Isolation method for management virtual machine and apparatus

Patent metadata

Field	Value
Publication number	US-9971623-B2
Application number	US-201514795225-A
Country	US
Kind code	B2
Filing date	Jul 9, 2015
Priority date	Mar 24, 2014
Publication date	May 15, 2018
Grant date	May 15, 2018

Abstract

An isolation method for a management virtual machine and an apparatus, which resolves problems that performance of communication between service components is deteriorated, more resources are required for running a virtual machine, and security of the service components is relatively low. The method includes: acquiring a guest identifier; searching, according to the guest identifier, the management virtual machine for a kernel virtual machine; when the kernel virtual machine is not found in the management virtual machine, creating the kernel virtual machine in the management virtual machine; dividing a service provided for a guest virtual machine by the kernel virtual machine into multiple service components; and running the multiple service components in execution environments corresponding to permission of the service components, where the kernel virtual machine includes the multiple execution environments, and the multiple execution environment have different permission.

First claim

What is claimed is:

1. An isolation method for a management virtual machine, comprising:
receiving, by a server, a request message to create a guest virtual machine corresponding to a guest identifier,
acquiring, by the server, the guest identifier from the request message;
creating, by the server, the guest virtual machine according to the request message;
searching, by the server according to the guest identifier, the management virtual machine for a kernel virtual machine corresponding to the guest identifier;
accessing the kernel virtual machine to provide a service for the guest virtual machine when the server finds the kernel virtual machine in the management virtual machine; and
performing the following steps when the server does not find the kernel virtual machine in the management virtual machine:
creating the kernel virtual machine in the management virtual machine;
dividing, by the server, code of a service provided for a guest virtual machine by the kernel virtual machine into multiple service components; and
running, by the server, the multiple service components in multiple execution environments corresponding to different permissions of the service components,
wherein the kernel virtual machine comprises the multiple execution environments.

2. The isolation method for a management virtual machine according to claim 1 , wherein when the kernel virtual machine is created in the management virtual machine, the method further comprises:
acquiring, by the kernel virtual machine, an indication message sent by a virtual machine manager, wherein the indication message is sent to the virtual machine manager by the guest virtual machine, wherein the indication message is also sent to the kernel virtual machine by the virtual machine manager after the virtual machine manager determines, according to the guest identifier carried in the indication message, the kernel virtual machine corresponds to the guest identifier, and wherein the indication message is used to indicate a service required by the guest virtual machine; and
responding, by the kernel virtual machine according to service request information carried in the indication message, to the service required by the guest virtual machine.

3. The isolation method for a management virtual machine according to claim 1 , wherein dividing the service provided for the guest virtual machine by the kernel virtual machine into multiple service components comprises:
dividing code of the service into multiple function code blocks according to a function of the kernel virtual machine; and
running the multiple function code blocks in multiple service processes to form the multiple service components, and wherein the multiple function code blocks are in a one-to-one correspondence with the multiple service processes.

4. The isolation method for a management virtual machine according to claim 1 , wherein running the multiple service components in execution environments corresponding to permission of the service components comprises:
grouping the multiple service components according to the permission of the multiple service components such that different groups of service components have different permission; and
running the different groups of service components in the multiple service components in execution environments corresponding to the permission of the different groups of service components.

5. The isolation method for a management virtual machine according to claim 4 , wherein the permission of the multiple service components is determined by:
acquiring system parameters of the multiple service components; and
determining, according to the system parameters of the multiple service components, the permission of the multiple service components that corresponds to the system parameters of the multiple service components.

6. The isolation method for a management virtual machine according to claim 1 , wherein after the running the multiple service components in execution environments corresponding to permission of the service components, the method further comprises limiting the permission of the multiple service components according to a preset policy, and wherein the preset policy comprises at least one of an access operation and a control operation.

7. The isolation method for a management virtual machine according to claim 1 , wherein after running the multiple service components in execution environments corresponding to permission of the service components, the method further comprises:
monitoring running states of the multiple service components; and
re-enabling one service component of the multiple service components when an error occurs in a running state of the one service component.

8. The isolation method for a management virtual machine according to claim 1 , wherein after the running the multiple service components in execution environments corresponding to permission of the service components, the method further comprises periodically re-enabling each of the multiple service components according to a preset time, and wherein the preset time is a preset time corresponding to each service component.

9. The isolation method for a management virtual machine according to claim 1 , wherein creating the kernel virtual machine in the management virtual machine comprises:
creating, in the management virtual machine and according to a kernel virtualization technology, a kernel virtualization container corresponding to the guest identifier; and
disposing, in the kernel virtualization container, a service provided for the guest virtual machine by the management virtual machine to create the kernel virtual machine.

10. The isolation method for a management virtual machine according to claim 1 , wherein a manner of communication between the multiple service components is interprocess communication.

11. The isolation method for a management virtual machine according to claim 1 , wherein the multiple service components comprise at least one of the following: a virtual machine enabling service component, a virtual machine management tool set component, a virtual machine device simulation component, a virtual machine creating tool component, a virtual machine back-end driver component, and a storage component.

12. A server, comprising:
a memory storing executable instructions which comprises a management virtual machine comprising a plurality of kernel virtual machines each having an identifier; and
a processor coupled to the memory, wherein the processor is configured to perform the steps of:
receiving a request message to create a guest virtual machine corresponding to a guest identifier;
acquiring the guest identifier from the request message;
creating the guest virtual machine according to the request message;
searching, according to the guest identifier, the management virtual machine for a kernel virtual machine corresponding to the guest identifier;
accessing the kernel virtual machine to provide a service for the guest virtual machine when the server finds the kernel virtual machine in the management virtual machine; and
performing the following steps when the server does not find the kernel virtual machine in the management virtual machine:
creating the kernel virtual machine in the management virtual machine;
dividing code of a service provided for a guest virtual machine by the kernel virtual machine into multiple service components; and
running the multiple service components in multiple execution environments corresponding to different permissions of the service components,
wherein the kernel virtual machine comprises the multiple execution environments.

Assignees

• Huawei Tech Co Ltd

Inventors

• Tu Bin
• Chen Haibo
• Xia Yubin

Classifications

• G06F2009/45587

  Isolation or security of virtual machine instances · CPC title

• G06F2009/45575

  Starting, stopping, suspending or resuming virtual machine instances · CPC title

• G06F9/45558 Primary

  Hypervisor-specific management and integration aspects · CPC title

• G06F21/53

  by executing in a restricted environment, e.g. sandbox or secure virtual machine · CPC title