Methods and systems for provisioning a virtual resource in a mixed-use server

• US 10,509,668 B2
• Filed: 04/20/2018
• Issued: 12/17/2019
• Est. Priority Date: 06/25/2014
• Status: Active Grant

• Current Assignee: NetApp, Inc.
• Original Assignee: CloudJumper Corporation
• Inventors: Buck, Charles F., Shivok, Jason A.
• Primary Examiner(s): Nguyen, Phillip H
• Application Number:
  US15/958,918
• Publication Number:
  US 20180239630A1
• Time in Patent Office: 606 Days
• CPC Class Codes: G06F 2009/45562 Creating, deleting, cloning virtual machine instances
• CPC Class Codes: G06F 2009/4557 Distribution of virtual machine instances; Migration and load balancing
• CPC Class Codes: G06F 2009/45595 Network integration; Enabling network access in virtual machine instances
• CPC Class Codes: G06F 9/45533 Hypervisors; Virtual machine monitors
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: G06F 9/5072 Grid computing
• CPC Class Codes: G06F 9/5077 Logical partitioning of resources; Management or configuration of virtualized resources specific details on emulation or internal functioning of virtual machines G06F9/455
• CPC Class Codes: G06F 9/52 Program synchronisation; Mutual exclusion, e.g. by means of semaphores
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231

Abstract

A method for provisioning a virtualized resource includes directing, by a provisioning machine, a server-executed hypervisor to provision a virtual machine. The provisioning machine directs generation of an organizational unit within a first organizational unit within a multi-tenant directory service separated from a second organizational unit in the multi-tenant directory service by a firewall. The provisioning machine associates the virtual machine with the first organizational unit. The provisioning machine establishes a firewall policy on the virtual machine restricting communications to the virtual machine and excluding a user associated with the second organizational unit. The provisioning machine receives a request to provision a virtualized resource for at least one user. The server establishes a connection between a client machine of the at least one user and the at least one virtual machine providing the at least one virtual resource.

Claims

1. A method for provisioning a virtualized resource in a mixed-use virtualization environment, the method comprising:

directing, by a provisioning machine, a hypervisor executing on a server, to provision a virtual machine on the server;

directing, by the provisioning machine, a directory service management component executing on a directory server to generate a first organizational unit within a multi-tenant directory service associated with a first entity and separated from a second organizational unity in the multi-tenant directory service by a firewall;

associating, by the provisioning machine, the virtual machine with the first organizational unit;

directing, by the provisioning machine, the directory service management component to establish a firewall policy preventing a user authorized to access the second organizational unit in the multi-tenant directory service from accessing the first organizational unit, the second organizational unit associated with a second entity, wherein establishing the firewall policy further comprises;

modifying, by the directory service management component, a policy object defining at least one attribute of the first organizational unity to include the firewall policy;

receiving, by the provisioning machine, from a management component, a request to provision a virtualized resource for at least one user within an organization, the request received after the provisioning of the virtual machine and generation of the first organizational unit; and

establishing, by the server, a connection between a client machine of the at least one user and the at least one virtual machine providing the at least one virtual resource.

2. The method of claim 1, wherein directing generation of the first organizational unit further comprises directing the directory service management component to instruct the directory server to generate the first organizational unit.

3. The method of claim 2 further comprising transmitting, by the directory service management component, an instruction to generate the first organizational unit via an application programming interface (API) to the directory server.

4. The method of claim 1, wherein associating further comprises directing the directory service to modify data associated with the first organizational unit to include an identification of the virtual machine.

5. The method of claim 1 further comprising marking the virtual machine as available for hosting a virtualized resource.

6. The method of claim 1, wherein receiving further comprises receiving an indication that the virtualized resource is to execute on a virtual machine dedicated to a single user.

7. The method of claim 1, wherein receiving further comprises receiving an indication of a type of the virtualized resource.

8. The method of claim 1, wherein receiving further comprises receiving a username associated with the at least one user.

9. The method of claim 1 further comprising generating a resource username associated with the username for use when accessing the virtualized resource.