MECHANISM FOR PROVIDING EXTERNAL ACCESS TO A SECURED NETWORKED VIRTUALIZATION ENVIRONMENT

• US 20150326531A1
• Filed: 05/08/2015
• Published: 11/12/2015
• Est. Priority Date: 05/09/2014
• Status: Active Grant

• Current Assignee: Nutanix Incorporated
• Original Assignee: Nutanix Incorporated
• Inventors: KAHLON, Vineet, CUI, Miao, JAIN, Kshitiz
• Granted Patent: US 10,542,049 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 2009/45595 Network integration; Enabling network access in virtual machine instances
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

A method for providing external access into a secured networked virtualization environment, includes performing a leadership election amongst nodes of the secured networked virtualization environment to elect a leader node, assigning a cluster virtual IP address to the leader node and generating a reverse tunnel, using a processor, by the leader node to allow for an external entity to communicate with the secured networked virtualization environment.

Claims

1. A method for providing external access into a secured networked virtualization environment, comprising:

performing a leadership election amongst nodes of the secured networked virtualization environment to elect a leader node;

assigning a cluster virtual IP address to the leader node; and

generating a reverse tunnel, using a processor, by the leader node to allow for an external entity to communicate with the secured networked virtualization environment.

2. The method of claim 1, wherein performing the leadership election, comprises:

receiving heartbeat responses for nodes of the secured networked virtualization environment;

forming a queue with nodes that provide heartbeat responses, wherein the nodes that provide heartbeat responses are placed in the queue in an order that the nodes provide their heartbeat responses; and

electing a first node in the queue as the leader node.

3. The method of claim 2, wherein a node located in the queue that subsequently fails to provide a heartbeat response is removed from the queue.

4. The method of claim 2, wherein a node not located in the queue that subsequently provides a heartbeat response is placed in an appropriate position in the queue.

5. The method of claim 1, wherein each node of the secured networked virtualization environment has a private IP address and internal communication amongst the nodes of the secured networked virtualization environment is made through private IP addresses.

6. The method of claim 1, wherein generating the reverse tunnel comprises:

identifying, by the leader node, a port number at the external entity through which the external entity communicates with the leader node.

7. The method of claim 6, wherein the port number is a statically determined port number.

8. The method of claim 6, wherein the port number is a dynamically determined port number.

9. The method of claim 8, wherein the dynamically determined port number is determined by:

requesting the external entity for an available port number;

receiving the available port number from the external entity; and

utilizing the available port number as the port number at the external entity through which the external entity communicates with the leader node.

10. The method of claim 6, wherein the port number at the external entity through which the external entity communicates with the leader node is associated with the secured networked virtualization environment.

11. The method of claim 6, wherein generating the reverse tunnel comprises performing a secured shell (SSH) command using the port number, the cluster virtual IP address and a public SSH key for the external entity.

12. The method of claim 1, further comprising:

identifying failure of the leader node;

performing the leadership election amongst nodes of the secured networked virtualization environment to elect a new leader node;

assigning the cluster virtual IP address to the new leader node; and

generating another reverse tunnel by the new leader node to allow for the external entity to communicate with the secured networked virtualization environment.

13. The method of claim 1, wherein the external entity is chosen by iterating over a list of external entities associated with the secured networked virtualization environment until the external entity is identified.

14. The method of claim 13, wherein the external entity is identified based on its ability to establish communication with the secured networked virtualization environment.

15. The method of claim 13, wherein the list of external entities is updated to periodically.

16. The method of claim 15, wherein the list of external entities is updated by:

requesting a current external entity from the list of external entities for an updated list of external entities;

receiving the updated list of external entities; and

modifying the list of external entities associated with the secured networked virtualization environment with the updated list of external entities.

17. The method of claim 13, wherein the list of external entities associated with the secured networked virtualization environment is assigned to the secured networked virtualization environment based on a unique identifier for the secured networked virtualization environment.

18. A computer program product embodied on a computer readable medium, the computer readable medium having stored thereon a sequence of instructions which, when executed by a processor causes the processor to execute a method for providing external access into a secured networked virtualization environment, comprising:

performing a leadership election amongst nodes of the secured networked virtualization environment to elect a leader node;

assigning a cluster virtual IP address to the leader node; and

generating a reverse tunnel by the leader node to allow for an external entity to communicate with the secured networked virtualization environment.

19. The computer program product of claim 18, wherein performing the leadership election, comprises:

receiving heartbeat responses for nodes of the secured networked virtualization environment;

forming a queue with nodes that provide heartbeat responses, wherein the nodes that provide heartbeat responses are placed in the queue in an order that the nodes provide their heartbeat responses; and

electing a first node in the queue as the leader node.

20. The computer program product of claim 19, wherein a node located in the queue that subsequently fails to provide a heartbeat response is removed from the queue.

21. The computer program product of claim 19, wherein a node not located in the queue that subsequently provides a heartbeat response is placed in an appropriate position in the queue.

22. The computer program product of claim 18, wherein each node of the secured networked virtualization environment has a private IP address and internal communication amongst the nodes of the secured networked virtualization environment is made through private IP addresses.

23. The computer program product of claim 18, wherein generating the reverse tunnel comprises:

identifying, by the leader node, a port number at the external entity through which the external entity communicates with the leader node.

24. The computer program product of claim 23, wherein the port number is a statically determined port number.

25. The computer program product of claim 23, wherein the port number is a dynamically determined port number.

26. The computer program product of claim 25, wherein the dynamically determined port number is determined by:

requesting the external entity for an available port number;

receiving the available port number from the external entity; and

utilizing the available port number as the port number at the external entity through which the external entity communicates with the leader node.

27. The computer program product of claim 23, wherein the port number at the external entity through which the external entity communicates with the leader node is associated with the secured networked virtualization environment.

28. The computer program product of claim 23, wherein generating the reverse tunnel comprises performing a secured shell (SSH) command using the port number, the cluster virtual IP address and a public SSH key for the external entity.

29. The computer program product of claim 18, further comprising:

identifying failure of the leader node;

performing the leadership election amongst nodes of the secured networked virtualization environment to elect a new leader node;

assigning the cluster virtual IP address to the new leader node; and

generating another reverse tunnel by the new leader node to allow for the external entity to communicate with the secured networked virtualization environment.

30. The computer program product of claim 18, wherein the external entity is chosen by iterating over a list of external entities associated with the secured networked virtualization environment until the external entity is identified.

31. The computer program product of claim 30, wherein the external entity is identified based on its ability to establish communication with the secured networked virtualization environment.

32. The computer program product of claim 30, wherein the list of external entities is updated to periodically.

33. The computer program product of claim 32, wherein the list of external entities is updated by:

requesting a current external entity from the list of external entities for an updated list of external entities;

receiving the updated list of external entities; and

modifying the list of external entities associated with the secured networked virtualization environment with the updated list of external entities.

34. The computer program product of claim 30, wherein the list of external entities associated with the secured networked virtualization environment is assigned to the secured networked virtualization environment based on a unique identifier for the secured networked virtualization environment.

35. A system for providing external access into a secured networked virtualization environment, comprising:

a computer processor to execute a set of program code instructions;

a memory to hold the program code instructions, in which the program code instructions comprises program code to perform;

performing a leadership election amongst nodes of the secured networked virtualization environment to elect a leader node;

assigning a cluster virtual IP address to the leader node; and

generating a reverse tunnel, using a processor, by the leader node to allow for an external entity to communicate with the secured networked virtualization environment.

36. The system of claim 35, in which the program code instructions further comprises program code to perform leadership election by:

receiving heartbeat responses for nodes of the secured networked virtualization environment;

forming a queue with nodes that provide heartbeat responses, wherein the nodes that provide heartbeat responses are placed in the queue in an order that the nodes provide their heartbeat responses; and

electing a first node in the queue as the leader node.

37. The system of claim 36, wherein a node located in the queue that subsequently fails to provide a heartbeat response is removed from the queue.

38. The system of claim 36, wherein a node not located in the queue that subsequently provides a heartbeat response is placed in an appropriate position in the queue.

39. The system of claim 35, wherein each node of the secured networked virtualization environment has a private IP address and internal communication amongst the nodes of the secured networked virtualization environment is made through private IP addresses.