Abstract: Systems and methods for allowing one or more users to access a number of tenant systems in a multi-tenant cloud environment are disclosed. The method includes registering a user to the tenant systems based on an identity information received from the user. The same identity information is associated with each of the tenant systems. The method also includes creating an account corresponding to each of the tenant systems for the user. The method further includes allowing the user to access one or more of the tenant systems based on the identity information entered by the user. The user accesses the tenant systems by entering the same identity information. Further, the same identity information is used for identifying the user in each of the tenant systems.

Abstract: Super-user privileges are virtualized by designating a virtual super-user for each of a plurality of virtual processes and intercepting system calls for which actual super-user privileges are required, which are nevertheless desirable for a virtual super-user to perform in the context of his or her own virtual process. In one embodiment, a computer operating system includes multiple virtual processes, such as virtual private servers. Each virtual process can be associated with one or more virtual super-users. When an actual process makes a system call that requires actual super-user privileges, the call is intercepted by a system call wrapper.

Abstract: Multiple virtual processes are each associated with a unique virtual process identifier. For each virtual process, a separate initialization process is started, from which all other processes included in the virtual process originate. The initialization process is associated with the appropriate virtual process identifier. System calls that create new processes are intercepted, and created processes are associated with the virtual process identifier of the appropriate initialization process. Multiple virtual processes are provided on a single, physical computer system.

Abstract: A system and a method dynamically adjusts the quality of service guarantees for virtual servers based upon the resource demands experienced by the virtual servers. Virtual server resource denials are monitored to determine if a virtual server is overloaded based upon the resource denials. Virtual server resources are modified dynamically to respond to the changing resource requirements of each virtual server. Occasionally, a physical host housing a virtual server may not have additional resources to allocate to a virtual server requiring increased resources. In this instance, a virtual server hosted by the overloaded physical host is transferred to another physical host with sufficient resources.

Abstract: A method facilitates providing appropriate quality of service guarantees to a plurality of virtual hosts on a single physical host computer. A server application program and its child processes service communication requests made to the plurality of virtual hosts. Quality of service parameters associated with the virtual hosts are stored. Communication requests made to a specific one of the virtual hosts are detected. The quality of service parameters associated with the specific virtual host are obtained. Operating system resources are utilized to guarantee, to a child process of the server application program, a quality of service according to the obtained quality of service parameters associated with the virtual host. Communication between the virtual host and the client is allowed to proceed, the communication being managed by the child process.

Abstract: A method and system allows a service provider to provide Intranet services remotely by assigning private virtual servers to customers. Each customer addresses transmissions to one or more private virtual servers using private addresses from the customer's private Intranet. The addresses of different private virtual servers do not have to be unique and may overlap. Customers exchange privately-addressed transmissions with the service provider using tunnels to traverse the local or regional network connecting the customer with the service provider. The service provider routes the transmissions to the relevant private virtual server belonging to the customer that sent the transmission. The service provider also routes privately-addressed transmissions back to individual customers using tunnels.

Abstract: Resource requests from a plurality of schedulable entities are scheduled while limiting the maximum and minimum quality of service allocated to each schedulable entity. The resource scheduler of the present invention requires less memory maintain state information than existing rate-controlling schedulers, and is thus more easily scalable to large numbers of users. The resource scheduler also schedules resources fairly among competing schedulable entities. A fair-share scheduling algorithm is used by a resource scheduler to select resource requests to service. A rate controller checks to ensure that servicing the selected request will not cause the associated user's maximum quality of service to be exceeded. If the maximum quality of service will not be exceeded, the virtual time used in the scheduling algorithm is incremented, and the request is serviced. If the maximum quality of service will be exceeded, the virtual time is still incremented, but the request is not serviced and remains pending.

Abstract: File access rates of processes are regulated according to file type. An association table stores entries associating processes to be regulated with specific access rates for various file types. System calls that access files are intercepted, and a system call wrapper executes. The system call wrapper determines the type of file that is being accessed by the process. The system call wrapper examines the association table in order to determine if the calling process is associated with an access rate for the file type being accessed. If so, the system call wrapper regulates access to the file according to the appropriate rate.

Abstract: Communications between network devices on a logical subnet are restricted between devices authorized to communicate with each other, even though other network devices may be present on the subnet. When a network device receives a request to provide it L2 address to a requesting network device, it responds with its L2 address only if the requesting device is authorized to request L2 address. Optionally, a network device only transmits requests for the L2 addresses of other devices if it authorized to do so. The information describing authorized devices maybe store as list of L2 and L3 addresses, which list may be loaded by each network device when starting up. Preferably, authorized devices include routers on the device's logical subnet, to allow the routers to communicate with, and route packets to, the network devices.

Abstract: An I/O multiplexing operation involving a cross-domain file descriptor set is intercepted. The cross-domain set is divided into a first subset corresponding to a first file type and a second subset corresponding to a second file type. System calls are initiated in parallel for performing separate I/O multiplexing operations on the first and second subsets of file descriptors. In response to one of the parallel system calls identifying at least one file descriptor ready for communication, the other parallel system call is unblocked. Sets of file descriptors identified as ready for communication by the parallel system calls are combined and returned to a calling process.

Abstract: A multi-resource system dynamically allocates its resources amongst multiple task streams to provide quality of service guarantees to the task streams. A quality of service manager maintains quality of service requirement information for a plurality of task streams, and requests processing of received tasks. An arbitrator assigns tasks streams and their tasks amongst various servers providing access to resources. The assignment is such that the total quality of service guarantees of the task streams assigned to each server does not exceed the total availability or capacity of the resource. When all assigned tasks for a server are blocked, the server notifies the arbitrator, which transfers an unblocked task to it. When a blocked task unblocks on a server handling a transferred task, the arbitrator transfers back the previously transferred task to its originating server.

Abstract: File systems are created and archived by providing a set of shared storage units and one or more templates, each template including a set of private storage units and a corresponding usage map.

Abstract: File descriptors associated with specific file types are disambiguated from other file descriptors by maintaining and examining an indicator table containing indicators concerning file descriptors associated with a specific, desired file type. System calls that establish a descriptor of the specific, desired type are intercepted, and an indicator concerning the established file descriptor is added to the indicator table. To keep the indicator table current, system calls that make a copy of a file descriptor or that delete a file descriptor are intercepted. If a file descriptor associated with the desired type is copied or deleted, the indicator table is updated. Therefore, the indicator table preferably includes indicators concerning all file descriptors associated with files of the specific desired type. The indicator table is examined to determine whether or not a specific file descriptor is of the desired type.

Abstract: System calls are selectively intercepted by processes. Processes selected to intercept system calls are loaded by a modified loader program which creates an association between the process and a system call wrapper. Pointers in the interrupt vector table to system calls to be intercepted are replaced with pointers to an interception module in operating system address space. When system calls are made, the interception module executes and determines whether the process that made the system call is a selected process, associated with a system call wrapper. If the process is a selected process, the system call wrapper executes. If the process is not a selected process, the system call is made. In one embodiment, system call wrappers execute in the process address space of selected processes. In another embodiment, system call wrappers execute in user address space, but not in the process address space of any specific processes.