Secure Access to a Virtual Machine

• US 20110258441A1
• Filed: 04/20/2010
• Published: 10/20/2011
• Est. Priority Date: 04/20/2010
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Jemiolo, Daniel Everett, Kaplinger, Todd Eric, Shook, Aaron Kyle, Ashok, Rohith Kottamangalam
• Granted Patent: US 9,443,078 B2
• Time in Patent Office: Days
• US Class Current: 713/168
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 2009/45595 Network integration; Enabling network access in virtual machine instances
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

A method for providing secure access to a virtual machine includes dispensing an image corresponding to a virtual machine from a management appliance to a distributed computing system such that the virtual machine is implemented by at least one of a plurality of interconnected physical computing devices in the distributed computing system; establishing a trusted relationship between the management appliance and the virtual machine; and providing a user with access to the virtual machine from the management appliance without further authentication credentials from the user.

Claims

1. A method for providing secure access to a virtual machine, the method comprising:

dispensing an image corresponding to a virtual machine from a management appliance to a distributed computing system such that said virtual machine is implemented by at least one of a plurality of interconnected physical computing devices in said distributed computing system;

establishing a trusted relationship between said management appliance and said virtual machine; and

providing a user with access to said virtual machine from said management appliance without further authentication credentials from said user.

2. The method of claim 1, wherein said trusted relationship is established upon said dispensing said image corresponding to said virtual machine from said management appliance to said distributed computing system.

3. The method of claim 1, wherein said trusted relationship is established in response to said user attempting to access said virtual machine.

4. The method of claim 1, wherein said trusted relationship is set to expire after a predetermined amount of time.

5. The method of claim 1, wherein said trusted relationship is established through public-key cryptography.

6. The method of claim 5, further comprising:

associating a public key with said virtual machine; and

associating a private key with said management appliance.

7. The method of claim 6, further comprising maintaining said private key in a secured storage location accessible to a processor of said management appliance.

8. The method of claim 1, further comprising accessing said virtual machine with said management appliance through one of:

a Secure Shell (SSH) protocol and a File Transfer Protocol (FTP).

9. The method of claim 1, further comprising restricting access to said virtual machine from said management appliance based on credentials provided by said user upon accessing said management appliance.

10. A management appliance, said management appliance comprising:

at least one processor; and

a memory communicatively coupled to said at least one processor, said memory comprising executable code stored thereon such that said at least one processor, upon executing said executable code, is configured to;

dispense an image corresponding to a virtual machine to a distributed computing system comprising a plurality of interconnected computing devices, such that at least one of said computing devices implements said virtual machine;

establish a trusted relationship with said virtual machine; and

provide an authenticated user with access to said virtual machine without further authentication credentials from said user.

11. The management appliance of claim 10, wherein said at least one processor is further configured to establish said trusted relationship upon dispensing said image corresponding to said virtual machine.

12. The management appliance of claim 10, wherein said at least one processor is further configured to establish said trusted relationship in response to said user attempting to access said virtual machine.

13. The management appliance of claim 10, wherein said trusted relationship is set to expire after a predetermined amount of time.

14. The management appliance of claim 10, wherein said at least one processor is further configured to establish said trusted relationship through public-key cryptography.

15. The management appliance of claim 14, wherein said at least one processor is further configured to:

associate a public key with said virtual machine image; and

associate a private key with said management appliance.

16. The management appliance of claim 15, wherein said at least one processor is further configured to maintain said private key in a secured storage location.

17. The management appliance of claim 10, wherein said at least one processor is further configured to access said virtual machine through one of:

a Secure Shell (SSH) protocol and a File Transfer Protocol (FTP).

18. The management appliance of claim 10, wherein said at least one processor is further configured to restrict said user'"'"'s access to said virtual machine based on credentials provided by said user upon accessing said management appliance.

19. A computer program product for providing secure access to a virtual machine on a distributed computing system comprising a plurality of interconnected physical computing systems, said computer program product comprising:

a computer readable storage medium having computer readable code embodied therewith, said computer readable program code comprising;

computer readable program code configured to dispense a virtual machine image from a management appliance to said distributed computing system;

computer readable program code configured to establish a trusted relationship between said management appliance and said virtual machine image; and

computer readable program code configured to provide a user with access to said virtual machine image from said management appliance without further authentication credentials from said user.

20. The computer program product of claim 19, wherein said trusted relationship is established with public-key cryptography, said computer readable program code further comprising:

computer readable program code configured to associate a public key with said virtual machine image; and

computer readable program code configured to associate a private key with said management appliance.