SYSTEM AND METHOD FOR HYPERVISOR-BASED REMEDIATION AND PROVISIONING OF A COMPUTER

• US 20110219234A1
• Filed: 03/08/2011
• Published: 09/08/2011
• Est. Priority Date: 03/08/2010
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: BOGNER, Etay
• Granted Patent: US 9,584,322 B2
• Time in Patent Office: Days
• US Class Current: 713/175
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

A computer located outside of an organizational computing environment is remotely prepared and configured to work in the organizational computing environment. A hypervisor operating system is installed and replaces the primary operating system of the computer, and the primary operating system, virtual software appliances (VSA) and virtual machines (VM) can execute as processes of the hypervisor. The hypervisor is configured to establish secure connection with organizational computing environment and to receive from it organization-configured image software for configuring the compute to work in the organizational computing environment. The secure connection can also be used for remote maintenance of the computer even when the computer operating system is faulty or inactive.

Claims

1. A method comprising:

a virtual software appliance (VSA) executing on a computer embedding a client-side certificate of an organization on said computer to identify said VSA with a known list of certificates, the computer configured so that a hypervisor is the controlling system of said computer, the computer having installed thereon a VSA of the organization;

said computer receiving from computing environment of said organization an organizational image;

a program embedded in said VSA being executed to provide a trusted connection from said computer to said computing environment of said organization.

2. The method of claim 1, wherein said organizational image is received via content distribution networks (CDN).

3. The method of claim 1, wherein said client-side certificate is time limited.

4. The method of claim 1, wherein said client-side certificate is user-specific and purpose-specific.

5. A method comprising:

a virtual software appliance (VSA) executing on a computer embedding a client-side certificate of an organization on said computer to identify said VSA with a known list of certificates, the computer configured so that a hypervisor is the controlling system of said computer, the computer having installed thereon a VSA of the organization;

said computer identifying itself to said organization, receiving from computing environment of said organization encrypted organizational image;

a program embedded in said VSA providing a trusted connection from said computer to said computing environment of said organization;

providing image encryption keys from said organization to said VSA; and

receiving from a user of said computer a passphrase to enable decryption of said organizational image.

6. The method of claim 5 wherein said identifying is by a one-time password

7. The method of claim 5 wherein the providing image encryption keys is preceded by providing of user credentials.

8. The method of claim 5 comprising initiating a secure connection between said VSA and said organizational computing environment.

9. The method of claim 8 wherein said secure connection is maintained according to one of:

at the time of pre-defined events, in a preset interval, and a persistent one.

10. The method of claim 8, wherein said secured connection is used for maintenance of said computer.

11. The method of claim 10, wherein said maintaining comprises one or more of:

installing patches, managing disk snapshots and taking-over said computer.

12. A system comprising:

an organizational computing environment;

a communication network; and

a remote computer, said computer comprising;

processor to execute a virtual software appliance (VSA) for embedding a client-side certificate of an organization on said computer to identify said VSA with a known list of certificates,

memory unit;

input/output unit; and

storage device,

wherein the computer is configured so that a hypervisor is the controlling system of said computer, the computer having installed thereon a virtual software appliance (VSA) of the organization;

said computer to receive from computing environment of said organization organizational image, to execute a program embedded in said VSA to provide a trusted connection from said computer to said computing environment of said organization.

13. The system of claim 12 wherein said input/output unit is to establish secure connection with said organizational computing environment.

14. The system of claim 13, wherein said storage device to store an organizational image received via said secure connection.

15. A non-transitory computer readable medium comprising a set of instructions that when executed by a processor cause a computer executing a hypervisor system to perform a process comprising:

a virtual software appliance (VSA) executing on a computer embedding a client-side certificate of an organization on said computer to identify said VSA with a known list of certificates, the computer configured so that a hypervisor is the controlling system of said computer, the computer having installed thereon a VSA of the organization;

said computer receiving from computing environment of said organization organizational image;

a program embedded in said VSA providing a trusted connection from said computer to said computing environment of said organization.

16. The non-transitory computer readable medium of claim 15, wherein said client-side certificate is time limited.

17. The non-transitory computer readable medium of claim 15, wherein said client-side certificate is user-specific and purpose-specific.

18. The non-transitory computer readable medium of claim 15, wherein said organizational image is received via content distribution networks (CDN).