Securely hosting workloads in virtual computing environments
View Patent ↗Methods and apparatus involve securely hosting workloads. Broadly, computing workloads are classified according to security concerns and those with common concerns are deployed together on common hardware platforms. In one instance, security tags are bi-modally attached or not to workloads meeting a predetermined security threshold. Those with tags are deployed on a common machine while those without tags are deployed on other machines. Tags may be embedded in meta data of open virtual machine formats (OVF). Considerations for re-booting computing devices are also contemplated as are multiplexing workloads. Computer program products are further disclosed.
1. In a virtual computing system environment, a method of securely hosting workloads on computing devices having a hardware platform, comprising:
classifying each of a plurality of workloads according to a predetermined level of security;
attaching a security tag to said each workload meeting a predetermined computing policy threshold set according to the predetermined level of security;
deploying to a first hardware platform only said workloads having said attached security tag and to a second hardware platform only said workloads not having said attached security tag; and
thereafter upon a request to add to said second hardware platform said workloads having said attached security tag, saving to disk the only said workloads not having said attached security tag and thereafter restoring a management domain of the second hardware platform to a pristine state.
2. The method of claim 1 , further including deploying to the second hardware platform the saved to disk workloads not having said attached security tag and the requested to add said workloads having said attached security tag after said restoring a management domain of the second hardware platform to a pristine state.
3. In a computing system environment, a method of securely hosting workloads on computing devices having hardware platforms, comprising:
classifying each of a plurality of computing workloads according to a predetermined level of security;
deploying to common said hardware platforms only said computing workloads having common said classified levels of security; and
thereafter upon a request to add to one of the hardware platforms a workload with a more restrictive level of security, saving to disk any existing workloads of said one of the hardware platforms and restoring a management domain of said one of the hardware platforms to a pristine state.
4. The method of claim 3 , further including deploying to said one of the hardware platforms the saved to disk said any existing workloads and the workload with the more restrictive level of security.
5. A computing system to securely host workloads, comprising:
at least first and second computing devices each with a hardware platform having at least a processor, memory and available storage upon which a plurality of virtual machines are configured under the scheduling control of a hypervisor, wherein the plurality of virtual machines have computing workloads classified according to a predetermined level of security and only said computing workloads meeting said classified predetermined level of security are deployed together on the first computing device while only said computing workloads not meeting said classified predetermined level of security are deployed together on the second computing device;
the system being adapted to save to said available storage said computing workloads not meeting the classified predetermined level of security upon a request to deploy to the second computing device computing workloads classified as meeting said predetermined level of security and restore a management domain of said hardware platform of said second computing device to a pristine state.
6. The system of claim 5 , wherein the only said computing workloads meeting said classified predetermined level of security that are said deployed together on the first computing device further include a security tag.
7. The system of claim 6 , wherein the security tag is embedded in meta data of an open virtual machine format.
8. A computer program product embodied in a non-transitory computer readable medium for loading on a computing device to securely host workloads, the computer program product having executable instructions to ascertain a level of security for each of a plurality of computing workloads of virtual machines, to classify the each of the plurality of computing workloads according to the ascertained level of security, and to deploy to common hardware platforms only said computing workloads having common said levels of security;
the computer program product further having executable instructions to, upon a request to add to one of the hardware platforms a workload classified with a more restrictive level of security than said workloads having common levels of security currently deployed thereon, first save to disk any existing workloads of the one of the hardware platforms and restore a management domain of the one of the hardware platforms to a pristine state.
9. The computer program product of claim 8 , further including executable instructions to reboot hardware platforms if no operating workload exists thereon and said computing workloads are designated for deployment thereto.
10. The computer program product of claim 8 , further including executable instructions to identify potential host computing devices available for the deployment to said common hardware platforms.