Virtual machine compliance checking in cloud environments

Patent metadata

Field	Value
Publication number	US-10735452-B2
Application number	US-201816016420-A
Country	US
Kind code	B2
Filing date	Jun 22, 2018
Priority date	Oct 13, 2014
Publication date	Aug 4, 2020
Grant date	Aug 4, 2020

Abstract

A method of transferring a virtual machine between a virtualized computing system and a cloud computing system includes determining that a virtual machine is to be transferred from a virtualized computing system to a cloud computing system and determining a connection between a first resource in the virtualized computing system and a second resource in the cloud computing system. Files that enable implementation of the virtual machine at the virtualized computing system and identified, as are file portions of the files for transfer from the virtualized computing system to the cloud computing system. At least one compliance check is executed on each of the file portions using at least one compliance checker. Each of the file portions that fails a compliance check is blocked from being maintained in the cloud computing system.

First claim

We claim:

1. A method of transferring a virtual machine between a virtualized computing system and a cloud computing system, the method comprising:
determining connection between a first resource in the virtualized computing system and a second resource in the cloud computing system;
accessing, for transmission over the connection, data blocks in the virtualized computing system that include files that enable implementation of the virtual machine at the virtualized computer;
executing at least one policy check on each of the data blocks using at least one policy checker; and
preventing each of the data blocks that fails a policy check from being maintained in the cloud computing system.

2. The method of claim 1 , wherein the executing the at least one policy check on each of the data blocks using at least one policy checker is performed by the first resource in the virtualized computing system, and wherein the preventing each of the data blocks that fails the policy check from being maintained in the cloud computing system comprises the first resource blocking each of the data blocks that fails a policy check from being transmitted over the connection.

3. The method of claim 1 , wherein the executing the at least one policy check on each of the data blocks using at least one policy checker is performed by the second resource in the cloud computing system, and wherein the preventing each of the data blocks that fails the policy check from being maintained in the cloud computing system comprises the second resource discarding each of the data blocks that fails a policy check.

4. The method of claim 1 , wherein the executing the at least one policy check on each of the data blocks using at least one policy checker is performed partially by the first resource in the virtualized computing system and partially by the second resource in the cloud computing system, and wherein the preventing each of the data blocks that fails the policy check from being maintained in the cloud computing system comprises the first resource blocking each of the data blocks that fails a policy check performed at the first resource from being transmitted over the connection and the second resource discarding each of the data blocks that fails a policy check performed at the second resource.

5. The method of claim 1 , wherein the at least one policy check comprises at least one of a financial data check, a human health data check, a software licensing check, a malicious software check, or a software vulnerability check.

6. The method of claim 1 , wherein the executing the at least one policy check on each of the data blocks using at least one policy checker is performed on at least one plurality of the data blocks as a group as the at least one plurality of the data blocks is accessed from the storage device in the virtualized computing system at the first resource or received at the second resource in the cloud computing system.

7. The method of claim 1 , wherein the preventing each of the data blocks that fails a policy check from being maintained in the cloud computing system comprises at least one of:
blocking transmission of each of the data blocks that fails a policy check over the connection; or
blocking each of the data blocks that fails a policy check at the second resource from being stored in a resource of the cloud computing system other than the second resource and discarding each of the data blocks that fails a policy check at the second resource.

8. A non-transitory computer readable medium comprising instructions, which when executed in a computer system, causes the computer system to carry out a method of transferring a virtual machine between resources within a hybrid cloud environment, the method comprising:
determining connection between a first resource in the virtualized computing system and a second resource in the cloud computing system;
accessing, for transmission over the connection, data blocks in the virtualized computing system that include files that enable implementation of the virtual machine at the virtualized computer;
executing at least one policy check on each of the data blocks using at least one policy checker; and
preventing each of the data blocks that fails a policy check from being maintained in the cloud computing system.

9. The non-transitory computer readable medium of claim 8 , wherein the executing the at least one policy check on each of the data blocks using at least one policy checker is performed by the first resource in the virtualized computing system, and wherein the preventing each of the data blocks that fails the policy check from being maintained in the cloud computing system comprises the first resource blocking each of the data blocks that fails a policy check from being transmitted over the connection.

10. The non-transitory computer readable medium of claim 8 , wherein the executing the at least one policy check on each of the data blocks using at least one policy checker is performed by the second resource in the cloud computing system, and wherein the preventing each of the data blocks that fails the policy check from being maintained in the cloud computing system comprises the second resource discarding each of the data blocks that fails a policy check.

11. The non-transitory computer readable medium of claim 8 , wherein the executing the at least one policy check on each of the data blocks using at least one policy checker is performed partially by the first resource in the virtualized computing system and partially by the second resource in the cloud computing system, and wherein the preventing each of the data blocks that fails the policy check from being maintained in the cloud computing system comprises the first resource blocking each of the data blocks that fails a policy check performed at the first resource from being transmitted over the connection and the second resource discarding each of the data blocks that fails a policy check performed at the second resource.

12. The non-transitory computer readable medium of claim 8 , wherein the at least one policy check comprises at least one of a financial data check, a human health data check, a software licensing check, a malicious software check, or a software vulnerability check.

13. The non-transitory computer readable medium of claim 8 , wherein the executing the at least one policy check on each of the data blocks using at least one policy checker is performed on at least one plurality of the data blocks as a group as the at least one plurality of the data blocks is accessed from the storage device in the virtualized computing system at the first resource or received at the second resource in the cloud computing system.

14. The non-transitory computer readable medium of claim 8 , wherein the preventing each of the data blocks that fails a policy check from being maintained in the cloud computing system comprises at least one of:
blocking transmission of each of the data blocks that fails a policy check over the connection; or
blocking each of the data blocks that fails a policy check at the second resource from being stored in a resource of the cloud computing system other than the second resource and discarding each of the data blocks that fails a policy check at the second resource.

15. A computer system, comprising:
a memory configured to store code; and
a processor configured to execute the code to:
determine connection between a first resource in a virtualized computing system and a second resource in a cloud computing system;
access, for transmission over the connection, data blocks in the virtualized computing sys

Assignees

• Vmware Inc

Inventors

• Thakkar Sachin
• Maskalik Serge
• Basak Debashis
• Sequeira Allwyn
• Haridas Govind

Classifications

• G06F21/53

  by executing in a restricted environment, e.g. sandbox or secure virtual machine · CPC title

• G06F2009/4557

  Distribution of virtual machine instances; Migration and load balancing · CPC title

• H04L63/1433 Primary

  Vulnerability analysis · CPC title

• G06F21/6236

  between heterogeneous systems · CPC title

• H04L63/1408

  by monitoring network traffic (monitoring network traffic per se H04L43/00) · CPC title