This application is based upon and claims the benefit of priority of the prior Japanese Patent Application No. 2008-224865, filed on Sep. 2, 2008, the entire contents of which are incorporated herein by reference.
The present invention relates to a technique for setting a secure communication path between virtual machines.
Recently, the demand for out-sourcing information processing systems of enterprises or the like has increased and the market for such out-sourcing has been growing. A data center that contracts for such out-sourcing in a lump has a server node pool including a plurality of servers. Business programs used for processing client business whose out-sourcing has been entrusted are distributed and arranged among the plurality of servers included in the server node pool in accordance with their functions, and these servers are physically connected with each other in a network.
In such a server node pool, a technique for setting a virtual machine environment for each server in order to divide and manage business relating to a plurality of clients is generalized. Specifically, in each server, acting as a virtual operating system (hereinafter, referred to as a virtual OS (Operating System)), a host OS which is the basis of the virtual machine environment is operated and guest OSs are respectively operated as business program executing environments, by which inter-client mixing of data processed using business programs of clients can be avoided even in the case where business programs of a plurality of clients are to be processed on the same server. In addition, in such a data center, an inter-server physical network is shared among the plurality of clients, so that the following technique is also adopted. That is, a network is virtually divided by partitioning the inter-server physical network in L2 (Layer-2) partitions using the VLAN (Virtual Local Area Network) technique or by partitioning it using VPN (Virtual Private Network), so as to build virtual intranets for respective clients.
Here, in operation of a server node pool, in the case that a guest OS is newly started up for a server in which the corresponding business program has not being executed so far, it is necessary to newly connect, on a virtual network basis, the server for which the guest OS has been newly started up with other servers so as to perform data transmission and reception therebetween.
However, the burden of setting up a new virtual network connection is heavy. This is because that identifying a server to be connected with is difficult due to a complexity of a server configuration in a server node pool, and that, in order to set up a virtual network connection, ensuring a security by using an encryption technique is needed to avoid information leakage, invalid access and the like. In addition, for encryption, an encryption key for enciphering transmission data should be set to each server as a security policy. Moreover, it is desirable, from the viewpoint of security enhancement, that a different security policy is set to each of servers to be connected with on the virtual network basis. However, when a security policy is different for each of the servers as mentioned above, setting up thereof becomes further complicated and requires much time and labor.
United States Patent Application Publication No. 2002/0069369 discloses a technology for providing computer services to customers using virtual machines.
According to an aspect of the invention, there is provided a method for setting a secure communication path between virtual machines each arranged within a server included in a set of servers in a network. The method includes providing business software that is operated by executing one or more task programs each provided for a virtual machine, and further includes providing each of the set of servers with, as a virtual machine, a guest operating system controlled by a host operating system thereof, the guest operating system executing a task program that handles a part of process to be operated by the business software, the host operating system controlling a secure communication between the guest operating system and another server included in the set of servers. The one or more task programs are classified into task classes according to a type of a function to be realized thereby, and there is provided task connection information including information on whether a communication path is needed or not between each pair of task classes, and encryption information including information on whether an encryption of transmission data is needed or not between each pair of task classes between which a communication path is needed. From among the set of servers, a first server different from servers in which the one or more task program are executed is selected, and provided with a first task program belonging to a first task class for handling a part of process to be operated by the business software. Then, a first guest operating system provided for the first server is started up so as to make the first task program ready to be executed. Next, from among the set of servers, a second server with which the first task program is to communicate, is selected on the basis of the task connection information, and it is determined whether an encryption of transmission data is needed or not between the first task program and the selected second server, on the basis of the encryption information. Then, encryption setting information is set to both a first host operating system provided for the first server and a second host operating system provided for the second server when it is determined that an encryption of transmission data is needed between the first task program and the selected second server, and a secure communication path between the first guest operating system and a second guest operating system provided for the second server is set by setting virtual network connection information to both the first and second host operating systems, so as to operate the business software by executing the first task program as well as the one or more task programs.
The object and advantages of the invention will be realized and attained by means of the elements and combinations particularly pointed out in the claims.
It is to be understood that both the foregoing general description and following detailed description are exemplary and explanatory and are not restrictive of the invention, as claimed.
In the plurality of servers 20 included in the server node pool (or the set of servers), a plural pieces of business software for a plurality of clients who have entrusted outsourcing thereof to the data center can be operated. Each server 20 is provided with a virtual machine capable of operating a virtual OS. Further, by connecting the servers 20 each other on the P2P (Peer to Peer) basis using a virtual (private) network (for example, VPN: Virtual Private Network), the system is divided into parts each corresponding to a client so as to build virtual intranets. The virtual intranets built by dividing the system as mentioned above are connected to respective systems belonging to the clients.
The above mentioned business software can be operated by executing one or more task programs each provided for a virtual machine, and each of the set of servers can be provided with, as a virtual machine, a guest operating system controlled by a host operating system thereof, where the guest operating system executes a task program that handles a part of processing to be operated by the business software, and the host operating system controls a secure communication between the guest operating system and another server included in the set of servers.
Hereinafter, an example in which a VPN connection is used will be described as a representative example of a communication path between virtual machines.
First, the configuration of server 20 provided with such a virtual machine, and the mechanism of VPN connection between servers 20 will be described with reference to
In server 20, the virtual machine is built so that host OS 30 and guest OS 40 operate as virtual OSs. Host OS 30 and guest OS 40 are controlled by a hypervisor functioning as an OS control program.
In addition, a server 20 is provided with a physical NIC (Network Interface Card) 50 used for performing communication between the own server and other servers. A physical IP address that is uniquely determined within the server node pool is allocated to each of servers 20. In addition, each of the host OS and the guest OS 40 that operate within a server 20 has a virtual NIC 60 and a communication between the host OS 30 and the guest OS 40 within the same server 20 is performed by using the virtual NICs 60. A client IP address serving as a virtual IP address that is an original address different from the physical IP address is allocated to the guest OS 40 that operates within the server 20.
Host OS 30 can be configured to include the following elements: a routing module 30A, a tunneling module 30B, and an enciphering module 30C.
The routing module 30A specifies tunnel information that is needed for transmitting, via a VPN connection, data received from the guest OS 40. This routing module 30A is provided with a routing setting table that includes client IP addresses of destinations and tunnel information used in VPN connection to the destinations as depicted in
A tunneling module 30B performs tunneling of transmission data by appending a physical IP address of a destination to the transmission data and encapsulating the transmission data. The tunneling module 30B is provided with a tunneling setting table in which tunnel information and a physical IP address of the opposite end of a tunnel corresponding thereto are set for each piece of tunnel information as depicted in
An enciphering module 30C enciphers transmission data and decodes received data. The enciphering module 30, which has a function analogous to an IPSec module or the like, functions as a key managing daemon. When data is received from another server 20, the enciphering module 30C of the host OS 30 decodes the received data, the tunneling module 30B decapsulate the decoded data, and then the decapsulated data is transmitted to the guest OS 40 pointed by the client IP address that is appended to the received data by the routing module 30A.
On the other hand, the guest OS 40 is configured to include a client business processing module 40A for executing a task program that handles a part of process to be processed by the business software. Although only one guest OS is operating in the example depicted in
Here, in the example depicted in
By adopting such a configuration as mentioned above, in the case that the task program transmits and receives data between the own server and the other servers 20, the guest OS 40 needs only to set the client IP address of the destination at the transmission data so that the host OS 30 performs VPN connection processing such as setting of physical IP address and encryption. Therefore, it is not necessary for a client to directly control the host OS 30 of a server when accessing the server to execute a task program thereof and perform VPN connection between the server and other servers. Thus, communication with other servers becomes possible without authorizing the client to control the host OS 30, thereby preventing such a trouble that the client erroneously changes the setting of the environment of the host OS 30.
Next, the management server 10 for generally managing these servers 20 will be described.
The startup instruction accepting module 10A, connected with an input device that a user can operate, accepts a startup instruction for executing a task program by starting up a guest OS 40. The startup instruction designates a startup object server (or a first server) within which a new guest OS 40 is to be started up, and a task program to be executed therein.
The guest OS startup module 10B instruct a server 20 in which host the OS 30 is operated under control of the hypervisor and the guest OS 40 is ready to run, to start up a new guest OS 40 so as to execute a task program.
The connection plan determining module 10C determines a connecting destination server (or a second server) that is a server to be connected, via a VPN, to the startup object server in which the guest OS 40 has been started up, and judges whether encryption of transmission data is needed or not between the startup object server and the connecting destination server.
The connection setting module 10D is communicably connected with the servers 20 via a network and sets encryption setting information indicating a security policy and virtual network connection information to both the host OS 30 of the startup object server and to the host OS 30 of the connecting destination server.
For example, as depicted in
Here, it will be described how servers 20 are VPN-connected with each other on the basis of the above mentioned connection plan table 10E in which information on whether VPN connection is needed or not and information on whether encryption of transmission data is necessary or not are stored in association with each of pairs of task classes.
In step S01 (abbreviated as S01 in
It step S02, referring to the connection plan table 10E, all the task classes that are to be connected via a VPN connection with the task class of the designated task program to which a startup instruction has been given, are obtained, and it is determined whether encryption of transmission data is necessary or not in the VPN connection.
In step S03, referring to the task management table 10F, a server 20 executing a task program belonging to the task class obtained at step S02 is determined to be a connecting destination server (or a second server).
In step S04, referring to the task management table 10F, the client IP address of the guest OS 40 in the connecting destination server is obtained.
In step S05, a tunnel to be used for VPN connection between the startup object server and the connecting destination server is determined so as not to duplicate a tunnel which has been already used in each server.
In step S06, referring to a server management table 10G, the physical IP address of the connecting destination server is obtained.
In step S07, it is determined whether encryption of transmission data is needed between the startup object server and the connecting destination server on the basis of information, obtained at step S02, on whether encryption of transmission data is needed or not in the VPN connection between task classes. When encryption is needed (YES), the process proceeds to next step S08, and when encryption is not needed (NO), the process proceeds to step S10.
In step S08, an encryption key according to the encryption system of the connecting destination server is obtained from the server management table 10G, and the obtained encryption key is used as an encryption key for enciphering transmission data to the connecting destination server. Here, when the encryption system applied to the connecting destination server is a public key encryption system, a public key will be obtained and when it is a secret key encryption system, a secret key will be obtained. Then, the obtained encryption key is set to the enciphering module 30 of the startup object server, as encryption setting information, to the connecting destination server. In the case, the encryption setting information indicates a security policy of the VPN connection.
In step S09, an encryption key according to the encryption system of the startup object server is obtained from the server management table 10G, and the obtained encryption key is used as an encryption key for enciphering transmission data to the startup object server. Here, when the encryption system applied to the startup object server is a public key encryption system, a public key will be obtained and when it is a secret key encryption system, a secret key will be obtained. Then, the obtained encryption key is set to the enciphering module 30 of the connecting destination server, as encryption setting information, to the startup object server. In the case, the encryption setting information indicates a security policy of the VPN connection.
In step S10, in order to establish a VPN connection from the startup object server to the connecting destination server, a new tunnel is set to the tunneling module 30B of the startup object server in accordance with the tunnel information determined at step S05. That is, the tunnel information and the physical IP address of the connecting destination server are, as virtual network connection information, set to the tunneling setting table of the tunneling module 30B of the startup object server. Further, the client IP address of the connecting destination server and the tunnel information are, as virtual network connection information, set to the routing setting table of the routing module 30A of the startup object server.
In step S11, in order to establish a VPN connection from the connecting destination server to the startup object server, a new tunnel is set to the tunneling module 30B of the connecting destination server. That is, that tunnel information and the physical IP address of the startup object server are, as virtual network connection information, set to the tunneling setting table of the tunneling module 30B of the connecting destination server. Further, the client IP address of the startup object server and the tunnel information are, as virtual network connection information, set to the routing setting table of the routing unit 30A of the connecting destination server.
In step S12, the client IP address, the task class, and the server identifier of the startup object server are registered in the task management table 10F of the management server 10, and tunnel information between the startup object server and the connecting destination server is registered in the connection management table 10H of the management server 10.
In the above description, when a plurality of connecting destination servers have been determined at step S03, the steps S04 to S12 are executed for each of the plurality of connecting destination servers.
Here, a network setting process by the management server 10 will be described with reference to a specific example thereof.
In this example, the connection plan table 10E, the server management table 10G, the task management table 10F, and the connection management table 10H of the management server 10 are set as depicted in
Further, in this example, data as depicted in
Then, when the startup instruction has been given, the management server 10 starts up the guest OS 40 in the server β and brings it into a state that a task program of the task class A can be executed thereon. At that time, a new client IP address (192. 167. 0. 3) is allocated to the started up guest OS 40 (corresponding to step S01 of
Further, tunnels used for VPN connection between the server β and the server γ are determined. In the case, “Tun0” is determined as a tunnel used for a VPN connection from the server β to the server γ, and “Tun1” is determined as a tunnel used for a VPN connection from the server γ to the server β (corresponding to step S05). Further, referring to the server management table 10G, a physical IP address (10. 0. 0. 3) of the server γ is obtained (corresponding to step S06).
Then, on the basis of the information in accordance with the connection plan table 10E obtained at step S02, it is determined that encryption of the VPN connection between the server β and the server γ is needed (corresponding to step S07). Next, referring to the server management table 10G, it is determined that the encryption system applied to the server γ is a public key system, and the public key thereof “rAAIEAtbRmeAJc . . . ” is obtained. Then, the public key “rAAIEAtbRmeAJc . . . ” is set to the enciphering module 30C of the server β, as an encryption key used for enciphering transmission data to the server γ (corresponding to step S08). Likewise, referring to the server management table 10G, it is determined that the encryption system applied to the server β is a secret key system, and the secret key thereof “AAAAB3NzaClyc . . . ” are obtained. Then, the secret key “AAAAB3NzaClyc . . . ” is set to the enciphering module 30C of the server γ, as an encryption key used for enciphering transmission data to the server β (corresponding to step S09).
Further, for VPN connection from the server β to the server γ, a new tunnel (Tun0) is set to the tunneling module 30B of the server β as depicted in
On the other hand, for VPN connection from the server γ to the server β, a new tunnel (Tun1) is set to the tunneling module 30B of the server γ as depicted in
Then, in the task management table 10F of the management server 10, the server β is registered as a server for executing the task program belonging to the task class A together with a client IP address (192. 167. 0. 3) as depicted in
According to the network setting process as mentioned above, when a new guest OS has been started up, a connecting destination server (or a second server) is automatically determined in accordance with a task program to be executed by the guest OS and it is determined whether encryption of transmission data in VPN connection is necessary or not between a startup object server (or first server) and the connecting destination server. In addition, virtual network connection information for establishing a VPN connection between the startup object server and the connecting destination server and encryption setting information (for example, a encryption key) as a security policy are automatically set to the host OS of each server. Therefore, when a new guest OS has been started up, the work of routing setting in each server and tunneling setting for VPN connection as well as the security policy setting work, can be eliminated. In setting the security policy, setting of a different encryption key can be performed depending on the server acting as a connecting destination server of the VPN connection. Therefore, in the VPN connection, the burden of setting up the network is drastically reduced while ensuring security of data transmission.
In addition, depending on an encryption system (a public key system or a secret key system) applied to a server that is the transmission destination of data, a public key or a secret key can be obtained as an encryption key which is set to the host OS of each server so as to encipher the transmission data. Therefore, even if a different encryption system is applied to each server included in a server node pool, the security policy can be automatically set in an appropriate manner.
As described above, it is possible to set, to the connection plan table 10E, information on whether connection is needed or not between the same business program classes, and information on whether encryption of transmission data is needed or not between the same business program classes. Therefore, the embodiment can be applied to the case of executing an another task program belonging to the same task class to which an existing task program that has already been executed belongs, so as to horizontally expand the function of a specific business software. On the other hand, it is also possible to set, to the connection plan table 10E, information on whether connection is needed or not between different task classes, and information on whether encryption of transmission data is needed or not between different task classes. Therefore, by registering, in advance, a new task class in the connection plan table 10E, the embodiment can be applied even to the case of conducting vertical expansion for executing a new task program belonging to a task class which has never been executed so far.
As mentioned above, according to the embodiment, network setting work can be automated in various forms of expansion of systems for executing business software.
All examples and conditional language recited herein are intended for pedagogical purposes to aid the reader in understanding the invention and the concepts contributed by the inventor to furthering the art, and are to be construed as being without limitation to such specifically recited examples and conditions, nor does the organization of such examples in the specification relate to a showing of the superiority and inferiority of the invention. Although the embodiment(s) of the present inventions have been described in detail, it should be understood that the various changes, substitutions, and alterations could be made hereto without departing from the spirit and scope of the invention.
Number | Date | Country | Kind |
---|---|---|---|
2008-224865 | Sep 2008 | JP | national |