A system is disclosed that includes components and features for enabling enterprise users to securely access enterprise resources (documents, data, application servers, etc.) using their mobile devices. An enterprise can use some or all components of the system to, for example, securely but flexibly implement a BYOD (bring your own device) policy in which users can run both personal applications and secure enterprise applications on their mobile devices. The system may, for example, implement policies for controlling mobile device accesses to enterprise resources based on device attributes (e.g., what mobile applications are installed), user attributes (e.g., the user's position or department), behavioral attributes, and other criteria. Client-side code installed on the mobile devices may further enhance security by, for example, creating a secure container for locally storing enterprise data, creating a secure execution environment for running enterprise applications, and/or creating secure application tunnels for communicating with the enterprise system.

Secure execution of enterprise applications on mobile devices

A system, method, and computer program product are provided for a touch or pressure signal-based interface. In operation, a touch or pressure signal is received in association with a touch interface of a device. To this end, a user experience is altered utilizing the signal. A system, method, and computer program product are provided for modifying one or more objects in one or more memory devices. In one embodiment, an apparatus is provided, comprising one or more memory devices including a non-volatile memory. Additionally, the apparatus comprises circuitry including a first communication path for communicating with the at least one processor, and a second communication path for communicating with at least one storage sub-system which operates slower than the one or more memory devices. Further, the circuitry is operable to modify one or more objects in the one or more memory devices.

User interface system, method, and computer program product

A source virtual machine (VM) hosted on a source server is migrated to a destination VM on a destination server without first powering down the source VM. After optional pre-copying of the source VM's memory to the destination VM, the source VM is suspended and its non-memory state is transferred to the destination VM; the destination VM is then resumed from the transferred state. The source VM memory is either paged in to the destination VM on demand, or is transferred asynchronously by pre-copying and write-protecting the source VM memory, and then later transferring only the modified pages after the destination VM is resumed. The source and destination servers preferably share common storage, in which the source VM's virtual disk is stored; this avoids the need to transfer the virtual disk contents. Network connectivity is preferably also made transparent to the user by arranging the servers on a common subnet, with virtual network connection addresses generated from a common name space of physical addresses.

Virtual machine migration

Various aspects of the disclosure relate to configuring and providing policies that manage execution of mobile applications. In some embodiments, a user interface may be generated that allows an IT administrator or other operator to set, change and/or add to policy settings. The policy settings can be formatted into a policy file and be made available for download to a mobile device, such as via an application store or to be pushed to the mobile device as part of a data push service. The mobile device, based on the various settings included in the policy file, may perform various actions to enforce the security constraints that are represented by the policy. The various settings that can be included in a policy are numerous and some examples and variations thereof are described in connection with the example embodiments discussed herein.

Configuring and providing profiles that manage execution of mobile applications

Embodiments of the invention include a method performed by a cloud network manager flow entries in a cloud network. The CNM is coupled to virtualized servers for hosting virtual machines (“VM”) that each comprise a virtual switch coupled to a top of rack switch (“TORS”). The CNM receives notification messages that indicate virtual machines have been scheduled for activation on virtualized servers. The CNM determines a VM media access control (“MAC”) address associated with the VM and a virtual switch MAC address associated with that virtualized server's virtual switch. The CNM records an association between the VM MAC address and the virtual switch MAC address. The CNM further determines a label that associates the TORS with the virtual switch. The CNM sends a modifies flow entries in the virtual switch to indicate data packets matching the MPLS label and the VM MAC address should be forwarded to the VM.

Using MPLS for virtual private cloud network isolation in openflow-enabled cloud computing

A method and system for managing direct memory access (DMA) in a computer system without a host input/output memory management unit (IOMMU). The computer system hosts virtual machines and allows memory overcommit. The computer receives, from a guest operating system that runs on a virtual machine, a request for mapping a guest address to a bus address. The computer translates the guest address to a host address and pins a memory page containing the host address to keep the memory page in host memory. The host address is then returned to the guest operating system to allow a device to use the host address as the bus address for direct memory access (DMA) to a buffer managed by the guest operating system.

Memory overcommit by using an emulated IOMMU in a computer system without a host IOMMU

A mechanism for dynamic placement of virtual machines (VMs) during live migration based on memory is disclosed. A method of embodiments of the invention includes determining candidate target host machines capable of receiving a VM to be migrated, obtaining a hash value for memory pages of the VM to be migrated, obtaining for each candidate target host machine hash values for shared memory pages utilized by one or more VMs hosted by the candidate target host machine, comparing for each candidate target host machine the hash values for the memory pages of the VM to be migrated with the hash values for the shared memory pages, and adjusting a score in a general selection algorithm for the candidate target host machine with the most identical matches of the hash values for the shared memory pages with the hash values for the memory pages of the VM to be migrated.

Mechanism for Dynamic Placement of Virtual Machines During Live Migration Based on Memory

A mechanism for memory change tracking during migration of a virtual machine (VM) with VM-controlled assigned peripherals is disclosed. A method of the invention includes interacting with a VM executed by a hypervisor of a origin host machine in order to cause the VM to prevent a state of a peripheral device controlled by the VM from changing, receiving the state of the peripheral device from at least one of the VM, a memory of the VM, or the peripheral device, and transferring the obtained state of the peripheral device to a destination host machine as part of a migration process of the VM.

Mechanism for Memory State Transfer of Virtual Machine-Controlled Peripherals During Migration of the Virtual Machine

A mechanism for delayed hardware upgrades in virtualization systems is disclosed. A method of the invention includes maintaining a delayed hardware upgrade mode that is applicable to one or more virtual machines (VMs) managed by a hypervisor of a host machine, receiving a command to change VM hardware presented to a VM of the one or more VMs, placing the command in a delayed command queue associated with the VM per the delayed hardware upgrade mode maintained by the hypervisor, and executing the command in the delayed command queue when it is determined that the VM has been rebooted, wherein the reboot of the VM is not directly associated with the command.

Mechanism for delayed hardware upgrades in virtualization systems

A system and method for protecting secure data from virtual machine clones are disclosed. In accordance with one embodiment, a hypervisor transmits a message to a guest operating system hosted by a first virtual machine, where the message identifies a memory location for a secure datum. After the transmission of the message, when the hypervisor receives a direct-copy command to clone the first virtual machine, the hypervisor creates a second virtual machine via direct copy, where the second virtual machine is not provided access to the secure memory location during its creation.

Michael Tsirkin

Papers

Memory overcommit by using an emulated IOMMU in a computer system without a host IOMMU

Mechanism for Dynamic Placement of Virtual Machines During Live Migration Based on Memory

Mechanism for Memory State Transfer of Virtual Machine-Controlled Peripherals During Migration of the Virtual Machine

Mechanism for delayed hardware upgrades in virtualization systems

Hypervisor-driven protection of data from virtual machine clones