Method and system for software application deployment

• US 10,193,879 B1
• Filed: 05/06/2015
• Issued: 01/29/2019
• Est. Priority Date: 05/07/2014
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Rodgers, Robert Stephen, Eatherton, William Norman, Beesley, Michael John, Dyckerhoff, Stefan Alexander, Lacroute, Philippe Gilbert, Swierk, Edward Ronald, Geraghty, Neil Vincent, Holleman, Keith Eric, Giuli, Thomas John, Rajagopal, Srivatsan, Fraley, Paul Edward, Tapaskar, Vijay Krishnaji, Selifonov, Daniel Sergeevich, Low, Keith Anthony
• Primary Examiner(s): Hirl, Joseph P
• Assistant Examiner(s): Shirazi, Sayed Aresh Beheshti
• Application Number:
  US14/705,847
• Time in Patent Office: 1,364 Days
• CPC Class Codes: G06F 12/0811 with multilevel cache hierarchies
• CPC Class Codes: G06F 12/0824 Distributed directories, e.g. linked lists of caches
• CPC Class Codes: G06F 16/196 Specific adaptations of the file system to access devices and non-file objects via standard file system access operations, e.g. pseudo file systems dedicated interfaces to storage systems G06F3/0601
• CPC Class Codes: G06F 16/84 Mapping; Conversion
• CPC Class Codes: G06F 16/9566 URL specific, e.g. using aliases, detecting broken or misspelled links
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2212/283 Plural cache memories
• CPC Class Codes: G06F 9/45533 Hypervisors; Virtual machine monitors
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: H04L 45/50 using label swapping, e.g. multi-protocol label switch [MPLS]
• CPC Class Codes: H04L 47/70 Admission control; Resource allocation
• CPC Class Codes: H04L 61/103 across network layers, e.g. resolution of network layer into physical layer addresses or address resolution protocol [ARP]
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 61/5007 Internet protocol [IP] addresses
• CPC Class Codes: H04L 61/5014 using dynamic host configuration protocol [DHCP] or bootstrap protocol [BOOTP]
• CPC Class Codes: H04L 61/59 using proxies for addressing
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/0428 : wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0457 : wherein the sending and receiving network entities apply dynamic encryption, e.g. stream encryption cryptographic mechanisms or cryptographic arrangements for stream encryption H04L9/065
• CPC Class Codes: H04L 63/061 : for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/0823 : using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0838 : using one-time-passwords
• CPC Class Codes: H04L 63/0876 : based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/0884 : by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 63/1466 : Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 63/168 : above the transport layer
• CPC Class Codes: H04L 67/02 : based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/10 : in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/51 : Discovery or management thereof, e.g. service location protocol [SLP] or web services
• CPC Class Codes: H04L 67/56 : Provisioning of proxy services store-and-forward switching systems in data switching networks H04L12/54
• CPC Class Codes: H04L 9/30 : Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy

Abstract

A method and system for deploying applications. The method includes deploying an application image of an application to a computing device, where the application is accessible using a first uniform resource locator (URL). The method also includes sending an application creation message to an authoritative domain name system (DNS) server to create a record mapping the first URL to a second URL. The first URL is in a first domain and the second URL is in a second domain. The method further includes providing, to the computing device, a digital certificate associated with the application. The method further includes generating certificate data using the digital certificate and sending, to a remote application server, the second URL and certificate data. A client software module may establish a connection to the application on the computing device using the second URL and the certificate data.

Claims

1. A method for deploying applications, the method comprising:

deploying an application from an application image in an application virtual machine of a computing device, wherein the application is accessible using a first uniform resource locator (URL);

sending an application creation message to an authoritative domain name system (DNS) server to create a record mapping the first URL to a second URL, wherein the first URL is in a first domain and the second URL is in a second domain;

providing, to a service virtual machine (SVM) of the computing device, a digital certificate associated with the application virtual machine, wherein the service virtual machine is configured to store the digital certificate isolated from and inaccessible by the application virtual machine, and wherein the service virtual machine is separate from a certificate authority that issues the digital certificate;

generating, by the service virtual machine and in response to one or more applications requesting communication based on the digital certificate, certificate data using the digital certificate; and

sending, to a remote application server comprising a client software module, the second URL and the certificate data,

wherein the client software module is configured to establish a connection to the application on the computing device using the second URL and the certificate data.

2. The method of claim 1, further comprising:

receiving the application image from the remote application server.

3. The method of claim 1, wherein deploying the application comprises:

providing the application image to the computing device; and

instructing the computing device to load the application image in the application virtual machine.

4. The method of claim 1, wherein the first URL is in a secure computing platform domain, wherein the authoritative DNS server is an authoritative DNS server for the secure computing platform domain, wherein the second URL is in an enterprise domain, and wherein the application is executing within the enterprise domain.

5. The method of claim 1, wherein the first URL is in an application provider domain, wherein the authoritative DNS server is an authoritative DNS server for the application provider domain, wherein the second URL is in an enterprise domain, and wherein the application is executing within the enterprise domain.

6. The method of claim 1, further comprising:

prior to deploying the application, verifying an integrity of the computing device.

7. The method of claim 6, wherein verifying the integrity of the computing device comprises receiving at least one integrity measurement for the computing device.

8. The method of claim 1, wherein the digital certificate conforms to the X.509 standard.

9. The method of claim 1, wherein generating the certificate data using the digital certificate comprises hashing the digital certificate.

10. A non-transitory computer readable medium comprising computer readable program code executed by a computer processor to perform the steps of:

deploying an application from an application image in an application virtual machine of a computing device, wherein the application is accessible using a first uniform resource locator (URL)

sending an application creation message to an authoritative domain name system (DNS) server to create a record mapping the first URL to a second URL, wherein the first URL is in a first domain and the second URL is in a second domain;

providing, to a service virtual machine (SVM) of the computing device, a digital certificate associated with the application virtual machine, wherein the service virtual machine is configured to store the digital certificate isolated from and inaccessible by the application, and wherein the service virtual machine is separate from a certificate authority that issues the digital certificate;

generating, by the service virtual machine and in response to one or more applications requesting communication based on the digital certificate, certificate data using the digital certificate; and

sending, to a remote application server comprising a client software module, the second URL and the certificate data,

wherein the client software module is configured to establish a connection to the application on the computing device using the second URL and the certificate data.

11. The non-transitory computer readable medium of claim 10, further comprising computer readable program code executed by a computer processor to perform the step of:

receiving the application image from the remote application server.

12. The non-transitory computer readable medium of claim 10, wherein deploying the application comprises:

providing the application image to the computing device; and

instructing the computing device to load the application image in the application virtual machine.

13. The non-transitory computer readable medium of claim 10, wherein the first URL is in a secure computing platform domain, wherein the authoritative DNS server is an authoritative DNS server for the secure computing platform domain, wherein the second URL is in an enterprise domain, and wherein the application is executing within the enterprise domain.

14. The non-transitory computer readable medium of claim 10, wherein the first URL is in an application provider domain, wherein the authoritative DNS server is an authoritative DNS server for the application provider domain, wherein the second URL is in an enterprise domain, and wherein the application is executing within the enterprise domain.

15. The non-transitory computer readable medium of claim 10, further comprising computer readable program code executed by a computer processor to perform the step of:

prior to deploying the application, verifying an integrity of the computing device.

16. The non-transitory computer readable medium of claim 15, wherein verifying the integrity of the computing device comprises receiving at least one integrity measurement for the computing device.

17. The non-transitory computer readable medium of claim 10, wherein the digital certificate conforms to the X.509 standard.

18. The non-transitory computer readable medium of claim 10, wherein generating the certificate data using the digital certificate comprising hashing the digital certificate.

19. A method for deploying applications, the method comprising:

deploying an application image in an application virtual machine of a computing device, wherein the application virtual machine is accessible using a uniform resource locator (URL);

sending an application creation message to an authoritative domain name system (DNS) server to create a record mapping the URL to an Internet Protocol (IP) address associated with the computing device, wherein the URL is in a domain and the authoritative DNS is not the authoritative DNS server for the domain;

providing, to a service virtual machine (SVM) of the computing device, a digital certificate associated with the application virtual machine, wherein the service virtual machine is configured to store the digital certificate isolated from and inaccessible by the application virtual machine, and wherein the service virtual machine is separate from a certificate authority that issues the digital certificate;

generating, by the service virtual machine and in response to one or more applications requesting communication based on the digital certificate, certificate data using the digital certificate; and

sending, to a remote application server comprising a client software module, the URL and the certificate data,

wherein the client software module is configured to establish a connection to an application in the application virtual machine on the computing device using the URL and the certificate data.

20. The method of claim 19, wherein the certificate data comprises one selected from a group consisting of a hash value of the digital certificate, a hash value of a public key in the digital certificate, and the public key.