WO2013027923A1

WO2013027923A1 - System for setting up a virtual machine policy, method for setting up a virtual machine policy, and method for providing a virtual machine policy in a cloud computing server system

Info

Publication number: WO2013027923A1
Application number: PCT/KR2012/004052
Authority: WO
Inventors: 전철규; 김종민
Original assignee: (주)케이티
Priority date: 2011-08-24
Filing date: 2012-05-23
Publication date: 2013-02-28
Also published as: KR101408034B1; KR20130022508A

Abstract

The present invention relates to a system for setting up a virtual machine policy, to a method for setting up a virtual machine policy, and to a method for providing a virtual machine policy in a cloud computing server system, which automatically set up the policy to be applied to a relevant virtual machine after the virtual machine is generated in the cloud computing server system that provides, to a client, a virtualized computing environment by means of the virtual machine that uses a virtualized computing resource. According to the present invention, a policy may be set up for a virtual machine automatically rather than manually, and therefore, distribution of the policy for the virtual machine can be efficiently performed when generating or distributing, on a large scale, virtual machines having the sample template.

Description

Virtual machine policy setting system, virtual machine policy setting method, and virtual machine policy provision method of cloud computing server system

The present invention relates to a virtual machine policy setting system, a virtual machine policy setting method, and a virtual machine policy providing method of a cloud computing server system, and more particularly, to a virtualized computing environment through a virtual machine using virtualized computing resources. A virtual machine policy setting system, a virtual machine policy setting method, and a virtual machine policy setting method of a cloud computing server system that automatically sets a policy to be applied to the virtual machine after the virtual machine is created in the cloud computing server system provided to the client. It relates to a method for providing machine policy.

Virtualization technology is a basic technology for implementing a cloud computing environment that must share computing resource pooling and be rapidly created and released by on-demand self service. There is this.

Virtualization technology is a technology that uses a single physical device as if it is multiple devices, maximizes the utilization of computing resources such as CPU, memory, storage, and network, and operates and manages resources for managing large data centers. to be.

As described above, a cloud computing server system implemented through virtualization technology creates a plurality of standalone execution environments, virtual machines using a single physical machine, and operates an independent operating system or application for each virtual machine.

In this case, the virtual machine refers to a virtual computing execution environment created by allocating hardware resources of a physical machine. The policy to apply to the virtual machine instance after the virtual machine instance is created, for example, if the guest OS of the virtual machine is a Windows-based operating system, a security ID, an IP address, and a computer name are applied. However, in the related art, the administrator of the cloud computing server system or a client to use the virtual machine has been implemented to manually set it by manually inputting it (administrator / user direct input method).

Therefore, there is a need for a technique for automatically setting such a policy after the virtual machine is created.

The technical problem to be achieved by the present invention is a virtual machine policy setting system, a virtual machine of the cloud computing server system that automatically sets a policy to be applied to the virtual machine after the virtual machine is created in the cloud computing server system, the virtual machine It is to provide a policy setting method and a virtual machine policy providing method.

Other objects and advantages of the invention will be described below and will be appreciated by the embodiments of the invention. In addition, the objects and advantages of the invention may be realized by the means and combinations indicated in the appended claims.

According to the present invention, after the virtual machine is generated in the cloud computing server system, a policy to be applied to the virtual machine, that is, an IP address or domain information, may be automatically set in the virtual machine. In addition, the policy can be automatically set to the virtual machine rather than manually, so that the process can be efficiently handled in large-scale creation or distribution of the virtual machine of the same template.

The following drawings attached to this specification are illustrative of preferred embodiments of the present invention, and together with the detailed description of the invention to serve to further understand the technical spirit of the present invention, the present invention is a matter described in such drawings It should not be construed as limited to.

1 is a diagram showing the configuration of a cloud computing server system according to an embodiment of the present invention.

2 is a diagram illustrating a process of distributing a policy of a virtual machine in a cloud computing server system according to an exemplary embodiment of the present invention.

3 is a diagram illustrating a specific communication process for setting a policy of a virtual machine between a policy setting agent and a local policy broadcasting server, which are components of a cloud computing server system according to an exemplary embodiment of the present invention.

In order to achieve the above technical problem, the virtual machine policy setting system of the cloud computing server system according to the present invention uses a MAC address of a virtual machine to generate a virtual machine in a local network to which the virtual machine belongs after the virtual machine is created. A policy setting agent that broadcasts a policy request message requesting a policy to apply, receives a response message including a policy to be set in the virtual machine in response to the policy request message, and sets the received policy in the virtual machine; And a policy setting agent located on the local network, receiving a policy request message broadcast by the policy setting agent, acquiring a policy to be set in the virtual machine corresponding to the MAC address based on the MAC address of the received policy request message, and obtaining the policy. It includes a local policy broadcasting server that transmits the response message.

More preferably, the MAC of the query received from the database that is located outside the local network, receives a query for a policy to set in the virtual machine corresponding to the MAC address from the local policy broadcasting server, and stores a policy to be set for each virtual machine The method may further include a policy distribution server for acquiring a policy to be set in the virtual machine corresponding to the address and transmitting the obtained policy to the local policy broadcasting server in response to the received query.

More preferably, the policy may include at least one of a security identifier, an IP address, subnet information, gateway information, domain name system information, a computer name, and information of a domain to which the virtual machine joins.

More preferably, the policy setting agent receives the response message for the policy request message, randomly sets the security identifier of the virtual machine, extracts the IP address and domain information from the response message, and virtualizes the extracted IP address. You can set the IP address of the machine and join the virtual machine to the domain corresponding to the extracted domain information.

In order to achieve the above technical problem, according to the present invention, a method for setting a policy of a virtual machine policy of a policy setting agent mounted on a virtual machine of a cloud computing server system may be performed by using a MAC address of a virtual machine after the virtual machine is generated. Broadcasting a policy request message requesting a policy to be applied to the virtual machine to the local network to which the machine belongs; Receiving a response message including a policy to be set in the virtual machine in response to the policy request message; And setting the received policy in the virtual machine.

More preferably, extracting information of the IP address and domain from the response message; Setting the extracted IP address as an IP address of the virtual machine; And joining the virtual machine to a domain corresponding to the extracted domain information.

In the virtual machine policy providing method of the local policy broadcasting server located in the local network of the virtual machine of the cloud computing server system according to the present invention for achieving the above technical problem, from the policy setting agent mounted on the virtual machine virtual machine Receiving a policy request message broadcast to a local network including a MAC address for requesting a policy to be applied to the network; A policy acquisition step of acquiring a policy to be set in a virtual machine corresponding to the MAC address based on the MAC address of the received policy request message; And sending a response message including the obtained policy to the policy setting agent.

More preferably, the policy acquiring step may include transmitting a query for a policy to be set in the virtual machine corresponding to the MAC address to a policy distribution server located outside the local network; Receiving a response to the query; And acquiring a policy to be set in the virtual machine corresponding to the MAC address through the received response.

The following merely illustrates the principles of the invention. Therefore, those skilled in the art, although not explicitly described or illustrated herein, can embody the principles of the present invention and invent various devices that fall within the spirit and scope of the present invention. Furthermore, all conditional terms and embodiments listed herein are in principle clearly intended for the purpose of understanding the concept of the invention and are not to be limited to the specifically listed embodiments and states. Should be. In addition, it is to be understood that all detailed descriptions, including the principles, aspects, and embodiments of the present invention, as well as listing specific embodiments, are intended to include structural and functional equivalents of these matters. In addition, these equivalents should be understood to include not only equivalents now known, but also equivalents to be developed in the future, that is, all devices invented to perform the same function regardless of structure.

Thus, the functionality of the various elements shown in the figures, including functional blocks represented by a processor or similar concept, can be provided by the use of dedicated hardware as well as hardware capable of executing software in conjunction with appropriate software. When provided by a processor, the functionality may be provided by a single dedicated processor, by a single shared processor, or by a plurality of individual processors, some of which may be shared. In addition, the use of terms presented in terms of processor, control, or similar concept should not be interpreted exclusively as a citation of hardware capable of executing software, and without limitation, ROM for storing digital signal processor (DSP) hardware, software. (ROM), RAM, and non-volatile memory are to be understood to implicitly include. Other well known hardware may also be included.

The above objects, features and advantages will become more apparent from the following detailed description taken in conjunction with the accompanying drawings. In the following description of the present invention, when it is determined that the detailed description of the related known technology may unnecessarily obscure the subject matter of the present invention, the detailed description will be omitted or briefly described.

On the other hand, when a part is said to "include" a certain component, it means that it may further include other components, without excluding other components unless otherwise stated.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a block diagram showing the configuration of a cloud computing server system 100 according to an embodiment of the present invention.

Referring to FIG. 1, the cloud computing server system 100 according to the present embodiment includes a policy setting agent 110, a local policy broadcasting server 120, a policy distribution server 130, and a domain server 140. .

Policy setting agent 110 is a module for setting the policy of the virtual machine is mounted on the virtual machine of the initial state after the virtual machine is created, the policy from the local policy broadcasting server 120 connected to the virtual machine and the local network It is distributed and applied to virtual machine.

Here, the policy of the virtual machine is a state in which only a guest operating system is installed in the virtual machine and no settings necessary for network connection are made, and only information such as the MAC address unique to the virtual machine and the type of operating system can be obtained. In the state, it refers to network address information or domain information necessary for implementing a network connection or other computing environment. For example, when the guest operating system of the virtual machine is a Windows-based operating system, a security ID, an IP address, and a gateway are used. Information, domain name system (DNS) information, computer name, information of domain server to join, and the like.

Local policy broadcasting server 120 is a component that distributes or distributes the policy of the virtual machine connected to the local network, obtains a policy to be applied to the virtual machine belonging to the local network from the policy distribution server 130 of the external network The policy setting agent 110 mounted in the virtual machine is delivered to distribute or distribute the policy of the virtual machine.

The policy distribution server 130 receives a request for a policy to be applied to the virtual machine from the local policy broadcasting server 120, and in response thereto, the policy distribution server 130 receives information about a policy to be applied to the virtual machine. 120).

The domain server 140 is a component that performs domain registration of a virtual machine, where a domain is a logical group sharing a common directory database through a network. The most representative example of the domain server 140 is a Windows-based operating system. There is an Active Directory server, and the virtual machine can access (join) various domains within the domain by joining (joining) its own account (or computer name) to the domain managed by the domain server 140.

In the cloud computing server system according to the present embodiment, a local policy broadcasting server 120 is provided to separate a service network (local network) and a management network, thereby causing the policy setting agent 110 of the virtual machine to be a virtual machine of another user. By not knowing the policy distribution server 130 that manages the policies of the, it was implemented to enhance the security of the cloud computing server system.

In particular, the cloud computing server system according to the present embodiment has a local policy broadcasting server 120 instead of a DHCP server in each local network to distribute the policy to the virtual machine on the local network.

DHCP (Dynamic Host Configuration Protocol) is a communication protocol for automatically allocating and managing configuration information (policy to be applied to a virtual machine in this embodiment) necessary for executing TCP / IP communication. The DHCP server can automatically assign an IP address at the request of a DHCP client and set a lease duration for the assigned IP address.

In general, in setting an IP address for a node or a virtual machine on a local network, a DHCP server is provided in each local network and an IP address is assigned to the node or a virtual machine using the same. In the case of introduction, each DHCP server manages policy information, so the load on the DHCP server increases excessively and the overall efficiency decreases.

In addition, when the policy of the virtual machine is distributed through a DHCP server, there is a problem that a possibility of collision with a DHCP server and DHCP clients on the public network occurs when interworking with a public network outside the local network.

In the cloud computing server system according to the present embodiment, even before the IP address is set, the MAC address of the virtual machine requesting the policy distribution may be transmitted using a broadcasting method, and the IP address may be obtained in response thereto. Focusing on the fact that the local policy broadcasting server 120 receives a broadcasting policy request message on the local network, and centrally, the local policy broadcasting server 120 is applied to the virtual machine. Policy distribution server 130 for providing a policy is provided.

Accordingly, it manages the policies of all virtual machines through the central policy distribution server 130, and the policy setting agent 110 of the virtual machine to obtain the policy information of the virtual machine through broadcasting on the local network. .

The policy setting agent 110, the local policy broadcasting server 120, the policy distribution server 130, and the domain server 140 according to the present embodiment are components installed in a cloud computing server system and include at least one DSP ( It can be implemented in hardware consisting of a digital signal process (processor), a controller, an application specific integrated circuit (ASIC), a programmable logic device such as a field programmable gate array (FPGA), other electronic devices, or a combination thereof. In addition, at least some of the components and functions of the virtual machine management apparatus 130 according to the present embodiment may be implemented in software, and such software may be recorded in a recording medium. In addition, each component and function of the virtual machine control device 130 according to the present embodiment may be implemented by a combination of hardware and software.

The policy setting agent 210, the local policy broadcasting server 220, the policy distribution server 230, and the domain server 240 of the cloud computing server system illustrated in FIG. 2 are the policies of the cloud computing server system illustrated in FIG. 1. It corresponds to the configuration agent 110, local policy broadcasting server 120, policy distribution server 130 and domain server 140, respectively, the distribution process of the virtual machine according to the present embodiment is cloud computing shown in FIG. It can be implemented in a server system. Therefore, the same matters as in the description of the cloud computing server system illustrated in FIG. 1 are referred to this.

First, the manager 250 of the cloud computing server system inputs user information to the policy distribution server 230 and requests that the user create a virtual machine to be used (S201).

According to the request of step S201, the policy distribution server 230 stores user information including a policy to be applied to the user's virtual machine in a local or networked database 235 (S202), and based on the stored user information. In operation S203, the virtual machine is created and its operation is started.

At the same time as the start of the virtual machine in step S203, the policy setting agent 210 mounted in the virtual machine sends a policy request message for requesting a policy to be applied to the virtual machine based on the MAC address of the virtual machine to the local network of the virtual machine. Broadcast (S204).

Local policy broadcasting server 220 connected to the virtual machine and the local network receives the policy request message broadcast in step S204 and delivers it to the policy distribution server 230 (S205).

The policy distribution server 230 searches for a policy to be applied to the virtual machine from the database 235 based on the MAC address of the policy request message in step S205, and in response to the policy request message in step S205, the MAC of the policy request message. The policy to be applied to the virtual machine corresponding to the address is transmitted to the local policy broadcasting server 220 (S206).

In response to the policy request message in step S204, the local policy broadcasting server 220 provides the policy setting agent 210 with information of the policy obtained in step S206.

If the SID (Security ID) is specified in the policy obtained in step S207, the policy setting agent 210 sets it as it is, otherwise, randomly generates the SID (S208).

Then, the policy setting agent 210 obtains an IP address from the policy obtained in step S207 and sets it as an IP address of the virtual machine (S209) to enable communication with the nodes of the external network.

Then, when the policy setting agent 210 can communicate with the nodes of the external network through the IP address setting in step S209, it acquires the computer name or other domain information from the policy obtained in step S207 to the domain of the external network. Apply to join the domain of the virtual machine to the server (S210).

3 is a diagram illustrating a specific communication process for setting a policy of a virtual machine between a policy setting agent and a local policy broadcasting server, which are components of a cloud computing server system according to an exemplary embodiment of the present invention. The embodiment illustrates that each component operates on a Windows-based operating system.

A detailed communication process for setting a policy of the virtual machine according to the present embodiment may be implemented in the cloud computing server system illustrated in FIGS. 1 and 2. Therefore, the same matters as in the description of the cloud computing server system illustrated in FIGS. 1 and 2 are referred to this.

First, when the virtual machine is generated and its operation is started, the policy setting agent 310 mounted on the virtual machine acquires the MAC address of the virtual machine (S301), and obtains the type of the guest operating system of the virtual machine. (S302). In this embodiment, the type of the guest operating system of the virtual machine is obtained in order to apply it differently when the policy is set differently according to the type of the guest operating system.

The policy request message including the MAC address of the virtual machine obtained through the steps S301 to S302 and the type of the operating system is broadcasted (S303).

The local policy broadcasting server 320 connected to the virtual machine and the local network acquires a policy to be applied to the virtual machine according to the policy request message broadcast in step S303, and sets the policy in response to the policy request message. The agent 310 transmits a policy to be applied to the virtual machine (S304).

The policy setting agent 310 generates a system preparation tool (Sysprep.ini) based on the policy received in step S304 (S306), and randomly generates a security identifier (SID) using the system preparation tool generated in step S306. Create (S307) and call the netsh utility to set the IP address, gateway, DNS, and the like.

In this embodiment, Sysprep.ini is generated and used to reset the security identifier (SID). However, this is only one example. In the Windows XP operating system, the newsid utility is called by calling the newsid utility. Can be reset. When resetting the SID by calling a separate utility for changing or resetting the SID, such as Windows XP, the generation of a system preparation tool (Sysprep.ini) may be omitted, and the present invention does not limit the SID setting method.

Then, the netdom utility is called to access the domain server 340 to join the domain (S308), and when all policy settings for the virtual machine are completed, the setting state is transmitted to the local policy broadcasting server 320. (S309).

The invention can also be embodied as computer readable code on a computer readable recording medium. Computer-readable recording media include all kinds of recording devices that store data that can be read by a computer system. Examples of computer-readable recording media include ROM, RAM, CD-ROM, magnetic tape, floppy disks, optical data storage devices, and the like, which are also implemented in the form of carrier waves (for example, transmission over the Internet). Include. The computer readable recording medium can also be distributed over network coupled computer systems so that the computer readable code is stored and executed in a distributed fashion. In addition, functional programs, codes, and code segments for implementing the present invention can be easily inferred by programmers in the art to which the present invention belongs.

Although the present invention has been described with reference to one embodiment shown in the accompanying drawings, it is merely an example, and those skilled in the art may realize various modifications and equivalent other embodiments therefrom. I can understand. Accordingly, the true scope of protection of the invention should be defined only by the appended claims.

Claims

In the virtual machine policy setting system of a cloud computing server system that provides a virtualized computing environment through a virtual machine using virtualized computing resources,

After the virtual machine is created, a policy request message for requesting a policy to be applied to the virtual machine is broadcasted to the local network to which the virtual machine belongs by using the MAC address of the virtual machine, in response to the policy request message. A policy setting agent configured to receive a response message including a policy to be set in a virtual machine and to set the received policy to the virtual machine; And

Located on the local network, receiving a policy request message broadcast by the policy setting agent, acquiring a policy to be set in the virtual machine corresponding to the MAC address based on the MAC address of the received policy request message, and Virtual machine policy setting system comprising a local policy broadcasting server for transmitting a response message containing the obtained policy.
The method of claim 1

The MAC address of the received query from a database located outside the local network, receiving a query for a policy to be set in the virtual machine corresponding to the MAC address from the local policy broadcasting server and storing a policy to be set for each virtual machine. And a policy distribution server for acquiring a policy to be set in the virtual machine corresponding to the and transmitting the obtained policy to the local policy broadcasting server in response to the received query. .
The method of claim 1,

The policy request message includes a virtual machine MAC address and operating system information of the virtual machine policy setting system.
The method of claim 1,

The policy may include at least one of a security identifier of the virtual machine, an IP address, subnet information, gateway information, domain name system information, a computer name, and information of a domain to which the virtual machine joins. Setting system.
The method of claim 1,

The policy setting agent receives a response message for the policy request message, randomly sets a security identifier of the virtual machine, extracts IP address and domain information from the response message, and stores the extracted IP address. And setting the IP address of the virtual machine and joining the virtual machine to a domain corresponding to the extracted domain information.
In the method of setting a virtual machine policy of a policy setting agent mounted on a virtual machine of a cloud computing server system that provides a virtualized computing environment through a virtual machine using virtualized computing resources,

Acquiring the MAC address of the virtual machine after the virtual machine is created;

Broadcasting a policy request message for requesting a policy to be applied to the virtual machine to a local network to which the virtual machine belongs using the obtained MAC address;

Receiving a response message including a policy to be set in the virtual machine in response to the policy request message; And

And setting the received policy in the virtual machine.
The method of claim 6,

Acquiring operating system information of the virtual machine after the virtual machine is generated,

The policy request message includes a virtual machine MAC address and operating system information.
The method of claim 6,

Extracting information of an IP address and a domain from the response message;

Setting the extracted IP address as an IP address of the virtual machine; And

And joining the virtual machine to a domain corresponding to the extracted domain information.
In the virtual machine policy providing method of the local policy broadcasting server located in the local network of the virtual machine of the cloud computing server system providing a virtualized computing environment through the virtual machine using the virtualized computing resources,

Receiving a policy request message broadcast to the local network including a MAC address for requesting a policy to be applied to the virtual machine from a policy setting agent mounted on a virtual machine;

A policy acquisition step of acquiring a policy to be set in a virtual machine corresponding to the MAC address based on the MAC address of the received policy request message; And

And transmitting a response message including the obtained policy to the policy setting agent.
The method of claim 9,

The policy acquisition stage

Transmitting a query for a policy to be set in a virtual machine corresponding to the MAC address to a policy distribution server located outside the local network;

Receiving a response to the query; And

And acquiring a policy to be set in the virtual machine corresponding to the MAC address through the received response.
The method of claim 9,

The policy request message includes the MAC address of the virtual machine and the operating system information.

The policy acquiring step includes acquiring a policy to be set in the virtual machine corresponding to the MAC address based on the MAC address and operating system information of the received policy request message.