Secure administration of virtual machines

• US 8,583,920 B1
• Filed: 04/25/2012
• Issued: 11/12/2013
• Est. Priority Date: 04/25/2012
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Bursell, Michael Hingston McLaughlin
• Primary Examiner(s): DADA, BEEMNET W
• Application Number:
  US13/455,221
• Publication Number:
  US 20130291062A1
• Time in Patent Office: 566 Days
• Field of Search: 726/1, 726/21, 726 27- 30
• US Class Current: 713/164
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/629 to features or functions of an application
• CPC Class Codes: G06F 2221/2137 Time limited access, e.g. to a computer or data
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263

Abstract

Methods and systems for performing secure administration of virtual domain resource allocation are provided herein. A cloud service provider (CSP) may provide instances of virtual machines to one or more contracting user entities. The cloud service provider may store an authorization database identifying one or more resources (e.g., storage, CPU, etc.) that each of the different contracting user entities is authorized to use on a virtual machine server device. The CSP may subsequently receive a request from an unverified entity to instantiate a virtual machine with access to one or more resources. The request may include security information. The CSP validates the request by verifying the unverified entity using the first security information (e.g., checking a PKI certificate, requiring a login/password, etc.) and, when the request is validated, provides access to the verified entity to a subset of the requested one or more resources based on the authorization database.

Claims

1. A method comprising:

receiving a first request from an unverified entity to instantiate a first instance of a virtual machine, said first request defining a first set of one or more resources to be made available by a virtual machine server device to the first instance of the virtual machine, said first request including first security information;

validating the first request by verifying the unverified entity using the first security information;

accessing an authorization database, said authorization database identifying one or more resources, based on the verified entity, that the first instance of the virtual machine is authorized to use on the virtual machine server device;

responsive to validating the first request;

instantiating the first instance of the virtual machine with access to the subset of the first set of one or more resources;

wherein when a requested resource is not available to the virtual machine server device, providing access comprises providing access to an alternative resource based on the unavailable requested resource.

2. The method of claim 1, wherein verifying the unverified entity comprises determining whether the first request was signed using a certificate corresponding to the unverified entity.

3. The method of claim 2, wherein the certificate comprises a cryptographically signed public key infrastructure (PKI) certificate.

4. The method of claim 1, wherein providing access comprises superseding a resource requested in the first request based on information in the authorization database.

5. The method of claim 1, wherein providing access is limited by a time-based limitation for a requested resource based on information in one of the first request and the authorization database.

6. The method of claim 5, wherein the time-based limitation is selected from a group comprising:

a time limitation on consecutive use of the resource;

a time limitation on total use of the resource;

a limitation on hours of one or more days the resource may be used;

a limitation on days of the week the resource may be used; and

an expiration date of the resource.

7. The method of claim 1, wherein providing access is limited by an affinity-based access restriction defined within one of the first request and the authorization database.

8. One or more nontransitory computer readable media comprising computer readable instructions that, when executed, configure a virtualization server to perform:

receiving a first request from an unverified entity to instantiate a first instance of a virtual machine, said first request defining a first set of one or more resources to be made available by the virtualization server to the first instance of the virtual machine, said first request including first security information;

validating the first request by verifying the unverified entity using the first security information;

responsive to validating the first request;

determining a subset of the first set of one or more resources based on an authorization database identifying one or more resources that each of a plurality of entities is authorized to access, and

instantiating the first instance of the virtual machine with a subset of the first set of one or more resources;

wherein when a requested resource is not available to the virtual machine server device, providing access comprises providing access to an alternative resource based on the unavailable requested resource.

9. The computer readable media of claim 8, wherein verifying the unverified entity comprises determining whether the first request was signed using a certificate corresponding to the unverified entity.

10. The computer readable media of claim 9, wherein the certificate comprises a cryptographically signed public key infrastructure (PKI) certificate.

11. The computer readable media of claim 8, wherein providing access comprises superseding a resource requested in the first request based on information in the authorization database.

12. The computer readable media of claim 8, wherein providing access is limited by a time-based limitation for a requested resource based on information in one of the first request and the authorization database.

13. The computer readable media of claim 12, wherein the time-based limitation is selected from a group comprising:

a time limitation on consecutive use of the resource;

a time limitation on total use of the resource;

a limitation on hours of one or more days the resource may be used;

a limitation on days of the week the resource may be used; and

an expiration date of the resource.

14. The computer readable media of claim 8, wherein providing access is limited by an affinity-based access restriction defined within one of the first request and the authorization database.

15. A virtualization server, comprising:

a processor; and

memory storing computer readable instructions that, when executed by the processor, configure the virtualization server to perform;

receiving a first request from an unverified entity to instantiate a first instance of a virtual machine, said first request defining a first set of one or more resources to be made available by the virtualization server to the first instance of the virtual machine, said first request including first security information;

validating the first request by verifying the unverified entity using the first security information;

responsive to validating the first request;

determining a subset of the first set of one or more resources based on an authorization database identifying one or more resources that each of a plurality of entities is authorized to access, and

configuring instantiating the first instance of the virtual machine with a subset of the first set of one or more resources;

wherein when a requested resource is not available to the virtual machine server device, providing access comprises providing access to an alternative resource based on the unavailable requested resource.

16. The virtualization server of claim 15, wherein verifying the unverified entity comprises determining whether the first request was signed using a certificate corresponding to the unverified entity.

17. The virtualization server of claim 16, wherein the certificate comprises a cryptographically signed public key infrastructure (PKI) certificate.

18. The virtualization server of claim 15, wherein providing access comprises superseding a resource requested in the first request based on information in the authorization database.

19. The virtualization server of claim 15, wherein providing access is limited by a time-based limitation for a requested resource based on information in one of the first request and the authorization database.

20. The virtualization server of claim 19, wherein the time-based limitation is selected from a group comprising:

a time limitation on consecutive use of the resource;

a time limitation on total use of the resource;

a limitation on hours of one or more days the resource may be used;

a limitation on days of the week the resource may be used; and

an expiration date of the resource.

21. The virtualization server of claim 15, wherein providing access is limited by an affinity-based access restriction defined within one of the first request and the authorization database.