Implementing a host as a container or virtual machine

Patent metadata

Field	Value
Publication number	US-9753762-B1
Application number	US-201615061630-A
Country	US
Kind code	B1
Filing date	Mar 4, 2016
Priority date	Mar 4, 2016
Publication date	Sep 5, 2017
Grant date	Sep 5, 2017

Abstract

A Container or VM running on physical host is allocated for hosting a dispatcher module in an isolated environment. A thin dispatcher runs on the host OS, while another secured dispatcher module runs inside the allocated Container. If an intruder gains access to the host, he would not be able to send commands to the dispatcher module running inside the Container. The intruder may access the thin dispatcher module, but would not be able to create or delete VMs or Containers. The administrator can connect directly to the dispatcher module inside the container. A remote shell access goes to the host container instead of a physical host. Thus, the security of the host is improved.

First claim

What is claimed is:

1. A computer-implemented system for creation of a host Virtual Execution Environment (VEE), the system comprising:
a host having a thin host OS, a host file system and a disk;
a dedicated hosting VEE implemented on the host;
a thin dispatcher module running on the host and configured to control Containers and Virtual Machines (VMs) residing on the host; and
a dispatcher module running inside the dedicated hosting VEE and configured to create or delete VMs and Containers upon receiving a command from an administrator,
wherein:
an authentication module, a backup module, a licensing module, a migration manager and a template module are implemented inside the dedicated hosting VEE;
a runtime Container manager and a runtime VM manager are implemented on the host; and
the dispatcher module running inside the dedicated hosting VEE is not accessible by any applications running on the host,

wherein the migration manager and the template module are implemented inside the dedicated hosting VEE, while their functionality is supported by the host.

2. The system of claim 1 , wherein the backup module is implemented inside the dedicated hosting VEE, while its functionality is supported by the host.

3. The system of claim 1 , wherein the dedicated hosting VEE is a VM.

4. The system of claim 1 , wherein the dedicated hosting VEE is a Container.

5. The system of claim 1 , wherein the thin host OS is a minimum LINUX OS comprising a basic kernel, low level libraries GLib and NetConfig.

6. The system of claim 1 , wherein dispatcher processes executing inside the dedicated hosting VEE are isolated from other processes of Containers and VMs residing on the same host.

7. A computer-implemented method for creation of a host Virtual Execution Environment (VEE), the method comprising:
launching a dedicated hosting VEE on a physical host;
starting a thin dispatcher module on the host;
controlling Containers and Virtual Machines (VMs) residing on the host by the thin dispatcher module;
launching a dispatcher module inside the dedicated hosting VEE;
creating or deleting VMs and Containers upon receiving a command from an administrator by the dispatcher module running inside the dedicated hosting VEE,
wherein:
an authentication module, a backup module, a licensing module, a migration manager and a template module are implemented inside the dedicated hosting VEE;
a runtime Container manager and a runtime VM manager are implemented on the host; and
the dispatcher module running inside the dedicated hosting VEE is not accessible by any applications running on the host,
wherein the migration manager and the template module are implemented inside the dedicated hosting VEE, while their functionality is supported by the host.

8. The method of claim 7 , wherein the dedicated hosting VEE is a VM.

9. The method of claim 7 , wherein the dedicated hosting VEE is a Container.

10. A computer-implemented system for creation of a host Virtual Execution Environment (VEE), the system comprising:
a host having a thin host OS and a host file system;
a dedicated hosting VEE on the host;
a dispatcher module on the host and configured to control Containers and Virtual Machines (VMs) residing on the host; and
a dispatcher module running inside the dedicated hosting VEE and configured to create or delete VMs and Containers in response to a command from an administrator,
wherein:
a user authentication module and a template module are implemented inside the dedicated hosting VEE;
a runtime Container manager and a runtime VM manager are implemented on the host; and
the dispatcher module is not accessible by applications running on the host.

11. The system of claim 10 , wherein the dedicated hosting VEE is a VM.

12. The system of claim 10 , wherein the dedicated hosting VEE is a Container.

13. The system of claim 10 , wherein the thin host OS is a minimum LINUX OS comprising a basic kernel, low level libraries GLib and NetConfig.

14. The system of claim 10 , wherein dispatcher processes executing inside the dedicated hosting VEE are isolated from other processes of Containers and VMs residing on the same host.

15. The system of claim 10 , further comprising a backup module is implemented inside the dedicated hosting VEE, while its functionality is supported by the host.

16. The system of claim 10 , further comprising a migration module is implemented inside the dedicated hosting VEE, while its functionality is supported by the host.

Assignees

• Parallels IP Holdings GmbH

Inventors

• Emelyanov Pavel

Classifications

• G06F2009/4557

  Distribution of virtual machine instances; Migration and load balancing · CPC title

• G06F2009/45587

  Isolation or security of virtual machine instances · CPC title

• G06F9/45558 Primary

  Hypervisor-specific management and integration aspects · CPC title

• G06F2009/45562

  Creating, deleting, cloning virtual machine instances · CPC title

• G06F9/50 Primary

  Allocation of resources, e.g. of the central processing unit [CPU] · CPC title