Virtual network environment
View Patent ↗A virtual network environment to be used by a set of applications for the express purpose of isolating the applications from other applications on the same node or network is disclosed. The virtual network environment encapsulates a set of applications within a virtual network and prevents applications from interfering, either maliciously or unintentionally, with other applications outside of its virtual network environment. This virtual network environment provides security and network isolation between applications, as is required in a hosted application environment.
1. A method comprising:
defining a global address space identifying a plurality of internet protocol (IP) addresses that are reserved for use in one or more virtual network environments, wherein each virtual network environment includes one or more of the plurality of IP addresses;
assigning a first IP address of the plurality of IP addresses to a first application;
assigning a second IP address of the plurality of IP addresses to a second application; and
if the first application is to be isolated from the second application, including the first IP address in a first virtual network environment and including the second IP address in a second virtual network environment different from the first virtual network environment, wherein the first virtual network environment is transparent to the first application, and wherein the second virtual network environment is transparent to the second application.
2. The method as recited in claim 1 further comprising, if the first application is to be permitted to communicate with the second application, including the first IP address and the second IP address in a same virtual network environment.
3. The method as recited in claim 1 wherein the first IP address is a virtual IP address.
4. The method as recited in claim 1 wherein the first IP address is a physical IP address of a computer on which the first application is executing.
5. The method as recited in claim 1 wherein defining the global address space comprises specifying a global subnet and a global netmask that encompass the plurality of IP addresses.
6. The method as recited in claim 5 wherein the plurality of IP addresses are virtual.
7. The method as recited in claim 5 further comprising associating the global subnet and global netmask with the first application and the second application.
8. The method as recited in claim 7 further comprising associating a first subnet and a first netmask with the first application, the first subnet and the first netmask defining the first virtual network environment.
9. The method as recited in claim 8 wherein the global subnet, the global netmask, the first subnet, and the first netmask are parameters of a process state of the first application.
10. The method as recited in claim 1 further comprising:
the first application initiating a communication to a third IP address; and
if the third IP address is not in the global address space, permitting the communication.
11. The method as recited in claim 10 further comprising, if the third IP address is in the global address space and also within a same virtual network environment as the first IP address, permitting the communication.
12. The method as recited in claim 10 further comprising, if the third IP address is in the global address space and not within a same virtual network environment as the first IP address, preventing the communication.
13. A computer readable medium tangibly storing a plurality of instructions which, when executed:
define a global address space identifying a plurality of internet protocol (IP) addresses that are reserved for use in one or more virtual network environments, wherein each virtual network environment includes one or more of the plurality of IP addresses;
assign a first IP address of the plurality of IP addresses to a first application;
assign a second IP address of the plurality of IP addresses to a second application; and
if the first application is to be isolated from the second application, include the first IP address in a first virtual network environment and include the second IP address in a second virtual network environment different from the first virtual network environment, wherein the first virtual network environment is transparent to the first application, and wherein the second virtual network environment is transparent to the second application.
14. The computer readable medium as recited in claim 13 wherein, if the first application is to be permitted to communicate with the second application, the plurality of instructions, when executed, include the first IP address and the second IP address in a same virtual network environment.
15. The computer readable medium as recited in claim 13 wherein the first IP address is a virtual IP address.
16. The computer readable medium as recited in claim 13 wherein the first IP address is a physical IP address of a computer on which the first application is executing.
17. The computer readable medium as recited in claim 13 wherein defining the global address space comprises specifying a global subnet and a global netmask that encompass the plurality of IP addresses.
18. The computer readable medium as recited in claim 17 wherein the plurality of IP addresses are virtual.
19. The computer readable medium as recited in claim 17 wherein the plurality of instructions, when executed, associate the global subnet and global netmask with the first application and the second application.
20. The computer readable medium as recited in claim 19 wherein the plurality of instructions, when executed, associate a first subnet and a first netmask with the first application, the first subnet and the first netmask defining the first virtual network environment.
21. The computer readable medium as recited in claim 20 wherein the global subnet, the global netmask, the first subnet, and the first netmask are parameters of a process state of the first application.
22. The computer readable medium as recited in claim 13 wherein the plurality of instructions, when executed:
in response to the first application initiating a communication to a third IP address, and
if the third IP address is not in the global address space, permit the communication.
23. The computer readable medium as recited in claim 22 wherein, if the third IP address is in the global address space and also within a same virtual network environment as the first IP address, the plurality of instructions, when executed, permit the communication.
24. The computer readable medium as recited in claim 22 wherein, if the third IP address is in the global address space and not within a same virtual network environment as the first IP address, the plurality of instructions, when executed, prevent the communication.
25. A system comprising a plurality of computers coupled in a network, wherein at least one of the computers comprises a computer readable medium tangibly storing a plurality of instructions which, when executed:
define a global address space identifying a plurality of internet protocol (IP) addresses that are reserved for use in one or more virtual network environments, wherein each virtual network environment includes one or more of the plurality of IP addresses;
assign a first IP address of the plurality of IP addresses to a first application;
assign a second IP address of the plurality of IP addresses to a second application; and
if the first application is to be isolated from the second application, include the first IP address in a first virtual network environment and include the second IP address in a second virtual network environment different from the first virtual network environment, wherein the first virtual network environment is transparent to the first application, and wherein the second virtual network environment is transparent to the second application.
26. The system as recited in claim 25 wherein if the first application is to be permitted to communicate with the second application, the plurality of instructions, when executed include the first IP address and the second IP address in a same virtual network environment.
27. The system as recited in claim 25 wherein the first IP address is a virtual IP address.
28. The system as recited in claim 25 wherein the first IP address is a physical IP address of one of the plurality of computers on which the first application is executing.
29. The system as recited in claim 25 wherein defining the global address space comprises specifying a global subnet and a global netmask that encompass the plurality of IP addresses.
30. The system as recited in claim 29 wherein the plurality of IP addresses are virtual.
31. The system as recited in claim 29 wherein the plurality of instructions, when executed, associate the global subnet and global netmask with the first application and the second application.
32. The system as recited in claim 31 wherein the plurality of instructions, when executed, associate a first subnet and a first netmask with the first application, the first subnet and the first netmask defining the first virtual network environment.
33. The system as recited in claim 32 wherein the global subnet, the global netmask, the first subnet, and the first netmask are parameters of a process state of the first application.
34. The system as recited in claim 25 wherein,
in response to the first application initiating a communication to a third IP address,and;
if the third IP address is not in the global address space, the plurality of instructions, when executed. permit the communication.
35. The system as recited in claim 34 wherein, if the third IP address is in the global address space and also within a same virtual network environment as the first IP address, the plurality of instructions, when executed, permit the communication.
36. The system as recited in claim 34 wherein,if the third IP address is in the global address space and not within a same virtual network environment as the first IP address, the plurality of instructions, when executed, prevent the communication.