IP Library › Granted Patent US 11,704,146
Granted Patent B2
US 11,704,146 · App. 16/906,679 · Granted Jul 18, 2023

Network transparency on virtual machines using socket impersonation

Inventor: Sergio Lopez Pascual (Madrid, ES)
Assignee: Red Hat, Inc.
G06F9/45558H04L69/162G06F2009/45579G06F2009/45591G06F2009/45595H04L67/10
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 11,704,146
App. No.
16/906,679
Granted
Jul 18, 2023
Kind
B2
Abstract

A system includes a hypervisor, a virtual machine (VM), and a host system. The VM includes a kernel and an application and the VM is in communication with the hypervisor. The host system includes a memory and one or more processors, where the one or more processors are in communication with the memory. The host system hosts the VM and the hypervisor. The one or more processors is configured to perform creating, via the kernel, a first socket accessible to the application. A second socket in communication with an endpoint is created at the host system. A virtual communication channel between the hypervisor and the kernel of the VM connects the first socket to the hypervisor. The hypervisor is configured to transmit inputs/outputs (I/Os) received from the application through the virtual channel to the endpoint via the second socket.

Claims (65)

1. A system, comprising:

a hypervisor;

a virtual machine (VM) including a kernel and an application, wherein the VM is in communication with the hypervisor;

a host system including a memory and one or more processors, wherein the one or more processors are in communication with the memory and the host system hosts the VM and the hypervisor; and

wherein the one or more processors is configured to perform:

determining, by the kernel, whether an endpoint, which is requested by the application, exists;

creating, via the kernel, a first socket accessible to the application;

determining, by the kernel, a location of the endpoint;

creating a second socket at the host system in communication with the endpoint;

creating a virtual communication channel between the hypervisor and the kernel of the VM connecting the first socket to the hypervisor; and

configuring the hypervisor, based on the location of the endpoint, to transmit inputs/outputs (I/Os) received from the application through the virtual channel to the endpoint via the second socket.

2. The system of claim 1 , wherein the one or more processors is further configured to perform:

creating, via the kernel, a third socket accessible to the application;

notifying the hypervisor, via the kernel, that the third socket is requesting a connection to the host system;

creating a forth socket at the hypervisor; and

connecting the forth socket to the third socket.

3. The system of claim 1 , wherein the first socket is a network socket.

4. The system of claim 1 , further comprising:

a second VM hosted on the host system; and

wherein the second VM is the endpoint.

5. The system of claim 1 , wherein the one or more processors is further configured to perform:

receiving a packet via the second socket; and

sending the packet to the application via the first socket.

6. The system of claim 1 , wherein the kernel communicates with the hypervisor through a virtual I/O device.

7. The system of claim 1 , wherein the endpoint is one of a plurality of endpoints in communication with the application, and each of the plurality of endpoints is one of located local to the VM, located local to the host, located on another VM residing on the host, or located external to the host.

8. A method, comprising:

determining, by a kernel within a virtual machine (VM), whether an endpoint, which is requested by an application on the VM, exists;

creating, via the kernel a first socket accessible to the application, wherein the VM is hosted by a host system and in communication with a hypervisor;

determining, by the kernel, a location of the endpoint;

creating a second socket at the host system in communication with the endpoint;

creating a virtual communication channel between the hypervisor and the kernel of the VM connecting the first socket to the hypervisor; and

configuring the hypervisor, based on the location of the endpoint, to transmit inputs/outputs (I/Os) received from the application through the virtual channel to the endpoint via the second socket.

9. The method of claim 8 , further comprising:

creating, via the kernel, a third socket accessible to the application;

notifying the hypervisor, via the kernel, that the third socket is requesting a connection to the host system;

creating a forth socket at the hypervisor; and connecting the forth socket to the third socket.

10. The method of claim 8 , wherein the first socket is a network socket.

11. The method of claim 8 , wherein the first socket is an UNIX socket.

12. The method of claim 8 , further comprising:

receiving a packet via the second socket; and

sending the packet to the application via the first socket.

13. The method of claim 8 , wherein the kernel communicates with the hypervisor through a virtual I/O device.

14. A system, comprising:

a hypervisor;

a virtual machine (VM) in communication with the hypervisor using a virtual control plane;

a host system including a memory and one or more processors, wherein the one or more processors are in communication with the memory and the host system hosts the VM and the hypervisor; and

wherein the one or more processors is configured to perform:

determining, by the kernel, whether an endpoint, which is requested by the application, exists;

receiving a notification, via the virtual control plane, that a first socket is available for connection at the virtual machine (VM);

determining, by the kernel, a location of the endpoint;

creating a second socket available for connection at the host system;

creating a virtual socket connection including a first end and a second end, where the first end impersonates the first socket and the second end is located at the hypervisor; and

configuring the hypervisor, using the location of the endpoint, to create a communication chain from the application to the endpoint by transmitting inputs/outputs (I/Os) received via the second end of the virtual socket connection to the second socket such that the application is not aware of any intermediary devices or sockets implemented to create the connection.

15. The system of claim 14 , wherein the virtual control plane is a virtual I/O device connecting the VM to the hypervisor.

16. The system of claim 14 , wherein creating the virtual socket connection comprises:

creating a third socket, wherein the third socket is a virtual socket;

sending a descriptor of the third socket to the VM to reconfigure the first socket from a network socket to a virtual socket;

connecting the third socket to the first socket, wherein the application is unaware the configuration of the first socket has changed.

17. The system of claim 14 , wherein the one or more processors is further configured to perform:

receiving a request for information regarding services available at the host system;

querying the host system for available services;

responding to the request.

18. The system of claim 14 , wherein the first socket is a network socket.

19. The system of claim 14 , wherein the first socket is a UNIX socket.

20. The system of claim 14 , wherein the endpoint is one of a plurality of endpoints in communication with the application, and each of the plurality of endpoints is one of located local to the VM, located local to the host, located on another VM residing on the host, or located external to the host.

Assignments (1)
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Jun 23, 2020
From: PASCUAL, SERGIO LOPEZ
To: RED HAT, INC.
Reel/Frame 053015/0684 →
Continuity (1)
Related Publication 20210397467A1 · Dec 23, 2021
Cited By (1)
US 12,706,760