Managing virtual machine security resources
In a virtualized environment where multiple guest virtual machines receive security services from multiple security virtual machines, a guest virtual machine automatically transitions to a new virtual security machine under various conditions. For example, the guest virtual machine may select a new security virtual machine when connectivity to the current security virtual machine degrades below a predetermined threshold, or in response to a request from the current security virtual machine indicating, e.g., that the current security virtual machine is about to shut down or otherwise terminate security services to the guest virtual machine.
1. A computer program product comprising computer executable code embodied in a non-transitory computer readable medium that, when executing on one or more computing devices, performs the steps of:
executing a security agent on a guest virtual machine in a virtualized computing environment;
managing communications between the guest virtual machine and a first security virtual machine with the security agent, the first security virtual machine providing one or more security services to the guest virtual machine;
measuring a latency of a connection between the first security virtual machine and the guest virtual machine;
when the latency continues to satisfy a predetermined threshold value for latency for more than a predetermined time, randomly selecting a second security virtual machine from among a number of other security virtual machines within the virtualized computing environment having a communication latency above a predetermined threshold for all security virtual machines available in the virtualized computing environment and having a heartbeat indicative of a healthy state; and
transitioning use of the one or more security services by the guest virtual machine from the first security virtual machine to the second security virtual machine.
2. The computer program product of claim 1 wherein the predetermined threshold is a time for the communication latency within a predetermined range of a lowest latency one of the security virtual machines.
3. The computer program product of claim 1 wherein the predetermined threshold is determined based on the communication latency among a top percentile group of the security virtual machines available in the virtualized computing environment.
4. The computer program product of claim 1 wherein the predetermined threshold is determined based on an average communication latency among a top percentile group of the security virtual machines available in the virtualized computing environment.
5. A method comprising:
executing a security agent on a guest virtual machine in a virtualized computing environment;
managing communications between the guest virtual machine and a first security virtual machine, the first security virtual machine providing one or more security services to the guest virtual machine;
detecting a condition affecting performance of the first security virtual machine in providing security services to the guest virtual machine;
in response to the condition indicating a decrease in quality of connectivity to the first security virtual machine by continuing to meet a predetermined threshold for latency for a time exceeding a predetermined duration, selecting a second security virtual machine from among a number of other security virtual machines within the virtualized computing environment having one or more connectivity criteria and having a heartbeat indicative of a healthy state; and
transitioning use of the security services by the guest virtual machine from the first security virtual machine to the second security virtual machine.
6. The method of claim 5 wherein the condition includes a network performance dropping below the predetermined threshold for latency.
7. The method of claim 5 wherein the condition includes a network performance dropping below a predetermined threshold for bandwidth.
8. The method of claim 5 wherein the condition includes a notification that the first security virtual machine will stop providing security services.
9. The method of claim 5 wherein the condition includes a notification that the guest virtual machine will migrate to a different physical machine.
10. The method of claim 5 wherein the one or more security services include file scanning.
11. The method of claim 5 wherein the one or more security services include at least one of malware definition updates for use by the security agent in detecting malware on the guest virtual machine and network monitoring.
12. The method of claim 5 wherein the one or more connectivity criteria include a latency of communications with each of the number of other security virtual machines.
13. The method of claim 5 wherein the one or more connectivity criteria include a bandwidth of communications with each of the number of other security virtual machines.
14. The method of claim 5 wherein the one or more connectivity criteria include a guest machine load for each of the number of other security virtual machines.
15. The method of claim 5 wherein at least one of the other security virtual machines is hosted on a first physical computing device separate from, and connected in a communicating relationship through a physical data network to, a second physical computing device hosting the guest virtual machine.
16. The method of claim 5 wherein the second security virtual machine is hosted on a second physical computing device separate from, and connected in a communicating relationship through a physical data network to, a first physical computing device hosting the guest virtual machine.
17. The method of claim 5 wherein the second security virtual machine is hosted on a second physical computing device separate from, and connected in a communicating relationship through a physical data network to, a first physical computing device hosting the first security virtual machine.
18. The method of claim 5 wherein selecting the second security virtual machine includes randomly selecting a security virtual machine in a lowest latency group.
19. A device comprising:
a computing device including one or more processors; and
a memory bearing computer code configured to execute on the one or more processors to create a virtual computing environment including one or more hypervisors configured to provide the virtual computing environment, a number of guest virtual machines executing in the virtual computing environment, and a group of security virtual machines executing in the virtual computing environment, the computer code further configured to provide security services to one of the number of guest virtual machines by performing the steps of executing a security agent on one of the number of guest virtual machines in the virtualized computing environment, managing communications between the one of the number of guest virtual machines and a first security virtual machine with the security agent, the first security virtual machine providing one or more security services to the one of the number of guest virtual machines, detecting a condition affecting performance of the first security virtual machine in providing security services to the one of the number of guest virtual machines, in response to the condition indicating a decrease in quality of connectivity to the first security virtual machine by continuing to meet a predetermined threshold for latency for a time exceeding a predetermined duration, selecting a second security virtual machine from among a number of other security virtual machines within the virtualized computing environment having one or more connectivity criteria and having a heartbeat indicative of a healthy state, and transitioning use of the security services by the one of the number of guest virtual machines from the first security virtual machine to the second security virtual machine.