Patent Application
20160285913
This disclosure relates generally to computer system networking, and more particularly to creating network isolation between virtual machines.
In networking technology, virtual local area networks (VLANs) are used to isolate network traffic. However, in a cloud environment, it may not be possible to create enough VLANs to isolate traffic due to limitations on the physical Ethernet adapters and switches, for example. A physical computer may include several virtual machines (VMs), which are logical emulations of a physical computer. The physical computer may host multiple VMs, each sharing the hardware resources of the physical computer, and each emulating a physical computer. In a cloud environment, a physical computer may include VMs that may belong to different organizations within the same enterprise, or to several unrelated enterprises, each sharing the physical computing environment. In general, several VMs may share the same physical Ethernet adapter. Although one physical network adapter may be trunked, i.e., carry multiple VLANs, it may not be physically possible to create enough VLANs to keep traffic segregated, for example to ensure security and to maintain adequate performance.
To maintain network security, VLANs, internet protocol (IP) subnets and addresses, and media access control (MAC) addresses may be used to keep network traffic segregated among the different organizations. However, in a cloud environment an organization or enterprise may only lease a VM for a brief period of time, such as for example, to process a monthly payroll. Consequently, VMs may be continually deployed and destroyed, resulting in repeated reuse of IP addresses and MAC on the physical computer. This, along with the probability that VMs on a physical computer may belong to multiple enterprises, increases the challenge of isolating network traffic and keeping out external undesired network traffic.
According to one embodiment, a method for creating network isolation between virtual machines is provided. The method includes: receiving, by a security virtual machine (SVM), an outgoing network packet from a virtual machine (VM); extracting a source internet protocol (IP) address and a source media access control (MAC) address from the outgoing network packet; searching a zone identifier table for a zone id, wherein the zone identifier table includes the source IP address and the source MAC address; sending the outgoing network packet to a physical Ethernet adapter that is connected to an external network switch wherein the external network switch is connected to an external network, based on the zone id not being found in the zone identifier table; and sending the outgoing network packet to a physical Ethernet adapter that is connected to an internal switch, based on the zone id being found in the zone identifier table.
According to another embodiment, a computer program product for creating network isolation between virtual machines is provided. The computer program product includes a computer readable storage medium readable by a processing circuit and storing instructions for execution by the processing circuit for performing a method is provided. The method includes: receiving, by a security virtual machine (SVM), an outgoing network packet from a virtual machine (VM); extracting a source internet protocol (IP) address and a source media access control (MAC) address from the outgoing network packet; searching a zone identifier table for a zone id, wherein the zone identifier table includes the source IP address and the source MAC address; sending the outgoing network packet to a physical Ethernet adapter that is connected to an external network switch wherein the external network switch is connected to an external network, based on the zone id not being found in the zone identifier table; and sending the outgoing network packet to a physical Ethernet adapter that is connected to an internal switch, based on the zone id being found in the zone identifier table.
According to another embodiment, a computer system for creating network isolation between virtual machines is provided. The computer system includes a memory, a processing unit communicatively coupled to the memory, and a management module communicatively coupled to the memory and processing unit, whereby the management module is configured to perform the steps of a method is provided. The method includes: receiving, by a security virtual machine (SVM), an outgoing network packet from a virtual machine (VM); extracting a source internet protocol (IP) address and a source media access control (MAC) address from the outgoing network packet; searching a zone identifier table for a zone id, wherein the zone identifier table includes the source IP address and the source MAC address; sending the outgoing network packet to a physical Ethernet adapter that is connected to an external network switch wherein the external network switch is connected to an external network, based on the zone id not being found in the zone identifier table; and sending the outgoing network packet to a physical Ethernet adapter that is connected to an internal switch, based on the zone id being found in the zone identifier table.
For a more complete understanding of this disclosure, reference is now made to the following brief description, taken in conjunction with the accompanying drawings and detailed description, wherein like reference numerals represent like parts.
Although an illustrative implementation of one or more embodiments is provided below, the disclosed systems and/or methods may be implemented using any number of techniques. This disclosure should in no way be limited to the illustrative implementations, drawings, and techniques illustrated below, including the exemplary designs and implementations illustrated and described herein, but may be modified within the scope of the appended claims along with their full scope of equivalents.
A physical computer may include several virtual machines (VMs), which are logical emulations of a physical computer. The physical computer may host multiple VMs, each sharing the hardware resources of the physical computer, and each emulating a physical computer.
The present disclosure relates generally to the field of computer networking, and more particularly to creating network isolation between virtual machines. In networking technology, virtual local area networks (VLANs) are commonly used to isolate network traffic. In a cloud computing environment, the physical computer may host multiple VMs, each sharing the hardware resources of the physical computer, and each emulating a physical computer. However, in a cloud, it may not be possible to create enough VLANs to isolate network traffic due to limitations on the physical Ethernet adapters and switches, for example. The following described exemplary embodiments provide a security virtual machine (SVM) manager and an SVM agent in a system, method and program product to create network isolation between virtual machines.
As will be appreciated by one skilled in the art, aspects of the present disclosure may be embodied as a system, method or computer program product. Accordingly, aspects of the present disclosure may take the form of an entirely hardware embodiment, an entirely software embodiment (including firmware, resident software, micro-code, etc.) or an embodiment combining software and hardware aspects that may all generally be referred to herein as a “circuit”, “module”, or “system”. Furthermore, aspects of the present invention may take the form of a computer program product embodied in one or more computer readable medium(s) having computer readable program code embodied thereon.
Aspects of the present disclosure are described below with reference to flowchart illustrations and/or block diagrams of methods, apparatus, (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and/or block diagrams, and combinations of blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions.
Turning now to
The server 12 is operational in numerous other computing system environments or configurations. For example, the server 12 may be a standalone machine, a virtual partition on physical host, a clustered server environment, or a distributed cloud computing environment that include any of the above systems or devices, and the like. When practiced in a distributed cloud computing environment, tasks may be performed by both local and remote servers 12 that are linked together and communicate through a communications network, such as the network 99.
The server 12 may be described in the context of executable instructions, such as a program, or more specifically, an operating system (OS) 40 that is an aggregate of program modules 42 being executed by the processing unit 16 to control the operation of the server 12. The program modules 42 perform particular tasks of the OS 40, such as process management; memory management; and device management. The program modules 42 may be implemented as routines, programs, objects, components, logic, or data structures, for example. The program modules 42 performing the particular tasks may be grouped by function, according to the server 12 component that the program modules 42 control. At least a portion of the program modules 42 may be specialized to execute the algorithm of
In a distributed computing environment, such as a cloud computing environment, each participating server 12 may be under the control of an OS 40 residing on each local and remote server 12, respectively. In a virtual machine, also referred to as a virtual server, each instance of the virtual machine is an emulation of a physical computer. A physical computer may host multiple virtual machine instances, each sharing the hardware resources of the physical computer, and each emulating a physical computer. Each of the virtual machine instances is under the control of an OS 40.
As shown in
System memory 28 can include computer system readable media in the form of volatile memory, such as random access memory (RAM) 30 and/or cache memory 32. The server 12 may further include other removable/non-removable, volatile/non-volatile computer system storage media.
By way of example only, a storage system 34 can be provided as one or more devices for reading from and writing to a non-removable, non-volatile magnetic media, such as a hard disk drive (HDD) or an optical disk drive such as a CD-ROM, DVD-ROM. Each device of the storage system 34 can be connected to bus 18 by one or more data media interfaces. The program modules 42, the OS 40, and one or more application programs may be stored on the storage system 34 and subsequently loaded into memory 28 for execution, as needed.
The server 12 may also communicate with one or more external devices 14 such as a keyboard, a pointing device, a display 24, etc.; one or more devices that enable a user to interact with the server 12; and/or any devices (e.g., network card, modem, etc.) that enable the server 12 to communicate with one or more other computing devices. Such communication can occur via I/O interfaces 22.
The server 12 can communicate with one or more networks such as a local area network (LAN), a general wide area network (WAN), and/or a public network (e.g., the Internet) via a network adapter 20. As depicted, the network adapter 20 communicates with the other components of the server 12 via bus 18. However, in a multi-tenant datacenter (MTD) environment, such as a cloud computing environment, network communications may be routed through the member servers 12 and virtual machines through both physical devices (e.g., network adapters network switches), and virtualized networks, such as those implemented using software defined networking (SDN).
External storage adapter 26 connects the server 12 with external storage subsystems, such as a storage area network (SAN) 15 or RAID array. Exemplary external storage adapters 26 include, but are not limited to, a host bus adapter (HBA), host channel adapter (HCA), SCSI, and iSCSI, depending upon the architectural implementation. The external storage adapter 26 communicates with the processing unit 16 and memory 28 of the server 12 over bus 18.
It should be understood that although not shown, other hardware and/or software components could be used in conjunction with the server 12. Examples include, but are not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data archival storage systems, etc.
Referring now to
Each managed system 200 may include multiple instances of one or more virtualization technologies, including for example, VMs 205, containers, and logical partitions (LPARs). Each managed system 200 includes a virtual input/output server (VIOS) 220. A VIOS is a specialized operating system and virtual machine combination that together facilitates the sharing, i.e., virtualization, of physical hardware resources among the client VMs 205 on the managed system 200.
Each of the managed systems 200 shown in
Each VIOS 220 also includes an SVM agent 206 that maintains a zone identifier table of logical zones that exist on the managed system 200. A logical zone may contain the VMs 205 that belong to the same organization or business enterprise, regardless of subnet or VLAN, and regardless of which managed system 200 hosts the VM 205. For example, VMs 205 L3 and L9 both belong to Company 123 and are both in zone 2, even though L3 is on Managed System A and L9 is on Managed System C. Therefore both L3 and L9 are included in the zone identifier tables of the SVM agent 206 of VIOS-A 220 and the SVM agent 206 of VIOS-C 206. Network packets sent between L3 and L9 may use the internal switch 230 (
Table 1 illustrates an exemplary zone identifier table for the managed system 200 Managed System A.
Table 2 illustrates an exemplary zone identifier table for the managed system 200 Managed System B.
Table 3 illustrates an exemplary zone identifier table for the managed system 200 Managed System C.
Each entry in Table 1, Table 2, and Table 3 identifies a VM 205 on a managed system 200. A unique virtual machine identifier (VM ID), for example a name of the VM 205, is associated with each VM 205 on a managed system 200. The VM ID may be unique within a managed system 200, but may not be unique within the cluster because other information in the zone identifier table will uniquely identify the VM 205. Each zone identifier table entry also includes an IP address that is unique in the network, here represented as IP 1 through IP 11, which the SVM agents 206 use to determine how to route traffic to the VMs 205. A unique hardware MAC address, here represented as MAC 1 through MAC 11, identifies the default physical or virtual Ethernet adapter in the VM 205 for communicating with the SVM agent 206. The SVM manager 240 may generate an INSTANCE ID that is unique, and therefore may be non-reusable, within a managed system 200. Alternatively, the SVM manager 240 may adopt the unique INSTANCE ID generated by the cloud orchestrator, hardware management console, or other cluster management facility upon creation of the VM 205. The zone identifier (ZONE ID) may be set at the SVM 240 by an administrator, for example, when defining logical network zones and assigning to the zones those VMs 205 belonging to the same organization. The combination of VM identifier (VM ID), instance identifier (INSTANCE ID), ZONE ID, IP address and MAC address on a managed system 200 ensures the VM 205 is always uniquely identified, since, for example, VM ID, MAC address, and IP address may be re-assigned and reused when a VIOS 220 instantiates a new VM 205.
The SVM agent 206 also includes a security firewall 208 that may receive firewall rules from the SVM manager 240. Each organization having VMs 205 on the managed systems 200 may define firewall rules for the VMs 205 within its zone. The SVM agent 206, in conjunction with the security firewall 208, may apply the firewall rules to filter network traffic entering the managed system 200 from the external switch 235.
The SVM agents 206 on the managed systems 200 form a cluster under the coordination of the SVM manager 240. The SVM manager 240, which may be implemented on a VM 205 within a managed system 200, a standalone computer, or other computing platform, maintains zone identifier tables for all the managed systems 200 within its cluster. A cloud orchestrator (not shown) provides centralized management of the cloud infrastructure, such as for hardware and software provisioning. If the cloud orchestrator modifies the configuration of a managed system 200, for example by adding or deleting a VM 205, or propagating firewall rules, the cloud orchestrator may communicate that modification to the SVM manager 240. The SVM manager 240 updates its zone identifier tables to reflect the modification, and pushes out the modified zone identifier tables to the affected SVM agents 206. The SVM manager 240 may push updated firewall rules to the external switch 235 and/or to the security firewalls 208 of the SVM agents 206.
Referring now to
At 310 if the source and destination IP addresses are not in the same zone, at 340 the network packet is sent to PETH2207 (
At 325 the SVM agent 206 (
However, if at 310 the SVM agent 206 (
Referring now to
Each set of internal components 800 also includes a R/W drive or interface 832 to read from and write to one or more computer-readable tangible storage devices 936 such as a CD-ROM, DVD, SSD, memory stick, magnetic tape, magnetic disk, optical disk or semiconductor storage device.
Each set of internal components 800 may also include network adapters (or switch port cards) or interfaces 836 such as a TCP/IP adapter cards, wireless WI-FI interface cards, or 3G or 4G wireless interface cards or other wired or wireless communication links. The operating system 828 that is associated with computing device 400, can be downloaded to computing device 400 from an external computer (e.g., server) via a network (for example, the Internet, a local area network, or other wide area network) and respective network adapters or interfaces 836. From the network adapters (or switch port adapters) or interfaces 836 and operating system 828 associated with computing device 400 are loaded into the respective hard drive 830 and network adapter 836. The network may comprise copper wires, optical fibers, wireless transmission, routers, firewalls, switches, gateway computers and/or edge servers.
Each of the sets of external components 900 can include a computer display monitor 920, a keyboard 930, and a computer mouse 934. External components 900 can also include touch screens, virtual keyboards, touch pads, pointing devices, and other human interface devices. Each of the sets of internal components 800 also includes device drivers 840 to interface to computer display monitor 920, keyboard 930 and computer mouse 934. The device drivers 840, R/W drive or interface 832 and network adapter or interface 836 comprise hardware and software (stored in storage device 830 and/or ROM 824).
Various embodiments of the invention may be implemented in a data processing system suitable for storing and/or executing program code that includes at least one processor coupled directly or indirectly to memory elements through a system bus. The memory elements include, for instance, local memory employed during actual execution of the program code, bulk storage, and cache memory which provide temporary storage of at least some program code in order to reduce the number of times code must be retrieved from bulk storage during execution.
Input/Output or I/O devices (including, but not limited to, keyboards, displays, pointing devices, DASD, tape, CDs, DVDs, thumb drives and other memory media, etc.) can be coupled to the system either directly or through intervening I/O controllers. Network adapters may also be coupled to the system to enable the data processing system to become coupled to other data processing systems or remote printers or storage devices through intervening private or public networks. Modems, cable modems, and Ethernet cards are just a few of the available types of network adapters.
The present invention may be a system, a method, and/or a computer program product. The computer program product may include a computer readable storage medium (or media) having computer readable program instructions thereon for causing a processor to carry out aspects of the present invention.
The computer readable storage medium can be a tangible device that can retain and store instructions for use by an instruction execution device. The computer readable storage medium may be, for example, but is not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of the computer readable storage medium includes the following: a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), a static random access memory (SRAM), a portable compact disc read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanically encoded device such as punch-cards or raised structures in a groove having instructions recorded thereon, and any suitable combination of the foregoing. A computer readable storage medium, as used herein, is not to be construed as being transitory signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission media (e.g., light pulses passing through a fiber-optic cable), or electrical signals transmitted through a wire.
Computer readable program instructions described herein can be downloaded to respective computing/processing devices from a computer readable storage medium or to an external computer or external storage device via a network, for example, the Internet, a local area network, a wide area network and/or a wireless network. The network may comprise copper transmission cables, optical transmission fibers, wireless transmission, routers, firewalls, switches, gateway computers and/or edge servers. A network adapter card or network interface in each computing/processing device receives computer readable program instructions from the network and forwards the computer readable program instructions for storage in a computer readable storage medium within the respective computing/processing device.
Computer readable program instructions for carrying out operations of the present invention may be assembler instructions, instruction-set-architecture (ISA) instructions, machine instructions, machine dependent instructions, microcode, firmware instructions, state-setting data, or either source code or object code written in any combination of one or more programming languages, including an object oriented programming language such as Smalltalk, C++ or the like, and conventional procedural programming languages, such as the “C” programming language or similar programming languages. The computer readable program instructions may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection may be made to an external computer (for example, through the Internet using an Internet Service Provider). In some embodiments, electronic circuitry including, for example, programmable logic circuitry, field-programmable gate arrays (FPGA), or programmable logic arrays (PLA) may execute the computer readable program instructions by utilizing state information of the computer readable program instructions to personalize the electronic circuitry, in order to perform aspects of the present invention.
Aspects of the present invention are described herein with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and/or block diagrams, and combinations of blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer readable program instructions.
These computer readable program instructions may be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions/acts specified in the flowchart and/or block diagram block or blocks. These computer readable program instructions may also be stored in a computer readable storage medium that can direct a computer, a programmable data processing apparatus, and/or other devices to function in a particular manner, such that the computer readable storage medium having instructions stored therein comprises an article of manufacture including instructions which implement aspects of the function/act specified in the flowchart and/or block diagram block or blocks.
The computer readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable apparatus or other device to produce a computer implemented process, such that the instructions which execute on the computer, other programmable apparatus, or other device implement the functions/acts specified in the flowchart and/or block diagram block or blocks.
The flowchart and block diagrams in the Figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of instructions, which comprises one or more executable instructions for implementing the specified logical function(s). In some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware-based systems that perform the specified functions or acts or carry out combinations of special purpose hardware and computer instructions.
Although preferred embodiments have been depicted and described in detail herein, it will be apparent to those skilled in the relevant art that various modifications, additions, substitutions and the like can be made without departing from the spirit of the disclosure, and these are, therefore, considered to be within the scope of the disclosure, as defined in the following claims.
