JP2011070526A - Virtual control computer program, hypervisor program, virtual control computer control method, and virtual computer control method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a virtual control computer program for easily and flexibly controlling communication between a plurality of virtual computers which are executed in virtualized environments, a hypervisor program, a virtual control computer control method, and a virtual computer control method. <P>SOLUTION: The virtual control computer program which makes a computer 10 control other virtual computers 1 to n makes a computer execute a receiving step for receiving a communication request designating the virtual computers 1 to n being transfer destinations from the other computers 1 to n, a determining step for determining whether access to a message contained in the communication request is available based on an access control rule table in which contents of messages and the availability of accesses are associated, and a transmission step for transmitting communication permitted by a determination section to the virtual computers 1 to n being the transfer destinations. <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  The present invention relates to a control virtual machine program, a hypervisor program, a control virtual machine control method, and a virtual machine control method, and in particular, a control virtual machine program, a hypervisor program for controlling a plurality of virtual machines executed in a virtual environment, The present invention relates to a control virtual machine control method and a virtual machine control method.

  In recent years, with the advancement of computer technology such as higher CPU speed, higher storage capacity, and higher network speed, virtualization technology that abstracts hardware has improved hardware utilization and security between OSs. It is widely used for the purpose of efficient management by the ease of duplication and backup.

  The virtualization technology is realized by a small program called a hypervisor such as VMware ESXi (registered trademark), Xen (registered trademark), or Hyper-V (registered trademark) (see, for example, Patent Document 1).

  The hypervisor is characterized in that it enters between a general OS and hardware, and a plurality of OSs are virtually operated on one hardware by virtualizing the functions of the hardware. In the following description, a program such as an OS operating on the hypervisor is referred to as a VM (Virtual Machine).

  When the number of VMs operating on the hypervisor increases, the number of VM groups that do not have a mutual trust relationship increases on the hypervisor. Therefore, access control is required for communication between VMs on the hypervisor. There are generally two types of communication between VMs: inter-VM interrupt and shared memory.

  The inter-VM interrupt is for notifying the occurrence of an event from one VM to the other VM. The inter-VM interrupt notifies the hypervisor of a destination and a message by a hypercall. Hypercall is a generic name for interfaces for VMs for using the functions of the hypervisor. The hypervisor sends a message to the destination VM.

  The shared memory realizes data sharing by sharing a specific memory area between VMs. When a shared memory is used, in a general method, one VM sets a specific memory area so that it can be shared by hypercall, and the other VM similarly sets a memory area that can be shared by hypercall to a shared state.

  In general, communication between VMs generally involves a method in which an event is generated by an inter-VM interrupt, and data is exchanged by a shared memory after the event is correctly processed. For this reason, access control for communication between VMs is often performed for an inter-VM interrupt. For example, the access control of communication between VMs can be a control of rejecting an inter-VM interrupt from a specific VM or permitting only a specific type of message.

  In a general hypervisor, the VM itself can set the ID of another VM that can send an interrupt to itself. However, this setting only controls whether transmission is possible or not based on the VM ID, and cannot control such that only a specific type of message is allowed. When performing control such as permitting only specific types of messages, another mechanism was required.

  In the following, access control of communication between VMs by setting an ID of another VM that can send an interrupt to itself is referred to as simple access control, and consideration is given to control that allows only specific types of messages. This access control is called advanced access control. For example, a hypervisor is known as a place for performing advanced access control.

  Some hypervisors have a function to support advanced access control. For example, Xen (registered trademark), which is an example of a hypervisor, is equipped with a mechanism called XSM (Xen Security Modules), so that a unique advanced access control module can be added to a predefined hook function. Yes. Hereinafter, advanced access control performed by the hypervisor is referred to as hypervisor advanced access control.

JP 2009-26117 A

  However, a function that supports advanced access control is not provided in all hypervisors. Therefore, a hypervisor that does not have a function for supporting advanced access control cannot perform hypervisor advanced access control.

  In particular, in the case of a built-in hypervisor instead of a general PC hypervisor, it is required to operate with the minimum necessary functions due to limitations on calculation capacity and memory capacity. For this reason, functions such as hypervisor advanced access control are often omitted.

  An embodiment of the present invention has been made in view of the above points. A control virtual computer program, a hypervisor program, and a control virtual computer that can easily and flexibly control communication between a plurality of virtual computers executed in a virtual environment. It is an object to provide a computer control method and a virtual computer control method.

  In order to solve the above problems, an embodiment of the present invention is a control virtual computer program that causes a computer to control another virtual computer, and from another virtual computer, a communication request specifying a virtual computer that is a transfer destination is issued. A receiving step for receiving, a determining step for determining whether or not the message included in the received communication request is accessible based on an access control rule table that correlates message contents and accessibility, and the determination unit permits A control virtual machine program that causes a computer to execute a transmission step of transmitting the received communication to the virtual machine that is the transfer destination.

  In addition, what applied the component, the expression, or arbitrary combinations of the component of one Embodiment of this invention to a method, an apparatus, a system, a computer program, a recording medium, a data structure, etc. is also effective as an aspect of this invention. .

  As described above, according to an embodiment of the present invention, communication between a plurality of virtual machines executed in a virtual environment can be controlled easily and flexibly.

It is a block diagram of an example showing the relationship between the software and hardware in a present Example. It is a block diagram of an example of the hardware in a present Example. It is explanatory drawing for demonstrating individual high access control. It is explanatory drawing for demonstrating hypervisor advanced access control. It is explanatory drawing for demonstrating the advanced access control performed by control VM. It is a flowchart of an example showing the procedure of the preparation process. It is explanatory drawing showing the example of the hyper call of a simple access control setting. It is a block diagram of an example of a simple access control setting table. It is explanatory drawing showing the example of the shared memory setting request | requirement to a hypervisor. It is a block diagram of an example of a shared memory setting table. It is explanatory drawing showing the example of the shared memory use request to a hypervisor. It is a flowchart of an example showing the procedure of the access process. It is explanatory drawing showing the example of the interruption transmission request to a hypervisor. It is explanatory drawing showing the example of the message included in interruption. It is explanatory drawing showing the example of the information contained in a message main body. It is explanatory drawing showing the example of the advanced access control setting.

  Next, modes for carrying out the present invention will be described based on the following embodiments with reference to the drawings.

  FIG. 1 is a block diagram showing an example of the relationship between software and hardware in this embodiment. The block diagram of FIG. 1 shows hardware 10, a hypervisor 20 operating on the hardware 10, a control VM 30 operating on the hypervisor 20, and a plurality of VMs (general VMs) 1 operating on the hypervisor 20. ~ N.

  The plurality of VMs 1 to n are VMs (control target VM group) that are targets of simple access control by the hypervisor 20 and advanced access control by the control VM 30. The control VM 30 performs advanced access control for the plurality of VMs 1 to n. Details of the control VM 30 will be described later.

  FIG. 2 is a configuration diagram of an example of hardware in this embodiment. FIG. 2 shows an example in which the hardware 10 is a general computer system such as a PC.

  The computer system of FIG. 2 includes an input device 11, an output device 12, a drive device 13, an auxiliary storage device 14, a main storage device 15, an arithmetic processing device 16, and an interface device 17 that are connected to each other via a bus B.

  The input device 11 is a keyboard or a mouse. The input device 11 is used for inputting various signals. The output device 12 is a display device or the like. The output device 12 is used for displaying various windows and data. The interface device 17 is a modem, a LAN card, or the like. The interface device 17 is used for connecting to a network.

  The hypervisor 20 of this embodiment is at least a part of various programs that control the computer system of FIG. The hypervisor 20 is provided, for example, by distributing the recording medium 18 or downloading from the network. The recording medium 18 on which the hypervisor 20 is recorded is information such as a CD-ROM, a flexible disk, a magneto-optical disk, etc., a recording medium for recording information optically, electrically or magnetically, a ROM, a flash memory, etc. Various types of recording media, such as a semiconductor memory that electrically records data, can be used.

  When the recording medium 18 on which the hypervisor 20 is recorded is set in the drive device 13, the hypervisor 20 is installed from the recording medium 18 to the auxiliary storage device 14 via the drive device 13. The hypervisor 20 downloaded from the network is installed in the auxiliary storage device 14 via the interface device 17.

  The auxiliary storage device 14 stores the installed hypervisor 20 and also stores necessary files, data, and the like. The main storage device 15 reads and stores the hypervisor 20 from the auxiliary storage device 14 when the hypervisor 20 is activated. The arithmetic processing unit 16 implements various processes as described later according to the hypervisor 20 stored in the main storage device 15.

  The place where the advanced access control is performed is performed by the control VM 30 as in this embodiment, and the hypervisor 20 and each of the VMs 1 to n can be considered. Therefore, here, problems of advanced access control performed by each of the VMs 1 to n and hypervisor advanced access control performed by the hypervisor 20 will be described in order to facilitate understanding of the present embodiment. Hereinafter, the advanced access control performed by each of the VMs 1 to n is referred to as individual advanced access control.

  FIG. 3 is an explanatory diagram for explaining individual altitude access control. In FIG. 3, three examples of VMs operating on the hypervisor 20 are shown. 3 includes an interrupt transmission unit 41, a main body processing unit 42, an advanced access control unit 43, an interrupt reception unit 44, a shared memory setting table 45, and an advanced access control setting table 46. The hypervisor 20 includes an interrupt receiver 21, a simple access controller 22, an interrupt transmitter 23, and a simple access control setting table 24. FIG. 3 illustrates the shared memory 47 of VM1 and VM2, and the shared memory 48 of VM2 and VM3.

  Each of the VMs 1 to 3 has an advanced access control unit 43 and an advanced access control setting table 46. Each of the VMs 1 to 3 uses the advanced access control unit 43 and the advanced access control setting table 46 to inspect the inter-VM interrupt transmitted to itself, and the advanced access set in the advanced access control setting table 46 in advance. Perform necessary individual altitude access control based on the control settings.

  However, the individual advanced access control has a problem that, as the number of VMs operating on the hypervisor 20 increases, the number of advanced access control settings to be set increases and management becomes complicated. The complexity of management causes an error in advanced access control settings, which may impair safety.

  FIG. 4 is an explanatory diagram for explaining hypervisor advanced access control. FIG. 4 shows three examples of VMs operating on the hypervisor 20. 4 includes an interrupt transmission unit 41, a main body processing unit 42, an interrupt reception unit 44, and a shared memory setting table 45. The hypervisor 20 includes an interrupt receiving unit 21, a simple access control unit 22, an interrupt transmission unit 23, a simple access control setting table 24, and a hook unit 25. The advanced access control module 50 includes an advanced access control unit 51 and an advanced access control setting table 52. FIG. 4 illustrates the shared memory 47 of VM1 and VM2, and the shared memory 48 of VM2 and VM3.

  The hypervisor 20 can add the advanced access control module 50 by using a hook function defined in the hook unit 25. Unlike the individual advanced access control, the hypervisor advanced access control can easily manage the advanced access control because the advanced access control can be centrally managed by the advanced access control module 50 on the hypervisor 20 side. However, in the hypervisor advanced access control, a function for realizing the advanced access control must be prepared on the hypervisor 20 side. For example, a built-in hypervisor or the like often does not have a function for realizing advanced access control due to limitations in computing capacity and memory capacity.

  FIG. 5 is an explanatory diagram for explaining advanced access control performed by the control VM. FIG. 5 shows three examples of VMs operating on the hypervisor 20. 5 includes an interrupt transmission unit 41, a main body processing unit 42, an interrupt reception unit 44, and a shared memory setting table 45. The hypervisor 20 includes an interrupt reception unit 21, a simple access control unit 22, an interrupt transmission unit 23, and a simple access control setting table 24. The control VM 30 includes an interrupt transmission unit 31, an advanced access control unit 32, an interrupt reception unit 33, and an advanced access control setting table 34. FIG. 5 illustrates the shared memory 47 of VM1 and VM2, and the shared memory 48 of VM2 and VM3.

  In FIG. 5, a control VM 30 is prepared as the only VM that can be accessed by each of the VMs 1 to 3. All communication between the VMs 1 to 3 other than the control VM 30 is sent to the control VM 30 and transferred from the control VM 30 to the target VMs 1 to 3. Since the control VM 30 can perform high-level access control of communication between the VMs 1 to 3, centralized high-level access control by the control VM 30 can be performed without the hypervisor advanced access control. Make mistakes less likely.

  Further, communication between the VMs 1 to 3 that perform advanced access control is an inter-VM interrupt. It is sufficient to perform access control between the VMs 1 to 3 with respect to the inter-VM interrupt, and it is not necessary to perform the access to the shared memory 47 of VM1 and VM2, and the shared memory 48 of VM2 and VM3.

  In general, relatively high overhead occurs in order to perform advanced access control of the shared memory 47 of VM1 and VM2, and the shared memory 48 of VM2 and VM3. However, when performing advanced access control of an inter-VM interrupt, the number of inter-VM interrupts for interrupt transfer is doubled, but the overhead of the inter-VM interrupt itself is sufficiently small, so that a relatively large overhead is unlikely to occur. Therefore, the advanced access control performed by the control VM 30 can efficiently perform the access control between the VMs 1 to 3 with little overhead.

  Further, the inter-VM interrupt between the VMs 1 to 3 has the identifiers of the VMs 1 to 3 that are actual communication destinations in addition to the identifier of the control VM 30 that is the direct transmission destination. Therefore, the control VM 30 can transfer an inter-VM interrupt to each of the VMs 1 to 3 that are actual communication destinations.

  Further, the control VM 30 can perform advanced access control desired by the user in order to prohibit communication from a specific VM (for example, VM1) to a specific VM (for example, VM2) based on a preset advanced access control setting. it can.

  Hereinafter, a processing procedure of simple access control by the hypervisor 20 and advanced access control by the control VM 30 according to the present embodiment will be described. Here, an example of advanced access control by the control VM 30 when there are VM1 and VM2 that perform communication between VMs using an inter-VM interrupt and a shared memory and an interrupt is transmitted from the VM1 to the VM2 will be described.

  FIG. 6 is a flowchart illustrating an example of the preparation process. It is assumed that the hypervisor 20 has been activated in advance. In step S100, the hypervisor 20 activates the control VM 30 according to a predetermined setting file (not shown). Files necessary for starting the control VM 30 are stored in the auxiliary storage device 14 such as a storage. The hypervisor 20 loads a file necessary for starting the control VM 30 from the auxiliary storage device 14 such as a storage and starts it.

  The general hypervisor 20 assigns a unique VM_ID to the activated VM. Unless otherwise set, the activated VM is in a state of not accepting any interrupt and does not share memory with any VM. Here, the VM_ID of the control VM 30 is set to “0”.

  In step S101, the hypervisor 20 activates the VM 1 according to a predetermined setting file. The hypervisor 20 loads a file necessary for starting the VM 1 from the auxiliary storage device 14 and starts it. The activated VM 1 is in a state of not accepting any interrupt, and does not share memory with any VM. Here, VM_ID of VM1 is set to “1”.

  In step S102, the hypervisor 20 activates the VM 2 according to a predetermined setting file. The hypervisor 20 loads a file necessary for starting the VM 2 from the auxiliary storage device 14 and starts it. The activated VM 2 is in a state that does not accept any interrupt, and does not share memory with any VM. Here, the VM_ID of VM2 is “2”.

  In step S103, the VM1 requests the hypervisor 20 to perform a simple access control setting so as to accept an interrupt from the control VM30 (VM_ID = 0). In the general hypervisor 20, each VM itself can set another VM that permits interruption to itself.

  Normally, each VM can specify another VM that is permitted to interrupt itself by notifying the hypervisor 20 of the VM_ID of another VM that is permitted to interrupt itself by hypercall. FIG. 7 is an explanatory diagram showing an example of a hyper call for simple access control setting. In the hyper call for simple access control setting, the VM_ID of the target VM and information on whether or not to receive an interrupt are specified.

  The hypervisor 20 designates “1” which is the VM_ID of the calling VM 1 that made the hyper call, “0” designated as the VM_ID of the target VM in the hyper call, and information as to whether or not to receive an interrupt. Simple access control is set in the simple access control setting table 24 as shown in FIG.

  FIG. 8 is a configuration diagram of an example of the simple access control setting table. The simple access control setting table 24 in FIG. 8 sets whether interrupt is possible or not for each combination of the transmission side VM_ID and the reception side VM_ID. The hypervisor 20 sends the VM_ID of the target VM specified by the hypercall to the sending VM_ID, the VM_ID of the calling VM that made the hypercall to the receiving VM_ID, and whether to receive an interrupt specified by the hypercall Simple access control is set as information on whether or not interrupts are possible.

  In this embodiment, it is assumed that the interrupt settings of all VMs other than the control VM 30 are set so as to permit interrupts from the control VM 30 and not permit interrupts from other than the control VM 30. Thereby, an interrupt between VMs always passes through the control VM 30.

  In step S104, the VM2 requests the hypervisor 20 to set the simple access control so as to accept an interrupt from the control VM30 (VM_ID = 0) as in the case of the VM1. The hypervisor 20 sets the simple access control in the simple access control setting table 24 so that the VM 2 permits an interrupt from the control VM 30 and does not permit an interrupt from other than the control VM 30.

  Proceeding to step S105, the control VM 30 requests the hypervisor 20 to perform simple access control settings so as to accept interrupts from the VM1 and VM2. The hypervisor 20 sets the simple access control in the simple access control setting table 24 so that the control VM 30 permits interrupts from VM1 and VM2 and does not permit interrupts from other than VM1 and VM2.

  In step S106, the VM1 requests the hypervisor 20 to set a specific memory area as a shared memory so that the specific memory area of the VM1 can be shared with the VM2.

  In the general hypervisor 20, a number unique to the VM (memory area number) is assigned to the VM memory area, and the memory area number is designated when the shared memory is designated. The number of the memory area is used as a number for designating the memory area to the hypervisor 20 when another VM actually uses the shared memory.

  Here, it is assumed that the number of the memory area to be set as the shared memory is defined in advance by VM1 and VM2, and is held in the shared memory setting table 45 as mutual memory setting information.

  FIG. 9 is an explanatory diagram showing an example of a shared memory setting request to the hypervisor. In the shared memory setting request, the number of the target memory area and information on whether to share are designated. FIG. 10 is a configuration diagram of an example of a shared memory setting table. The shared memory setting table 45 represents shared memory setting information held by each VM. The shared memory setting information in FIG. 10 represents a list of memory area numbers set as the shared memory of the VM1.

  In step S107, the VM 2 uses the memory area set as the VM 1 shared memory in the hypervisor 20 based on the memory area number set as the VM 1 shared memory set in advance in the shared memory setting table 45. Request to be able to. FIG. 11 is an explanatory diagram showing an example of a shared memory use request to the hypervisor. In the shared memory use request, the VM_ID of the target VM, the number of the target memory area, and information on whether or not to use are specified.

  After the preparation process shown in FIG. 6 is completed, VM1 and VM2 can exchange data via the shared memory. It is assumed that the main body processing unit 42 of the VMs 1 and 2 accesses the shared memory.

  FIG. 12 is a flowchart illustrating an example of the access processing procedure. In step S108, the VM1 requests the hypervisor 20 to interrupt the control VM 30 in order to transmit an interrupt to the VM2.

  The actual interrupt destination of VM1 is VM2, but in order to realize advanced access control by the control VM30, VM1 sets all the interrupt destinations to the control VM30. The VM 1 needs to specify the actual interrupt destination to be notified to the control VM 30 in addition to the normal interrupt destination to be notified to the hypervisor 20 (control VM 30).

  In the general hypervisor 20, a simple message can be added at the time of interruption. Therefore, the VM1 designates the VM_ID of the VM2 that is the actual interrupt destination by using a simple message that can be added at the time of interrupt. FIG. 13 is an explanatory diagram showing an example of an interrupt transmission request to the hypervisor. The interrupt transmission request in FIG. 13 specifies VM_ID of the control VM 30 and a message to be included in the interrupt.

  FIG. 14 is an explanatory diagram showing an example of a message included in an interrupt. In the message included in the interrupt of FIG. 14, the VM_ID of the VM 2 that is the actual interrupt destination and the message body are specified. The message body in FIG. 14 may include various types of information, but it is assumed that information as illustrated in FIG. 15 is included. FIG. 15 is an explanatory diagram showing an example of information included in the message body. The information included in the message body in FIG. 15 specifies a command, argument 1, and argument 2.

  Specifically, the information included in the message body of FIG. 15 requests deletion of a file of a specific path by specifying a command for requesting file deletion, a directory name of the target file, and a target file name. Is. In FIGS. 14 and 15, the message included in the interrupt and the information included in the message body are represented in a table format, but are represented in a visually easy-to-understand manner. The message included in the actual interruption and the information included in the message body are represented by, for example, a character string concatenated with a space.

  In step S109, the hypervisor 20 receives an interrupt transmission request from the VM 1 to the control VM 30, and permits an interrupt from the VM 1 to the control VM 30 based on the simple access control setting held in the simple access control setting table 24. Check if it is. If the interrupt from the VM 1 to the control VM 30 is permitted, the hypervisor 20 proceeds to step S110 and transmits the interrupt from the VM 1 to the control VM 30.

  On the other hand, if the interrupt from the VM 1 to the control VM 30 is not permitted, it is an illegal interrupt transmission request, so the hypervisor 20 proceeds to step S111, returns an error to the VM 1, and terminates abnormally.

  Progressing to step S112 following step S110, the control VM 30 receives an interrupt from the VM 1 from the hypervisor 20. In step S113, the control VM 30 checks whether interruption from VM1 to VM2 is permitted based on the advanced access control setting stored in the advanced access control setting table 34.

  It is assumed that the control VM 30 holds advanced access control settings in the advanced access control setting table 34 in advance. FIG. 16 is an explanatory diagram showing an example of advanced access control setting. The advanced access control setting in FIG. 16 specifies the destination VM, command, argument 1, and argument 2. The control VM 30 determines that the interruption from the VM 1 to the VM 2 is permitted when the information included in the message body shown in FIG. 15 matches the advanced access control setting of FIG. The advanced access control setting in FIG. 16 permits an interruption from VM1 to VM2 when the interruption to VM2 is a request for file deletion for a file under a specific directory specified by argument 1. is there. That is, the control VM 30 refers to the message body shown in FIG. 15 and performs advanced access control based on the advanced access control setting.

  Specifically, the control VM 30 reads a message as illustrated in FIG. 14 included in the interrupt transmitted from the VM 1 and extracts the VM_ID of the VM 2 that is the actual interrupt destination specified in the message. Next, the control VM 30 takes out the message body specified in the message.

  Then, the control VM 30 refers to the extracted message body of FIG. 15 and checks whether an interrupt from VM1 to VM2 is permitted based on the advanced access control setting of FIG. 15 and 16 show an example in which an interrupt from VM1 to VM2 is permitted. Here, an example is shown in which the control VM 30 performs relatively simple advanced access control, but the control VM 30 can also perform more complex advanced access control.

  If the interrupt from VM1 to VM2 is permitted, the control VM 30 proceeds to step S114, reads the message body of FIG. Request an interrupt to a certain VM2.

  On the other hand, if the interrupt from VM1 to VM2 is not permitted, it is an illegal interrupt transmission request, so the control VM30 proceeds to step S115, returns an error to VM1, and terminates abnormally.

  Progressing to step S116 following step S114, the hypervisor 20 receives an interrupt transmission request from the control VM 30 to the VM 2, and from the control VM 30 based on the simple access control setting held in the simple access control setting table 24. Check if interrupt to VM2 is enabled. If the interrupt from the control VM 30 to the VM 2 is permitted, the hypervisor 20 proceeds to step S117 and transmits the interrupt from the control VM 30 to the VM 2.

  On the other hand, if the interrupt from the control VM 30 to the VM 2 is not permitted, it is an illegal interrupt transmission request, so the hypervisor 20 proceeds to step S118, returns an error to the VM 1, and ends abnormally.

  Progressing to step S119 following step S117, the VM 2 receives an interrupt from the control VM 30 from the hypervisor 20 and performs necessary processing. It is assumed that necessary processing is performed by the main body processing unit 42 of the VM 2. The main body processing unit 42 extracts a message included in the interrupt and performs processing according to the content of the message.

  In the case of the message body shown in FIG. 15, the content of the message is a request to delete a file of a specific path. Therefore, the main body processing unit 42 of the VM 2 deletes a file with a specific path. At this time, depending on the content of the message, data may be exchanged via the shared memory 47 shared with the VM 1. The VM 2 receives the interrupt from the control VM 30 from the hypervisor 20, performs necessary processing, and then ends normally.

  As described above, according to the present embodiment, even when the hypervisor 20 does not have the function of advanced access control, by inserting the control VM 30 between the VMs, flexible advanced access control can be performed compared to individual advanced access control. It can be carried out.

  In particular, it is conceivable that the hypervisor 20 used in the embedded field is subjected to only a minimum function and is not equipped with a function such as advanced access control due to limitations on calculation capacity and memory capacity. For this reason, the hypervisor 20 used in the embedded field has a great effect obtained by this embodiment.

  In this embodiment, an inter-VM interrupt is a control target, and it is not necessary to control a shared memory between VMs. Generally, in the communication between VMs, necessary advanced access control can be realized by controlling the interruption between VMs. If the shared memory between VMs is the target of control, memory copy may occur in the communication between VMs in some cases, which may cause a large overhead.

  On the other hand, in the control of the inter-VM interrupt, the number of interrupts is doubled to transfer the interrupt, but the overhead of the inter-VM interrupt itself is sufficiently small, so it does not become a large overhead. In this embodiment, since the inter-VM interrupt is a control target and the shared memory between the VMs is not a control target, overhead can be reduced and necessary advanced access control can be performed.

  As described above, in this embodiment, access control between VMs that becomes complicated when the number of VMs increases in a virtual environment is made efficient. In this embodiment, advanced access control is performed by a single control VM 30 instead of a plurality of VMs, so that advanced access control can be flexibly performed. In this embodiment, advanced access control is performed not by the hypervisor 20, but by the control VM 30, so that advanced access control can be easily performed even when the hypervisor 20 does not have the advanced access control function. According to this embodiment, communication between VMs can be controlled easily and flexibly.

  The present invention is not limited to the specifically disclosed embodiments, and various modifications and changes can be made without departing from the scope of the claims. Note that the control virtual machine program described in the claims corresponds to the hypervisor 20, the control virtual machine corresponds to the control VM 30, and the virtual machines correspond to VM1 to VMn.

1-n VM (general VM)
DESCRIPTION OF SYMBOLS 10 Hardware 11 Input device 12 Output device 13 Drive device 14 Auxiliary storage device 15 Main storage device 16 Arithmetic processing device 17 Interface device 18 Recording medium 20 Hypervisor 21 Interrupt reception unit 22 Simple access control unit 23 Interrupt transmission unit 24 Simple access control Setting table 25 Hook part 30 Control VM
31 Interrupt transmission unit 32 Advanced access control unit 33 Interrupt reception unit 34 Advanced access control setting table 41 Interrupt transmission unit 42 Main body processing unit 43 Advanced access control unit 44 Interrupt reception unit 45 Shared memory setting table 46 Advanced access control setting table 47, 48 Shared memory 50 Advanced access control module 51 Advanced access control unit 52 Advanced access control setting table

Claims (4)

A control virtual machine program that causes a computer to control another virtual machine,
A receiving step for receiving a communication request designating a virtual machine as a transfer destination from another virtual machine;
A determination step of determining whether or not access is possible based on an access control rule table in which the message included in the received communication request is associated with whether or not the message content is accessible; and
A transmission step of transmitting communication permitted by the determination unit to the virtual machine that is the transfer destination;
Control virtual machine program that causes a computer to execute. A control virtual machine execution step of starting the control virtual machine by executing the control virtual machine program of claim 1;
A virtual machine execution step of starting a virtual machine by executing a predetermined virtual machine program;
A monitoring step of monitoring a communication request by the virtual machine or the control virtual machine and permitting only communication between the virtual machine and the control virtual machine;
A hypervisor program that causes a computer to execute. A control virtual computer control method executed by a computer,
The computer is
A receiving step for receiving a communication request designating a virtual machine as a transfer destination from another virtual machine;
A determination step of determining whether or not access is possible based on an access control rule table in which the message included in the received communication request is associated with whether or not the message content is accessible; and
A transmission step of transmitting communication permitted by the determination unit to the virtual machine that is the transfer destination;
Control virtual machine control method to execute. A virtual machine control method executed by a computer,
The computer is
A control virtual machine execution step of starting the control virtual machine by executing the control virtual machine program of claim 1;
A virtual machine execution step of starting a virtual machine by executing a predetermined virtual machine program;
A monitoring step of monitoring a communication request by the virtual machine or the control virtual machine and permitting only communication between the virtual machine and the control virtual machine;
Virtual machine control method for executing.

Images