the source virtual machine and the destination virtual machine in the packet. Besides, whether the packet should be further transmitted or discarded is determined according to foregoing validation result. Thereby, packet flows of virtual machines run by different tenants can be effectively managed and separated.