JP2007323354A - Machine management system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To avoid invalidation of a personal file wall by making it unnecessary to prepare an OS image file to be downloaded at booting a network for every PC hardware configuration to make the start quick. <P>SOLUTION: Hardware configuration is made to look identical by software means by using a virtual machine technology, and an end user is made to use not a PC but a virtual machine so as to make it enough to have one OS image file working on the virtual machine. The OS image file of the virtual machine is held by the PC and when changing the OS image, only the changed sector portion in the OS image is transmitted to the PC. Transmission is made not only from a boot server but also from neighboring PCs. In order not to be changed, the writing to the disk is cached to a hard disk of the PC out of the memory or the image file area. The personal file wall does not operate on the virtual machine which has the possibility of viral infection, but operates on the PC on which the virtual machine operates. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

The present invention relates to a management method for client terminals such as PCs, and in particular, by virtualizing hardware using virtual machine technology, OSs appear to be the same hardware and use the same OS image. The present invention relates to a system for updating an OS image at high speed in an environment capable of doing so.

In the conventional PC booting, the OS on the local disk is booted. For this reason, a hard disk is connected to each PC, and an OS is installed. Application programs and document files edited by end users were also stored on the local disk. For this reason, when an OS or application update or a security patch is required, the update or patch application is required for each PC, which causes an increase in total management cost.

One means for solving this is network boot in which an OS is downloaded from a network and booted. When the PC is activated, an IP address is acquired from the boot server, then the boot loader is downloaded and activated, and the OS body is further downloaded to boot the OS.

There is a personal firewall as a measure against viruses. This is a firewall that runs on the PC used by the end user, and determines whether transmission / reception is possible based on a predetermined rule using the communication partner and packet type of the transmitted packet and received packet. Drop the packet. This prevents the invasion of viruses and prevents the spread of infection to other PCs even if they are infected by a virus.
Yamaguchi, Kawaguchi, Kishi, diskless Windows using VID, Information Processing Vol. 45, No. 3, 2004 Technical Overview of Microsoft Corporation, Windows Server 2003, Automated Deployment Services, August 2003

In the prior art disclosed in Non-Patent Documents 1 and 2, it is necessary to prepare an OS image file to be downloaded for each hardware configuration of the PC. This is because the OS includes a display, a local disk, a network card, a connected device such as a keyboard and a mouse, and different drivers for each model. For this reason, it is necessary to perform update for each image file, such as OS and application update, security patch application, and virus pattern file update. This invention makes it a 1st subject to solve this problem.

In this case, since the entire OS is downloaded, it takes time to start up the PC. In particular, since many PCs start up in a short time at the start of work, the load on both the network and the boot server that transmits the OS image file increases, and the start-up is delayed. This invention makes it a 2nd subject to solve this problem.

On the other hand, regarding the personal firewall, a virus that attacks the personal firewall itself can be considered. When infected with such a virus, the personal file wall is invalidated by stopping the operation of the personal file wall or rewriting the rules for determining whether communication is possible. This invention makes it a 3rd subject to solve this problem.

To solve the first problem, the hardware configuration looks the same in terms of software using virtual machine technology such as VMware and Xen, and end users use virtual machines instead of actual terminals such as PCs. In other words, only one image file of the OS running on the virtual machine is required.

In order to solve the second problem, the OS image file of the virtual machine is held by the PC, and when the OS image is changed, the entire file is not sent to the PC, but there is a change in the OS image. Only the sector portion is transmitted to the PC. Further, the PC image file is not changed, and transmission is not limited to the boot server, but transmission is also performed from a nearby PC. In order not to change, it is only necessary to cache the writing to the disk in the memory or the hard disk of the PC outside the image file area.

In order to solve the third problem, a personal file wall is not operated in a virtual machine that is used by an end user and may be infected with a virus, but is operated on a PC on which the virtual machine operates.

Therefore, the present invention provides the following configuration.
In a machine management system according to the present invention, a client terminal such as a PC including a virtual machine used by an end user, a virtual hard disk drive used by the virtual machine, and a module for updating sectors in the virtual hard disk drive, and the client A system comprising a boot server including a module for sending an old sector compared to the latest virtual hard disk drive among the sectors of the virtual hard disk drive of the terminal, and a network connecting the client terminal and the boot server. And
When the client terminal is activated, the old sector of the virtual hard disk drive is updated by obtaining the latest sector from the boot server, and then the virtual machine used by the end user is activated.

Further, the OS on the virtual machine or the OS of the client terminal caches the write to the virtual hard disk drive in a memory or a hard disk outside the area of the virtual hard disk drive, thereby eliminating the change of the virtual hard disk drive. so,
The latest sector is obtained not from the boot server but from a client terminal close to the network.

Furthermore, the communication packet filtering of the virtual machine is processed on the client terminal instead of the virtual machine.

Even if there are terminals with different hardware configurations, only one OS image file is required by using a virtual machine. Even if there is an OS or application update, security patch application, or virus pattern file update, there is one Only the file needs to be updated, and the update effort can be reduced.

Since only the changed sector is transmitted, even if the boot image file is updated, only the minimum part needs to be downloaded, and the startup time of the PC can be reduced. Furthermore, by transmitting from a nearby PC, the load on the boot server can be reduced, the load on the backbone portion of the network can be reduced, and the startup time of the PC can be further reduced.

Because the personal firewall operates on a PC instead of a virtual machine, even if the OS or application on the virtual machine is infected with a virus that attacks the personal firewall, the PC that is logically operating on another machine The above personal firewall cannot be disabled.

Embodiments of the present invention will be described below with reference to the drawings.
(1) First Embodiment FIG. 1 is a diagram schematically showing the overall configuration of a machine management system according to the present invention. The system includes a network, a client PC 105, and a boot server 106. The network includes a backbone switch 101, a floor switch 102, a server switch 103, and a network cable connecting them.

The backbone switch 101 is a switch that connects a plurality of floor switches 102 and server switches 103. The floor switch 102 is a switch installed for each floor or department, and connects the client PC 105 on the floor or department. The server switch 103 is a switch that connects servers, and connects the boot server 106 and other servers 107. The client PC 105 is a PC (personal computer) used directly by the end user.

The boot server 106 distributes virtual hard disk data to the client PC 105. The server 107 is a server used by the client PC, and corresponds to, for example, a mail server or a file server. Since it is not directly related to the present invention, no further details will be given.

FIG. 2 shows the configuration of the client PC 105.
The drive version number 201 is the version number of the virtual hard disk drive 208 that the client PC 105 has. The entity exists on the hard disk drive 205 connected to the client PC 105.
The drive update module 202 is a module for updating the data of the sector of the virtual hard disk drive 208 that the client PC 105 has.
The drive version number notification module 203 is a module that returns a drive version number 201 in response to a request from another client PC 105 connected to the same floor switch 102.
The virtual sector distribution module 204 is a module for distributing data of sectors constituting the virtual hard disk drive 208 to other client PCs 105 connected to the same floor switch 102.
The hard disk drive 205 is connected to the client PC 105, and the virtual hard disk drive 208 exists in this drive.
An OS (operating system) and application 206 operate on a virtual machine 207 on the client PC 105. The client PC 105 also has an OS 209, but the end user does not use it directly, and uses this OS and application 206.
The virtual machine 207 is provided on the client PC 105. VMware and Xen are examples of virtual machines.
The virtual hard disk drive 208 is a virtual hard disk drive used by the virtual machine 207 and the OS and application 206 operating on it.
The OS 209 is an OS of the client PC 105, and the drive update module 202, the drive version number notification module 203, the virtual sector distribution module 204, and other modules operate. This OS is an OS different from the OS 206 on the virtual machine 207, and the virtual machine 207 operates on this OS.

FIG. 3 shows the configuration of the boot server 106.
The latest drive version number and update required sector number notification module 301 is a module on the boot server 106 that notifies the client PC 105 of the sector number that needs to be updated.
The virtual sector distribution module 302 is a module on the boot server (106) that distributes data of sectors constituting the virtual hard disk drive to the client PC 105.
The distribution virtual sector management table 303 is a table for notifying the client PC 105 of the sector number that needs to be updated.
The distribution virtual sector 304 is the latest sector to be distributed to the client PC 105.
The latest drive version number 305 is the drive version number of the distributed virtual sector (304).

A method of creating the latest sector which is the virtual sector 304 for distribution will be briefly described. A virtual machine is prepared in a PC different from the client PC 105, and the OS and applications are updated using this virtual machine. By comparing the sectors of the virtual hard disk drive before and after the update, the changed sector can be known, and the distribution virtual sector management table 303 can be created.

FIG. 4 shows the configuration of the distribution virtual sector management table 303. The table includes a plurality of records, and each record includes an old drive version number field 401 and an update sector number field 402.
The old drive version number field 401 stores the old drive version number.
The update sector number field 402 is a field for holding the sector number to be updated by the client PC 105 having the version number indicated in the old drive version number field 401. In many cases, this field includes a plurality of sector numbers.

FIG. 5 shows the file I / O mechanism of the OS of the virtual machine 207 and the application 206.
An application 501 is an application used by an end user.
The file system 502 is a file system that is a part of the OS used by the end user. The file system 502 manages file names and sector numbers including the file contents. This sector number is a sector number in the virtual hard disk drive 208.
The sector overlay driver 503 is a sector overlay driver that is part of the OS used by the end user. The data of the sector below the file system 502 and requested to be written from the file system 502 is cached in the memory 505. This cache is never written to the virtual hard disk drive 208. In response to a read request, the corresponding sector data is read from the virtual hard disk drive 208 through the hard disk driver 504 from the memory 505 if there is corresponding sector data on the cache and passed to the file system 502.
The hard disk driver 504 is a driver that manages input / output with the virtual hard disk drive 208.
The memory 505 is a memory used for writing sector cache.
A process 506 indicates a file read / write request that the application 501 requests from the OS.
A process 507 indicates a sector data read / write request that the file system 502 requests the sector overlay drive 503.
A process 508 indicates a read / write request of sector data requested by the sector overlay driver 503 to the virtual hard disk driver 504.
A process 509 indicates writing and reading of sector data to be cached requested by the sector overlay drive 503 to the memory 509.

Hereinafter, the operation when the client PC 105 is activated will be described with reference to FIGS. 6 and 7.
In step 601 of FIG. 6, the OS on the hard disk drive 205 is loaded into the memory and activated. The OS 209 is the activated OS. Subsequently, the drive update module 202, the drive version number notification module 203, and the virtual sector distribution module 204 are activated.

In step 602 in FIG. 6, the drive update module 202 notifies the drive version number 201 to the latest drive version number and the update required sector number notification module 301 of the boot server 106 (step 701 in FIG. 7). Then, the module 301 searches the distribution virtual sector management table 303 for a record having the old drive version number 401 that matches the latest drive version number 305 and the received drive version number 201, and is in the corresponding update sector number field 402. The update required sector number is returned to the client PC 105 (step 702 in FIG. 7). Thus, the client PC 105 can obtain the latest drive version number and the sector number that needs to be updated.

In step 603 of FIG. 6, a client PC 105 connected to the same floor switch 102 is searched for a PC having the latest drive. Specifically, a broadcast message is sent (step 703 in FIG. 7), a list of activated client PCs 105 is created from the returned response (step 704 in FIG. 7), and the drives on each PC in random order. The version number notification module 203 is inquired about the drive version number (steps 705 to 708 in FIG. 7).

If there is a neighboring client PC having the latest drive version number in step 604 of FIG. 6, that PC is set as the sector data acquisition destination, and if not, the boot server 103 is set as the sector data acquisition destination. Subsequently, a necessary sector number is sent to the virtual sector distribution module 204 or 302 of the sector acquisition destination PC (step 709 in FIG. 7), sector data is obtained (step 710 in FIG. 7), and the virtual hard disk drive 208 is updated. In FIG. 7, the drive version number is inquired to neighboring PC1 and neighboring PC2 (steps 705 and 707), and among the returned drive version numbers (steps 706 and 708), neighboring PC2 returns the latest drive version number. (Step 708), the sector is requested from the neighboring PC 2 (step 709), and the sector is obtained (step 710).

In step 605 of FIG. 6, the virtual machine 207 is activated. The virtual machine 207 activates the OS and application 206 from the updated virtual hard disk drive 208.

(2) Second Embodiment FIG. 8 shows the configuration of the client PC 105. Portions that are unnecessary in the first embodiment are further added to the configuration of FIG. Conversely, unnecessary portions are omitted in the second embodiment.

The NIC 211 is a network interface card (NIC), and connects the client PC 105 and the floor switch 102 via a cable.
The packet filtering module 210 monitors a communication packet exchanged between the virtual machine 207 and the NIC 211, and operates on the OS 209 of the client PC 105. When a communication packet is transmitted from the virtual machine 207, a filtering rule is applied, and a packet that does not match the rule is discarded. The same applies to the communication packet for the virtual machine 207.

The filtering rule indicates whether or not communication is possible based on the type of communication packet, the IP address or port number of the communication partner.

(3) Third Embodiment In the first and second embodiments, as shown in FIG. 5, writing to the hard disk is cached by the OS 206 on the virtual machine 207. This caching can also be performed by the client PC 105 instead of the virtual machine 207.

FIG. 9 shows a cache mechanism in the client PC 105, which is almost the same as FIG. Steps 901 to 909 respectively correspond to steps 501 to 509 in FIG. 5, and the only difference is 901, which is a virtual machine 207 corresponding to one application when viewed from the OS 209 of the client PC 105. The operation is the same as in FIG. The memory 905 is the memory of the client PC 105, but it does not have to be a memory and may be outside the area of the virtual hard disk 208 in the hard disk 205.

It is a figure which shows the whole structure of the machine management system of this invention. It is a figure which shows the structure of client PC of 1st embodiment. It is a figure which shows the structure of a boot server. It is a figure which shows the structure of the virtual sector management table for distribution shown in FIG. It is a figure which shows the mechanism of file I / O on a virtual machine. It is a flowchart which shows the boot process of a client PC. It is a figure which shows the boot process of a client PC. It is a figure which shows the structure of client PC of 2nd embodiment. It is a figure which shows the mechanism of the cache in the client PC of 3rd embodiment.

Explanation of symbols

105: Client PC
106: Boot server
202: Drive update module
203: Drive version number notification module
204: Virtual sector distribution module
207: Virtual machine
301: Latest drive number and update required sector number notification module
302: Virtual sector distribution module
303: Virtual sector management table for distribution
304: Virtual sector for distribution
305: Latest drive version number

Claims (3)

A client terminal including a virtual machine used by an end user, a virtual hard disk drive used by the virtual machine, and a module for updating sectors in the virtual hard disk drive;
A boot server including a module for sending an old sector compared to the latest virtual hard disk drive among the sectors of the virtual hard disk drive of the client terminal;
A system comprising a network connecting the client terminal and the boot server,
Machine management characterized in that when the client terminal is started, an old sector of the virtual hard disk drive is updated by obtaining the latest sector from the boot server, and then a virtual machine used by the end user is started. system. In claim 1,
The OS on the virtual machine or the OS of the client terminal caches a write to the virtual hard disk drive in a memory or a hard disk outside the area of the virtual hard disk drive, thereby eliminating the change of the virtual hard disk drive,
A machine management system characterized in that the latest sector is obtained not from the boot server but from a client terminal that is close to the network. In claim 1 or 2,
A machine management system, wherein filtering of communication packets of the virtual machine is processed not on the virtual machine but on the client terminal.

Images