Endpoint-hosted hypervisor management

1. An apparatus for endpoint-hosted hypervisor management, comprising:

a processor running a hypervisor-resident, policy-based, virtual management agent in a privileged context, said processor, via said agent, managing at least one host OS from outside said OS, said host OS comprising a virtual machine (VM) running on an underlying hardware-based device;

said processor, via said agent, executing virtual machine management operations for any of provisioning, end-of-life, removable device management, emergency partition, protected process, configuration persistence, multiple VMs, encrypted VMs, or off-line patching;

a client hosted virtual desktop running within said underlying hardware-based device, said client hosted virtual desktop comprising said hypervisor, wherein said hypervisor is configured to support an administrative environment comprising a virtual management appliance, said virtual management appliance comprising said management agent, a virtual relay, and a virtual management platform, said hypervisor also configured to support at least one virtual machine having a respective virtual machine agent; and

a parent relay configured for inspection, wherein said virtual management platform interfaces with said hypervisor to allow inspection of said hardware-based device, and wherein said virtual management platform interfaces with said hypervisor to allow management of hardware-based device.

2. The apparatus of claim 1 , said agent comprising a management layer between said operating system and said hardware-based device.

3. The apparatus of claim 1 , said agent configured to execute a relevance-based computing model, to interact with one or more inspectors, and to implement actions to address systems-management operations.

4. The apparatus of claim 1 , said agent configured to interact with a hypervisor-based virtual data-drive for segregation and management of user-data separate from said hardware device.

5. The apparatus of claim 4 , wherein said data drive is configured for any of separating specific data from said VM, sharing data between a plurality of VMs, storing user and/or application data; and wherein said data drive is configured to be backed up, copied, or moved as a container.

6. The apparatus of claim 4 , wherein said data drive is configured to mount a VM as a file system to collect files left on another VM.

7. The apparatus of claim 1 , wherein said agent interacts with a relay component running in a virtual management layer; and further comprising a networking configuration for said agent and relay functions.

8. The apparatus of claim 7 , wherein said relay component function provides services to a virtual management agent as well as agents residing in guest VMs managed by said virtual management agent.

9. The apparatus of claim 1 , said agent configured as one or more endpoint hypervisors and virtual management agents for dynamic grid computing by way of virtual computing appliances.

10. The apparatus of claim 1 , further comprising:

an emergency VM configured to:

allow user access to said hardware based device if a primary VM is corrupted, infected, or otherwise compromised; and

emulate said hardware hardware based device for ease-of-management and/or ease-of-deployment.

11. The apparatus of claim 1 , further comprising:

a virtual data drive configured to perform any of:

separating specific data from a VM;

sharing data between VMs;

storing user and/or application data;

being backed up, copied, and/or moved as a container; and

mounting a VM as a file system to collect files left on another VM.

12. The apparatus of claim 11 , said virtual data drive comprising:

a user data drive configured to store specific user information separate from a VM;

wherein user data is portable between VMs and hardware based devices.

13. The apparatus of claim 1 , further comprising:

a protected agent configured to control and protect said hardware based devices against tampering;

wherein with said protected agent users are allowed to gain control of said hardware based devices; and

wherein with administrators can disable said protected agent;

wherein said protected agent is configured to allow said virtual machine agent to look inside said VM to ensure that a VM agent is running; and

wherein if said VM agent is not running, the virtual machine agent can take any of the following actions:

report a violation;

pop a message to a VM user;

restrict network access;

stop/pause said VM; and

install/start said agent.

14. The apparatus of claim 13 , further comprising:

a heartbeat for a protected agent, wherein said protected agent is configured to allow said virtual machine agent to monitor a VM agent;

wherein said virtual machine agent is configured to listen on an event channel;

wherein said VM agent repeatedly sends a heartbeat message on said event channel;

wherein if said virtual machine a does not receive a heartbeat message for a predetermined time period, a fixlet becomes relevant that indicates that said VM agent is not working; and

wherein if said virtual machine agent notices that a VM agent is not running in said VM, remediation actions are taken that include any of mounting a CD/USB drive to start or install said VM agent, stopping said VM, and cutting off network access.

15. The apparatus of claim 1 , said hypervisor comprising a plurality of client hypervisor APIs which support a plurality of client hypervisor use cases, wherein said APIs comprise any of:

physical device inspection;

VM inspection, image management;

disk management;

device management;

network management;

introspection; and

snapshot/freeze/rollback.

16. The apparatus of claim 15 , said use cases comprising any of:

VM deployment;

emergency VM;

user data drive;

offline patching;

device management;

protected agent; and

agent with virtual relay.

17. A computer implemented method for endpoint-hosted hypervisor management, comprising:

providing a hypervisor-resident, policy-based, virtual management agent;

running said virtual management agent in a privileged context;

configuring said virtual management agent to manage at least one host OS from outside said OS, wherein said host OS comprises a virtual machine (VM) running on an underlying hardware-based device; and

executing virtual machine management operations for any of provisioning, end-of-life, removable device management, emergency partition, protected process, configuration persistence, multiple VMs, encrypted VMs, or off-line patching:

providing a client hosted virtual desktop running within said underlying hardware-based device, said client hosted virtual desktop comprising said hypervisor, wherein said hypervisor is configured to support an administrative environment comprising a virtual management appliance, said virtual management appliance comprising said management agent, a virtual relay, and a virtual management platform, said hypervisor also configured to support at least one virtual machine having a respective virtual machine agent; and

providing a parent relay configured for inspection, wherein said virtual management platform interfaces with said hypervisor to allow inspection of said hardware-based device, and wherein said virtual management platform interfaces with said hypervisor to allow management of hardware-based device.

18. The method of claim 17 , further comprising the steps of: configuring said hypervisor to provide a plurality of client hypervisor APIs which support a plurality of client hypervisor use cases, wherein said APIs comprise any of:

physical device inspection;

VM inspection, image management;

disk management;

device management;

network management;

introspection; and

snapshot/freeze/rollback.

19. The method of claim 18 , said use cases comprising any of:

VM deployment;

emergency VM;

user data drive;

offline patching;

device management;

protected agent; and

agent with virtual relay.