Patent Grant
10095870
The present invention relates to the technical field of virtualization, and in particular, relates to a virtual machine creation method and apparatus.
Mobile terminals have become an important tool in users' daily life and work. With dramatic advancements of the mobile Internet by the promotion of mobile terminals, the security issue of the mobile terminals is becoming more and more severe, which is extensively concerned in the society. Mobile virtualization allows a plurality of operating systems or virtual machines (VM) to simultaneously run on a mobile phone or a wireless handheld device, and a secure and independent software running environment is created on the bottom-layer hardware using a Hypervisor. By means of mobile virtualization, a user does not need to carry two or more than two mobile devices, and is capable of accessing a plurality of operating systems in one physical handheld device. Mobile virtualization has prominent features in the aspect of security.
Through isolation achieved by the virtualization technology, a plurality of operating systems are isolated on a single terminal, and thus processes running in the operating systems are prevented from causing adverse impacts to other operating systems. A typical application scenario is to achieve isolation of an enterprise system and a personal system on a mobile device such as a mobile phone by using the virtualization technology, prevent latent risks caused by processes in the personal system to the enterprise system, and accommodate requirements imposed on Bring Your Own Device (BYOD) by some enterprises having security requirement.
For further improvement of isolation of various application levels in a terminal, in the architecture of the technical solution as illustrated in
An embodiment of the present invention provides a virtual machine creation method. The method includes:
Another embodiment of the present invention provides a virtual machine creation apparatus. The apparatus includes:
One or more embodiments are illustrated by way of example, and not by limitation, in the figures of the accompanying drawings, wherein elements having the same reference numeral designations represent like elements throughout. The drawings are not to scale, unless otherwise disclosed.
To make the technical solutions and advantages of the present invention clearer and more understandable, exemplary embodiments of the present invention are described in detail hereinafter with reference to the accompanying drawings. Apparently, the described embodiments are merely a part of embodiments of the present invention, instead of all the embodiments of the present invention. It should be noted that in cases of no conflict, the embodiments and features in the embodiments of the present invention may be combined together.
The present application includes: acquiring a first installation package of a first application; determining essential environmental data corresponding to the first installation package, obtaining a simplified operating system via compilation according to the essential environmental data; packaging the simplified operating system and the first installation package to obtain a virtual machine installation package; and running the virtual machine installation package to create a virtual machine. The present application provides a method for automatically creating a virtual machine for independently running an application, wherein a simplified operating system needed by the applications running on the virtual machine is only configured for the virtual machine, instead of configuring an entire operating system environment. This greatly saves terminal resources. The method is described hereinafter.
For ease of practice of the present invention, description is given hereinafter with reference to examples.
In step 201, the virtual machine creation method according to this embodiment is applied to create, for a first application, a virtual machine for dedicatedly running the application, wherein the acquiring a first installation package of a first application may include: acquiring a request for installing the first application by a user, determining an installation package of the first application according to the application installation request, and acquiring the installation package.
In step 202, before a virtual machine for dedicatedly running a first application is created for the first application, whether to create, for the first application, a virtual machine for dedicatedly running the application is determined, because various applications imposes a different requirement on isolation. With respect to some applications imposing a higher requirement on security, for example, applications related to online payment, including group-shopping application clients, car-hailing applications clients and the like, or some other applications imposing a much more higher requirement on security and related to direct and large-amount transactions from users' bankcards, including Alipay or online banking clients and the like, a virtual machine for dedicatedly running an application needs to be created. With respect to applications imposing no requirement on security, such as music or video playing applications, news resources browser application clients or dictionary and translation applications or the like, the applications may be installed in a virtual machine to maximally save terminal resources.
Step 202 is an optional step. With this step, a virtual machine may be created for an application whose security requirement satisfies a predetermined condition, and with respect to applications imposing a low security requirement, the applications may be uniformly installed in an operating system of a conventional virtual machine according to the prior art, and no virtual machines are created for the applications. In this way, the terminal resources are further saved on the prerequisite of satisfying the security requirement of the application.
In step 203, the installation package of the first application is unpackaged and scanned to determine the type of the operating system that the application running on (for example, Apple iOS operating system or Android operating system or the like), and determine essential environmental data to be called for running the first application in the operating system. The environmental data includes libraries and relevant files and the like in the operating system, wherein such relevant formation as user authority and the like is included. After the essential environmental data is provided, the need for the running environment during running of the first application is satisfied, and the essential environmental data does not include some environmental data that is not needed during the running of the first application.
In combination with the above environmental data and start and control information of the operating system corresponding to the first application, a new configuration file for compiling the operating system is generated. The start and control information of the operating system is used for starting the environment of the operating system and running the first application in a corresponding operating environment. A simplified “operating system” is compiled according to the generated new configuration file, wherein this simplified “operating system” only includes an operating system environment satisfying running of the first application. The compiled simplified operating system and the first application are packaged to generate a virtual machine installation package Image (an image file).
Although when running in various operating systems, almost all the applications need support of their corresponding “start and control information of the operating systems”, the environmental data which different applications need to call, that is, “libraries and relevant files”, is greatly different, and is generally less than all the environmental data of a complete operating system. For example, a complete operating system may occupy several GBs of a memory, whereas a simplified operating system for various applications only occupies tens or several hundreds of MBs of a memory. Therefore, the virtual machine created according to this technical solution not only satisfies the running requirements of various applications, but also greatly reduces consumption of the memory.
In step 204, after a virtualization layer host (Host) runs the image file of the virtual machine installation package, a virtual machine for dedicatedly running the first application may be directly created, that is, a virtual machine is created, and the simplified operating system is configured on the created virtual machine and the first application is installed.
The architecture upon creation of a virtual machine according to the present application is as illustrated in
The present application provides a method for automatically creating a virtual machine for independently running an application, wherein a simplified operating system needed by the applications running on the virtual machine is only configured for the virtual machine, instead of configuring an entire operating system environment. This greatly saves terminal resources.
According to this embodiment, after a virtual machine for dedicatedly running an application is created, in step 405, a second installation package is acquired, and an attempt is made to install the second installation package on the created virtual machine.
In step 406, under general circumstances, the second installation package will be installed to an existing virtual machine running a plurality of applications imposing a low security requirement, or according to steps 201 to 204 or steps 401 to 404, a new virtual machine is created for the second installation package and the second installation package is installed on the new virtual machine. If a new virtual machine is created for any new installation package, the number of virtual machines in the system is large, and thus terminal resources may be wasted. In step 406, whether the second installation package satisfies a predetermined condition is determined, and the second installation package satisfying the predetermined condition may be installed on an existing virtual machine for dedicatedly running an application, to reduce the number of virtual machines appropriately.
In some embodiments, the predetermined condition may be: the second installation package is an updated installation package of the first application.
An updated application still imposes the same security requirement, runs the same operating system, and basically needs the same environmental data or needs little additional data. Therefore, when a virtual machine for dedicatedly running an application has been created for this application, and an updated installation package of the application has also been obtained, there is no need to create a independent virtual machine for the updated installation package, but the updated installation package needs to be installed on a virtual machine of the application corresponding to the updated installation package, so as to prevent creating a new virtual machine for the updated installation package and consuming terminal resources.
In some embodiments, the predetermined condition may be: the second installation package is an installation package of a second application, and a security level of the second application is the same as the security level of the first application.
Some similar applications impose the same security requirement. For such similar applications, it is more important to isolate these applications from ordinary applications, instead of isolating these applications from each other. Therefore, it may be considered to install the applications having the same security level on a newly created virtual machine. Using the architecture illustrated in
In some embodiments, when the second installation package is an installation package of the second application, the predetermined condition may include: determining that a similarity between essential environmental data corresponding to the second installation package and the essential environmental data corresponding to the first installation package exceeds a predetermined threshold.
Considering that it needs to be further considered whether the environmental data to be called by applications is the same or similar when these applications having the same security level are installed on a virtual machine, when the environmental data needed by various applications is greatly different, the virtual machine capable of simultaneously running these applications will contain a large amount of environmental data, which is equivalent to installation of a complete operating system. As such, in one aspect, applications having the same security level may not be better isolated, and in another aspect, the memory occupied by the virtual machine may not be minimized.
Therefore, the second installation package is installed on the virtual machine for dedicatedly running the first application only when the similarity between the essential environmental data corresponding to the second installation package and the essential environmental data corresponding to the first installation package of the first application exceeds a predetermined threshold. That the similarity of the environmental data exceeds the predetermined threshold include: the essential environmental data corresponding to the second installation package is less than the essential environmental data corresponding to the first installation package of the first application, or the essential environmental data corresponding to the second installation package is the same as the essential environmental data corresponding to the first installation package of the first application, or the ratio of the size of memory occupied by the same portion of the environmental data corresponding to the second installation package and the essential environmental data corresponding to the first installation package of the first application to the total size of the memory occupied by the essential environmental data corresponding to the second installation package exceeds a predetermined ratio (for example, 90%).
That is, if the environmental data needed by two applications is greatly different, even if these two applications have the same security level, a later application may not be installed on the virtual machine for dedicatedly running a previous application.
For example, the environmental data needed by Tmall client application is the same as the environmental data essential by Taobao client application. Therefore, TinaII client application may be installed, using the installation package of Tmall client application, on the virtual machine for dedicatedly running Taobao client application. The environmental data needed by Xianyu client application (Xianyu client application is similar to Taobao client application and Tmall client application, which is an e-commerce application having similar functions developed by Alibaba and also relates to user account and payment information, and may thus considered to have the same security level as Taobao client application and Tmall client application) is less than the environmental data needed by Taobao client application. Therefore, Xianyu client application may be installed on the existing virtual machine for dedicatedly running Taobao client application. Finally, the virtual machine originally for dedicatedly running Taobao client application may run Taobao client application, Tmall client application and Xianyu client application, and other applications satisfying the above condition may be further installed on the virtual machine.
In step 407, the second installation package satisfying the predetermined condition is installed on the virtual machine.
When the second installation package is an updated installation package of the first application, a new function may need to be added during the updating and upgrading process of the application. Therefore, the updated installation package is scanned, the environmental data essential by the updated installation package is compared with the environmental data supported by the existing virtual machine for dedicatedly running the first application to determine environmental data to be called for newly adding or modifying a function, and the determined environmental data and the start and control information of the operating system upon update of the first application are re-compiled, and installed together with the second installation package to the existing virtual machine for dedicatedly running the first application in the form of an extended application. The virtual machine needs to update a list of the supported environmental data, and update the start and control information of the operating system of the first application.
For example, if Taobao client application previously installed by the user does not have the function of scanning codes to find commodities, and Taobao client application in a latest version is capable of calling the camera to acquire, via scanning, a two-dimensional code and barcode information of a commodity, environmental data needed for calling the camera in the operating system needs to be added on the virtual machine originally for dedicatedly running Taobao client application, and start and control information of the operating system corresponding to Taobao client application in the latest version needs to be updated.
When the second installation package is an installation package of the second application, if the essential environmental data corresponding to the second installation package is less than the essential environmental data corresponding to the first installation package of the first application, or the essential environmental data corresponding to the second installation package is the same as the essential environmental data corresponding to the first installation package of the first application, there is no need to add new environmental data, the second application is directly installed on the existing virtual machine for dedicatedly running the first application, and the start and control information of the operating system corresponding to the second application is meanwhile added to the virtual machine.
For example, if a user has created a virtual machine for dedicatedly running Taobao client application, and desires to install Tmall client application, the Host judges that the security level of Tmall client application is the same as the security level of Taobao client application, the two applications run in the same operating system (for example, the Android operating system), and meanwhile the environmental data in the operating system to be called by these two applications are exactly the same. In this case, Tmall client application is directly installed on the virtual machine for dedicatedly running Taobao client application, and start and control information of the operating system corresponding to Tmall client application is added to the virtual machine.
If the ratio of the size of memory occupied by the same portion of the environmental data corresponding to the second installation package and the essential environmental data corresponding to the first installation package of the first application to the total size of the memory occupied by the essential environmental data corresponding to the second installation package exceeds a predetermined ratio (for example, 90%), that is, a portion of the environmental data needed by the second application may be different from the environmental data essential by the first application, when the second application is installed on the virtual machine for dedicatedly running the first application, environmental data, needed by the second application, different from that needed by the first application may also be added in addition to the start and control information of the operating system corresponding to the second application.
For example, a user has created a virtual machine for dedicatedly running housing transaction applications, and these applications are similar to e-commerce shopping applications but do not relate to the actual payment function. Therefore, the environmental data in the related operating system may be slightly less than that essential by Taobao client application or Tmall client application. In this case, the user initiates a request for installing Taobao client application, and the Host judges that the security level of Taobao client application is the same as the security level of the housing transaction application running on an independent virtual machine. In addition, although the environmental data essential by Taobao client application is slightly more than the environmental data essential by the housing transaction application, the similarity of their essential environmental data exceeds a predetermined threshold (for example, 90% of their environmental data is the same). As such, while installing Taobao client application on the virtual machine, the Host supplements the environmental data to be additionally called by Taobao client application and different from the environmental data essential by the housing transaction application, and start and control information of the operating system of Taobao client application. Upon successful installation of Taobao client application, a list of the environmental data of the virtual machine is updated.
The present application provides a method for automatically creating a virtual machine for independently running an application, wherein a simplified operating system needed by the applications on the virtual machine is only configured for the virtual machine, instead of configuring an entire operating system environment. This greatly saves terminal resources. In addition, where a virtual machine for dedicatedly running an application is created, an updated installation package of the application or other applications may be further installed on the virtual machine according to the actual needs, so as to achieve optimal utilization of terminal resources.
Based on the same inventive concept, another embodiment of the present invention provides a virtual machine creation apparatus. Since the principle based on which the apparatus solves the technical problem is similar to the principle used by the virtual machine creation method, practice of the apparatus may be referenced to practice of the method. The duplicate portions are not described herein any further.
In some embodiments, the apparatus 500 further includes a security module 502, wherein before the compiling and packaging module 503 determines the essential environmental data corresponding to the first installation package, the security module 502 is configured to determine a security level of the first application, and determine, according to the security level of the first application, that a virtual machine needs to be created for the first application.
In some embodiments, the apparatus 500 further includes:
In some embodiments, the predetermined condition includes: the second installation package is an updated installation package of the first application.
In some embodiments, the predetermined condition includes: the second installation package is an installation package of a second application, and a security level of the second application is the same as the security level of the first application.
In some embodiments, the condition determining module 506 is further configured to determine that a similarity between essential environmental data corresponding to the second installation package and the essential environmental data corresponding to the first installation package exceeds a predetermined threshold before the installing module installs the second installation package to the virtual machine.
For ease of description, in the description, various parts of the above apparatuses are divided into various modules according to function for independent description. Nevertheless, the function of each module or unit is implemented in the same or a plurality of software and/hardware when the present invention is practiced.
Those skilled in the art shall understand that the embodiments may be described as illustrating methods, systems, or computer program products. Therefore, hardware embodiments, software embodiments, or hardware-plus-software embodiments may be used to illustrate the present invention. In addition, the present invention may further employ a computer program product which may be implemented by at least one non-transitory computer-readable storage medium with an executable program code stored thereon. The non-transitory computer-readable storage medium includes, but not limited to, a disk memory, a CD-ROM, and an optical memory.
The present invention is described based on the flowcharts and/or block diagrams of the method, device (system), and computer program product. It should be understood that each process and/or block in the flowcharts and/or block diagrams, and any combination of the processes and/or blocks in the flowcharts and/or block diagrams may be implemented using computer program instructions. These computer program instructions may be issued to a computer, a dedicated computer, an embedded processor, or processors of other programmable data processing device to generate a machine, which enables the computer or the processors of other programmable data processing devices to execute the instructions to implement an apparatus for implementing specific functions in at least one process in the flowcharts and/or at least one block in the block diagrams.
These computer program instructions may also be stored in a non-transitory computer-readable memory capable of causing a computer or other programmable data processing devices to work in a specific mode, such that the instructions stored on the non-transitory computer-readable memory implement a product including an instruction apparatus, wherein the instruction apparatus implements specific functions in at least one process in the flowcharts and/or at least one block in the block diagrams.
These computer program instructions may also be stored on a computer or other programmable data processing devices, such that the computer or the other programmable data processing devices execute a series of operations or steps to implement processing of the computer. In this way, the instructions, when executed on the computer or the other programmable data processing devices, implement the specific functions in at least one process in the flowcharts and/or at least one block in the block diagrams.
Although preferred embodiments of the present invention are described, those skilled in the art may make modifications and variations to these embodiments based on the basic inventive concept of the present invention. Therefore, the preferred embodiments and all such modifications and variations shall fall within the protection scope subject to the appended claims.
This application is a continuation of International Application No. PCT/CN2016/080128, with an international filing date of Apr. 25, 2016, the entire contents of which are incorporated herein by reference.
| Number | Name | Date | Kind |
|---|---|---|---|
| 7519814 | Rochette | Apr 2009 | B2 |
| 8230415 | Thomas | Jul 2012 | B1 |
| 8578363 | Sah | Nov 2013 | B2 |
| 8694989 | Carlson | Apr 2014 | B1 |
| 8862741 | Tegtmeier | Oct 2014 | B1 |
| 8990809 | Jacob | Mar 2015 | B1 |
| 9032481 | Ikeda | May 2015 | B2 |
| 9747091 | Berg | Aug 2017 | B1 |
| 9747136 | Sathyamurthy | Aug 2017 | B2 |
| 20040123152 | Le Saint | Jun 2004 | A1 |
| 20050283622 | Hall | Dec 2005 | A1 |
| 20060031830 | Chu | Feb 2006 | A1 |
| 20090044170 | Bernardi | Feb 2009 | A1 |
| 20090064086 | Faus | Mar 2009 | A1 |
| 20090228629 | Gebhart | Sep 2009 | A1 |
| 20090254993 | Leone | Oct 2009 | A1 |
| 20090271787 | Clark | Oct 2009 | A1 |
| 20100023934 | Sheehan | Jan 2010 | A1 |
| 20100138823 | Thornley | Jun 2010 | A1 |
| 20110035747 | Machida | Feb 2011 | A1 |
| 20110126197 | Larsen | May 2011 | A1 |
| 20110265164 | Lucovsky | Oct 2011 | A1 |
| 20110271279 | Pate | Nov 2011 | A1 |
| 20120137281 | Kleiner | May 2012 | A1 |
| 20120137369 | Shin | May 2012 | A1 |
| 20120144391 | Ueda | Jun 2012 | A1 |
| 20120246634 | Wright | Sep 2012 | A1 |
| 20120331463 | Orveillon | Dec 2012 | A1 |
| 20130132950 | McLeod | May 2013 | A1 |
| 20130232498 | Mangtani | Sep 2013 | A1 |
| 20130275596 | Subramaniam | Oct 2013 | A1 |
| 20130297922 | Friedman | Nov 2013 | A1 |
| 20140006580 | Raghu | Jan 2014 | A1 |
| 20140040446 | Cohen | Feb 2014 | A1 |
| 20140059544 | Koganty | Feb 2014 | A1 |
| 20140173594 | Ng | Jun 2014 | A1 |
| 20150039875 | Di Cocco | Feb 2015 | A1 |
| 20150106810 | Ciano | Apr 2015 | A1 |
| 20150120818 | Kim | Apr 2015 | A1 |
| 20150269029 | Smith | Sep 2015 | A1 |
| 20160096136 | Su et al. | Apr 2016 | A1 |
| 20160098288 | Petrov | Apr 2016 | A1 |
| 20160162338 | Sathyamurthy | Jun 2016 | A1 |
| 20160179850 | Martin | Jun 2016 | A1 |
| 20160378519 | Gaurav | Dec 2016 | A1 |
| 20160378530 | Ramasubramanian | Dec 2016 | A1 |
| 20160379237 | Shapsa | Dec 2016 | A1 |
| 20160380862 | Shapsa | Dec 2016 | A1 |
| 20170003991 | Strandzhev | Jan 2017 | A1 |
| 20170075675 | Babol | Mar 2017 | A1 |
| 20170109212 | Gaurav | Apr 2017 | A1 |
| 20170149880 | Lochhead | May 2017 | A1 |
| 20170149931 | Lochhead | May 2017 | A1 |
| 20170161023 | Khazanchi | Jun 2017 | A1 |
| 20170161043 | Khazanchi | Jun 2017 | A1 |
| 20170161057 | Khazanchi | Jun 2017 | A1 |
| 20170161101 | Khazanchi | Jun 2017 | A1 |
| 20170163669 | Brown | Jun 2017 | A1 |
| 20170168714 | Saha | Jun 2017 | A1 |
| 20170214737 | Agarwal | Jul 2017 | A1 |
| 20170214738 | Agarwal | Jul 2017 | A1 |
| 20170228227 | Winterfeldt | Aug 2017 | A1 |
| 20170228245 | Hardy | Aug 2017 | A1 |
| 20170242866 | Imai | Aug 2017 | A1 |
| 20170270449 | Shrimali | Sep 2017 | A1 |
| 20170288863 | Dimitrakos | Oct 2017 | A1 |
| 20170364713 | Speak | Dec 2017 | A1 |
| Number | Date | Country |
|---|---|---|
| 101655798 | Feb 2010 | CN |
| 103716347 | Apr 2014 | CN |
| 103778368 | May 2014 | CN |
| 105320546 | Feb 2016 | CN |
| Entry |
|---|
| Written Opinion dated Jan. 25, 2017; PCT/CN2016/080128. |
| Number | Date | Country | |
|---|---|---|---|
| 20170323105 A1 | Nov 2017 | US |
| Number | Date | Country | |
|---|---|---|---|
| Parent | PCT/CN2016/080128 | Apr 2016 | US |
| Child | 15661168 | US |
