AUTOMATED PROVISIONING OF VIRTUAL MACHINES

• US 20140019959A1
• Filed: 07/12/2012
• Published: 01/16/2014
• Est. Priority Date: 07/12/2012
• Status: Active Grant

• Current Assignee: Unisys Corporation
• Original Assignee: Unisys Corporation
• Inventors: Dodgson, David S., Farina, Ralph, Fontana, James A., Johnson, Robert A., Maw, David, Narisi, Anthony
• Granted Patent: US 10,248,442 B2
• Time in Patent Office: Days
• US Class Current: 718/1
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 2009/45595 Network integration; Enabling network access in virtual machine instances
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 8/35 model driven
• CPC Class Codes: G06F 9/455 Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/065 for group communications cryptographic mechanisms or cryptographic arrangements for key management involving conference or group key H04L9/0833
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263

Abstract

Virtual machines in a network may be isolated by encrypting transmissions between the virtual machines with keys possessed only by an intended recipient. Within a network, the virtual machines may be logically organized into a number of community-of-interest (COI) groups. Each COI may use an encryption key to secure communications within the COI, such that only other virtual machines in the COI may decrypt the message. Virtual machines may be automatically provisioned with configuration information, such as the encryption keys, when the virtual machine is started. The provisioning information may be created based on a template stored on a configuration server.

Claims

1. A method, comprising:

detecting start-up of a virtual machine;

assigning a community-of-interest to the virtual machine; and

configuring the virtual machine for communications with a virtual gateway in the community-of-interest.

2. The method of claim 1, in which the community-of-interest (COI) is at least one of an application tier COI, a web tier COI, a database COI, and an administrative COI.

3. The method of claim 1, in which the step of assigning the community-of-interest to the virtual machine comprises transmitting a certificate to the virtual machine, in which the certificate includes a community-of-interest key corresponding to the assigned community-of-interest wrapped in the certificate.

4. The method of claim 3, in which the step of transmitting a certificate to the virtual machine comprises transmitting an encryption key, in which the encryption key is encrypted with the community-of-interest key.

5. The method of claim 4, in which the step of transmitting the certificate comprises transmitting the certificate from a jumpbox coupled to the virtual machine.

6. The method of claim 1, in which the step of assigning the community-of-interest comprises copying a template from a configuration server to the virtual machine.

7. The method of claim 1, further comprising assigning a dynamic license to the virtual machine.

8. A computer program product, comprising:

a non-transitory computer readable medium comprising;

code to detect start-up of a virtual machine;

code to assign a community-of-interest to the virtual machine; and

code to configure the virtual machine for communications with a virtual gateway in the community-of-interest.

9. The computer program product of claim 8, in which the community-of-interest (COI) is at least one of an application tier COI, a web tier COI, a database COI, and/or an administrative COI.

10. The computer program product of claim 8, in which the medium further comprises code to transmit a certificate to the virtual machine, in which the certificate includes a community-of-interest key corresponding to the assigned community-of-interest wrapped in the certificate.

11. The computer program product of claim 10, in which the medium further comprises code to transmit an encryption key, in which the encryption key is encrypted with the community-of-interest key.

12. The computer program product of claim 8, in which the medium further comprises code to copy a template from a configuration server to the virtual machine.

13. The computer program product of claim 8, in which the medium further comprises code to assign a dynamic license to the virtual machine.

14. An apparatus, comprising:

a memory;

a network interface; and

a processor coupled to the memory and to the network interface, in which the processor is configured;

to detect start-up of a virtual machine;

to assign a community-of-interest to the virtual machine; and

to configure the virtual machine for communications with a virtual gateway in the community-of-interest.

15. The apparatus of claim 14, in which the community-of-interest (COI) is at least one of an application tier COI, a web tier COI, a database COI, and/or an administrative COI.

16. The apparatus of claim 14, in which the processor is further configured to transmit a certificate to the virtual machine through the network interface, in which the certificate includes a community-of-interest key corresponding to the assigned community-of-interest wrapped in the certificate.

17. The apparatus of claim 16, in which the processor is further configured to transmit an encryption key, in which the encryption key is encrypted with the community-of-interest key.

18. The apparatus of claim 14, in which the processor is further configured to copy a template from a configuration server to the virtual machine.

19. The apparatus of claim 14, in which the processor is further configured to assign a dynamic license to the virtual machine.

20. The apparatus of claim 14, in which the processor is further configured to execute a virtual machine executing software for detecting start-up, assigning the community-of-interest, and configuring the virtual machine.