Market-Based Virtual Machine Allocation

Abstract

A cloud computing system management system including a plurality of computing devices configured to host virtual machine instances, each computing device in the plurality of computing devices including a local agent that continuously evaluates the observed load relative to a utility maximization function. If observed load is higher than a calculated optimal level, individual loading processes are offered for “sale” via a market scheduler. If observed load is lower than a calculated optimal level, then available capacity is offered as a bid via the market scheduler. The market scheduler matches bids with available processes and coordinates the transfer of load from the selling device to the buying device. The offered prices and utility maximization functions can be employed to optimize the performance of the cloud system as a whole.

1 . A cloud computing system, the system comprising:
 an access control device associating a set of immutable values with a set of roles, and further associating each role in the set of roles with a distinct subset of permissions from a set of permissions;   a first resource having configuration information a first associated immutable value, where the first associated immutable value corresponds to an immutable value within the set of immutable values;   a second resource having a second associated immutable value, where the second associated immutable value corresponds to an immutable value within the set of immutable values;   a first virtual machine instance operably coupled to the first resource, wherein an the immutable value associated with the first resource is used to uniquely denotes an identify of the virtual machine instance and is assigned to the first virtual machine instance;   a second virtual machine instance operably coupled to the second resource, wherein the immutable value associated with the second resource is used to uniquely identify the second virtual machine instance;   wherein the first virtual machine instance and the second virtual machine instance are communicably coupled to each other and to the access control device; and   wherein the first virtual machine instance and the second virtual machine instance interoperate only if the permissions associated with the first immutable value and with the second immutable value in the access control device allow the interoperation.   ; and an authentication manager that receives a request including the immutable value from the virtual machine instance for access to the resource, authenticates, based on the identity of the virtual machine instance, the virtual machine instance, determines that the virtual machine instance has successfully authenticated, and provides, based on the determination that the virtual machine instance has successfully authenticated, the configuration information to the virtual machine instance.   
     
     
         2 . The cloud computing system of  claim 1 , wherein the permissions associated with the first immutable value are complementary to the permissions associated with the second immutable value. 
     
     
         3 . The cloud computing system of  claim 1 , wherein one of the first virtual machine and the second virtual machine instance is an operating system-level logical containers, and is not based on a hardware-like interface. 
     
     
         4 . The cloud computing system of  claim 1 , wherein the first virtual machine and the second virtual machine instance are co-located on a single physical computing device. 
     
     
         5 . The cloud computing system of  claim 4 , wherein the interoperation includes access by the first virtual machine to a storage associated with the second virtual machine. 
     
     
         6 . The cloud computing system of  claim 1 , wherein the interoperation includes network access by the first virtual machine a network port associated with the second virtual machine. 
     
     
         7 . The cloud computing system of  claim 1 , wherein the immutable value is a hash value computed based on a pre-prepared instantiation image. 
     
     
         8 . The cloud computing system of  claim 7 , wherein the pre-prepared instantiation image is executable on an emulated hardware interface. 
     
     
         9 . The cloud computing system of  claim 7 , wherein the pre-prepared instantiation image is executable on an operating-system-level interface. 
     
     
         10 . The cloud computing system of  claim 1 , wherein one of the first virtual machine and the second virtual machine instance is a software-defined interface associated with a language-level virtual machine. 
     
     
         11 . The cloud computing system of  claim 7 , wherein the hash value is computed by using SHA-1, SHA-2, or SHA-3. 
     
     
         12 . A method for instantiating and authenticating an identified virtual machine, the method comprising:
 receiving a request to instantiate an identified virtual machine, the virtual machine being identified by a first immutable value, and the virtual machine having an associated virtual machine image;   applying a cryptographic function to the virtual machine image to receive a second immutable value;   if the second immutable value matches an expected value, instantiating the identified virtual machine; and   if the second immutable value does not match the expected value, returning an error.   
     
     
         13 . The method of  claim 12 , wherein the second immutable value is a hash value computed from a virtual machine image used to instantiate the virtual machine instance. 
     
     
         14 . The method of  claim 13 , wherein the hash value is computed by using SHA-1, SHA-2, or SHA-3. 
     
     
         15 . The method of  claim 12 , wherein the first immutable value is a public key, and the second immutable value is a validation result from the process of validating a signature over the virtual machine image by a corresponding private key. 
     
     
         16 . The method of  claim 12 , wherein the first immutable value is a public key, and the second immutable value is decryption result from the process of decrypting the virtual machine image by a corresponding private key. 
     
     
         17 . The method of  claim 12 , further comprising the step of:
 if the second immutable value matches the expected value, assigning access permissions to the instantiated virtual machine.   
     
     
         18 . The method of  claim 12 , wherein the pre-prepared instantiation image is executable on an operating-system-level interface. 
     
     
         19 . The method of  claim 12 , wherein the pre-prepared instantiation image is executable on an emulated hardware interface. 
     
     
         20 . The method of  claim 12 , further comprising:
 assigning a group of identities to a role, the group of identities including the first immutable value; and   
       assigning the virtual machine instance to the role.