VIRTUALIZED HOST ID KEY SHARING

• US 20180227281A1
• Filed: 04/10/2018
• Published: 08/09/2018
• Est. Priority Date: 06/28/2013
• Status: Active Grant

• Current Assignee: Extreme Networks, Inc.
• Original Assignee: Extreme Networks, Inc.
• Inventors: Walker, William T., Biyani, Aabha
• Granted Patent: US 11,038,860 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 2009/45562 Creating, deleting, cloning virtual machine instances
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources

Abstract

In virtualized environments a method of determining authorization to a resource cannot use a hardware specific identifier, such as a MAC address. As a result upgrading a virtual host may cause licenses associated with that host to be invalid, even though the upgraded virtual host should be authorized. Authentication methods and systems are disclosed such that a key may be shared with a second host along with a license file and, provided at least the second host has a key associated with its system identifier and a key associated with a license file, access to a licensed resource may be authorized.

Claims

1-20. -20. (canceled)

21. A method of managing access to a resource in a computing system, comprising:

receiving a request to access the resource on a host, wherein the host is configured to provide a virtualized computing environment; and

accessing a license repository;

determining whether a first host key has a corresponding record in the license repository;

determining whether the host has a second host key in accord with a system identifier of the host; and

granting access to the resource by the host upon determining, (a) the host has the first host key in accord with the record in the license repository and (b) the host has the second host key in accord with the system identifier of the host.

22. The method of claim 21, further comprising:

granting access to the resource by the host upon determining, (c) the host does not have an associated entry in a blacklisted license repository.

23. The method of claim 21, further comprising placing an entry associated with the host in a blacklisted license repository upon determining the second host key is not in accord with the system identifier of the host.

24. The method of claim 21, wherein at least one of the first host key and the second host key comprises a universally unique identifier and an IP address.

25. The method of claim 24, wherein at least one of the first host key and the second host key further comprises a timestamp.

26. The method of claim 21, wherein at least one of the first host key and the second host key is encrypted.

27. The method of claim 21, further comprising, generating the second host key from the system identifier of the host.

28. The method of claim 21, further comprising, upon determining the second host key is not in accord with the system identifier of the host (a) not authorizing access to the resource;

(b) copying the first host key, the second host key, and any additional host keys to a blacklist;

(c) deleting all keys, and (d) updating the second host key to be associated with the known system identifier of the host.

29. A system of managing access to a resource in a computing system, comprising control circuitry configured to:

receive a request to access the resource on a host, wherein the host is configured to provide a virtualized computing environment; and

access a license repository;

determine whether a first host key has a corresponding record in the license repository;

determine whether the host has a second host key in accord with a system identifier of the host; and

grant access to the resource by the host upon determining, (a) the host has the first host key in accord with the record in the license repository and (b) the host has the second host key in accord with the system identifier of the host.

30. The system of claim 29, wherein the control circuitry is further configured to:

grant access to the resource by the host upon determining, (c) the host does not have an associated entry in a blacklisted license repository.

31. The system of claim 29, wherein the control circuitry is further configured to place an entry associated with the host in a blacklisted license repository upon determining the second host key is not in accord with the system identifier of the host.

32. The system of claim 29, wherein at least one of the first host key and the second host key comprises a universally unique identifier and an IP address.

33. The system of claim 32, wherein at least one of the first host key and the second host key further comprises a timestamp.

34. The system of claim 29, wherein at least one of the first host key and the second host key is encrypted.

35. The system of claim 29, wherein the control circuitry is further configured to generate the second host key from the system identifier of the host.

36. The system of claim 29, wherein the control circuitry is further configured to, upon determining the second host key is not in accord with the system identifier of the host (a) not authorize access to the resource;

(b) copy the first host key, the second host key, and any additional host keys to a blacklist;

(c) delete all keys, and (d) update the second host key to be associated with the known system identifier of the host.

37. A non-transitory computer-readable medium with instructions encoded thereon for managing access to a resource in a computing system, the instructions comprising:

an instruction for receiving a request to access the resource on a host, wherein the host is configured to provide a virtualized computing environment; and

an instruction for accessing a license repository;

an instruction for determining whether a first host key has a corresponding record in the license repository;

an instruction for determining whether the host has a second host key in accord with a system identifier of the host; and

an instruction for granting access to the resource by the host upon determining, (a) the host has the first host key in accord with the record in the license repository and (b) the host has the second host key in accord with the system identifier of the host.

38. The non-transitory computer-readable medium of claim 37, wherein the instructions further comprise an instruction for granting access to the resource by the host upon determining, (c) the host does not have an associated entry in a blacklisted license repository.

39. The non-transitory computer-readable medium of claim 37, wherein the instructions further comprise an instruction for placing an entry associated with the host in a blacklisted license repository upon determining the second host key is not in accord with the system identifier of the host.

40. The non-transitory computer-readable medium of claim 37, wherein at least one of the first host key and the second host key comprises a universally unique identifier and an IP address.