Granted Patent B2

US 9,021,556 · App. 12/713,754 · Granted Apr 28, 2015

Inventor: Christopher Youngworth (San Jose, CA)

Assignee: Symantec Corporation

G06F21/74G06F9/45558G06F2009/45587

Abstract

Claims (33)

1. A method for setting up data filtering comprising:

receiving, within an electronic system, an instantiation request for a first virtual device running on a hypervisor;

determining whether said first virtual device and a second virtual device running on the hypervisor are allowed to communicate via a virtual transport bus comprising at least one shared memory queue based on an authorization record datastore;

modifying an authorization record of said authorization record datastore based on respective security levels of said first virtual device and said second virtual device, wherein said modifying comprises setting an indicator of a data filtering module, communicatively coupled to the hypervisor and the at least one shared memory queue, to filter communications between said first virtual device and said second virtual device over the virtual transport bus; and

sending a response to said instantiation request,

wherein said indicator indicates a point of a plurality of points along a data path of the at least one shared memory queue between said first virtual device and said second virtual device at which said data filtering module is to filter the communications between said first virtual device and said second virtual device.

2. The method of claim 1 further comprising caching said authorization record local to said first virtual device.

3. The method of claim 1 wherein said determining is performed by an authorization component operable to interface with a hypervisor and said authorization component is remote from said first virtual device.

4. The method of claim 1 wherein said data filtering module is operable to compress data.

5. The method of claim 1 wherein said data filtering module is operable to encrypt data.

6. The method of claim 1 wherein said data filtering module is operable to audit data.

7. A non-transitory computer readable storage medium having stored thereon, computer executable instructions that, when executed by a computer system cause the computer system to perform a method of providing storage information said method comprising:

receiving an instantiation request for a first virtual device running on a hypervisor;

determining whether said first virtual device and a second virtual device running on the hypervisor are allowed to communicate via a virtual transport bus comprising at least one shared memory queue based on an authorization record datastore;

modifying an authorization record of said authorization record datastore based on respective security levels of said first virtual device and said second virtual device, wherein said modifying comprises setting an indicator of a data filtering module, communicatively coupled to the hypervisor and the at least one shared memory queue, to filter communications between said first virtual device and said second virtual device over the virtual transport bus; and

sending a response to said instantiation request,

wherein said indicator indicates a point of a plurality of points along a data path of the at least one shared memory queue between said first virtual device and said second virtual device at which said data filtering module is to filter the communications between said first virtual machine and said second virtual machine.

8. The non-transitory computer readable storage medium of claim 7 wherein said method further comprises caching said authorization record local to said first virtual device.

9. The non-transitory computer readable storage medium of claim 7 wherein said determining is performed by an authorization component operable to interface with a hypervisor and wherein said authorization component is remote from said first virtual device.

10. The non-transitory computer readable storage medium of claim 7 , wherein said data filtering module is operable to compress data.

11. The non-transitory computer readable storage medium of claim 7 , wherein said data filtering module is operable to encrypt data.

12. The non-transitory computer readable storage medium of claim 7 , wherein said data filtering module is operable to audit data.

13. A storage cluster system, comprising:

a computer system comprising one or more processors coupled to a computer readable storage media and configurable to execute computer readable code stored on the computer readable storage media which causes the computer system to implement a method comprising:

receiving an instantiation request for a first virtual device running on a hypervisor;

determining whether said first virtual device and a second virtual device running on the hypervisor are allowed to communicate via a virtual transport bus comprising at least one shared memory queue based on an authorization record datastore;

modifying an authorization record of said authorization record datastore based on respective security levels of said first virtual device and said second virtual device, wherein said modifying comprises setting an indicator of a data filtering module, communicatively coupled to the hypervisor and the at least one shared memory queue, to filter communications between said first virtual device and said second virtual device over the virtual transport bus; and

sending a response to said instantiation request,

wherein said indicator indicates a point of a plurality of points along a data path of the at least one shared memory queue between said first virtual device and said second virtual device at which said data filtering module is to filter the communications between said first virtual machine and said second virtual machine.

14. The storage cluster system of claim 13 , wherein said method further comprises caching said authorization record local to said first virtual device.

15. The storage cluster system of claim 13 , wherein said determining is performed by an authorization component operable to interface with a hypervisor and said authorization component is remote from said first virtual device.

16. The storage cluster system of claim 13 , wherein said data filtering module is operable to compress data.

17. The storage cluster system of claim 13 , wherein said data filtering module is operable to encrypt data.

Assignments (8)

Continuity (2)