Moveable access control list (ACL) mechanisms for hypervisors and virtual machines and virtual port firewalls
View Patent ↗A method (and system) which provides virtual machine migration with filtered network connectivity and control of network security of a virtual machine by enforcing network security and routing at a hypervisor layer at which the virtual machine partition is executed, and which is independent of guest operating systems.
1. A computer implemented method of controlling network security of a virtual machine, the method comprising enforcing network security and routing at a hypervisor layer via dynamic updating of routing controls initiated by a migration of said virtual machine from a first device to a second device.
2. The method according to claim 1 , further comprising:
routing traffic for the virtual machine to the second device at the hypervisor layer; and
setting firewalls to permit a network traffic for the virtual machine to go to the second device at the hypervisor layer.
3. The method according to claim 1 , further comprising:
copying network security and routing for said virtual machine to said hypervisor layer;
migrating said virtual machine from a first hardware device to a second hardware device.
4. The method according to claim 3 , further comprising:
updating routing controls for said virtual machine at the hypervisor level;
updating traffic filters for said virtual machine at the hypervisor level; and
advertising said migration of said virtual machine from said first hardware device to said second hardware device.
5. The method according to claim 1 , further comprising setting firewalls to permit network traffic for the virtual machine to go to the second hardware device at the hypervisor layer.
6. The method according to claim 1 , further comprising adding a network section to a Virtual Machine Description File.
7. The method according to claim 1 , further comprising storing network access control lists.
8. The method according to claim 7 , further comprising adding a command line interface to a Virtual Switch configuration to set and unset a respective one of the access control lists.
9. A system for virtual machine migration with filtered network connectivity and controlling network security of a virtual machine by enforcing network security and routing at a hypervisor layer, said system comprising:
a copying unit that copies network security and routing for said virtual machine to said hypervisor layer;
a migrating unit that migrates said virtual machine from a first hardware device to a second hardware device;
a first updating unit that updates routing controls for said virtual machine at the hypervisor level;
a second updating unit that updates traffic filters for said virtual machine at the hypervisor level; and
an advertising unit that advertises said migration of said virtual machine from said first hardware device to said second hardware device.
10. The system of claim 9 , further comprising:
a router that routes network traffic for said virtual machine to said second hardware device based on said routing controls; and
a filter that grants access to said virtual machine on said second hardware device based on said traffic filters.
11. The system according to claim 9 , wherein said second hardware device includes said advertising unit.
12. The system according to claim 9 , wherein said first updating unit dynamically updates routing controls initiated by said migration of said virtual machine from the first device to the second device.
13. The system according to claim 9 , wherein said second updating unit dynamically controls firewall network access initiated by said migration of said virtual machine from said first device to said second device.
14. The system according to claim 9 , further comprising a logical rule unit that establishes logical rules that govern an interaction of said migrated virtual machine with a network infrastructure.
15. The system according to claim 9 , further comprising a storage unit for storing network access control lists, said network access control lists comprising a serialized representation of the virtual machine in a central repository.
16. The system according to claim 9 , further comprising a storage unit that stores a virtual machine description file when said virtual machine is serialized, said virtual machine description file including a network section and a media access control file.
17. The system according to claim 9 , wherein said hypervisor layer includes a hypervisor at which a virtual machine partition is executed.