Securely connecting virtual machines in a public cloud to corporate resource

• US 8,863,257 B2
• Filed: 03/10/2011
• Issued: 10/14/2014
• Est. Priority Date: 03/10/2011
• Status: Active Grant

• Current Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Original Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Inventors: Pal, Dmitri V.
• Primary Examiner(s): Chea, Philip
• Assistant Examiner(s): LE, KHOI V
• Application Number:
  US13/045,061
• Publication Number:
  US 20120233678A1
• Time in Patent Office: 1,314 Days
• Field of Search: None
• US Class Current: 726/7
• CPC Class Codes: G06F 21/445 by mutual authentication, e.g. between devices or programs
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3228 One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key

Abstract

Securely connecting a virtual machine in a public cloud to corporate resources. A cloud computing system is coupled to an enterprise computing system via a network. The enterprise computing system includes a management server, an authentication server and a virtual private network (VPN) server. A cloud engine runs on the management server. The cloud engine starts an exchange with the authentication server that leads to a state in which both parties know a one-time password (OTP) and an identifier (ID) of a virtual machine (VM) hosted by the cloud computing system. The cloud engine sends the OTP and the ID to the VM. The VPN server then receives credentials from the VM. If the credentials are successfully authenticated against the OTP and the ID, a secure connection is established between the enterprise computing system and the VM.

Claims

1. A method, comprising:

generating a one-time password (OTP) by one of a cloud engine of a private enterprise computing system or an authentication server, wherein the cloud engine is executable by a processing device;

passing the OTP to the other one of the cloud engine and the authentication server;

starting, by the cloud engine, an exchange with the authentication server to lead to a state in which both the cloud engine and the authentication server comprise an identifier (ID) of a virtual machine (VM), the VM hosted by a public cloud computing system coupled to the private enterprise computing system via a network;

sending, by the private enterprise computing system, the OTP and the ID to the VM;

creating an account at an account creation time before starting the VM;

associating the OTP and the ID for the VM with the account;

enabling the account at an account enablement time that is after the account creation time;

receiving credentials of the VM and a request to access a virtual private network (VPN) server of the private enterprise computing system;

authenticating the credentials of the VM against the OTP and the ID; and

establishing, by the private enterprise computing system, a secure connection between the VPN server and the VM when the credentials received from the VM comprise the OTP and the ID.

2. The method of claim 1, further comprising:

generating the OTP by each of the cloud engine and the authentication server in view of information shared between the cloud engine and the authentication server.

3. The method of claim 1, further comprising:

generating the OTP using a software token or a seed shared between the cloud engine and the authentication server.

4. The method of claim 1, wherein

the account is created before receiving a request to start the VM, and wherein the account is enabled upon receiving the request to start the VM.

5. The method of claim 1, wherein receiving credentials from the VM further comprises:

receiving, by a virtual private network (VPN) server, the credentials from the VM; and

sending, by the VPN server, the credentials to the authentication server for authentication.

6. A system comprising:

a management server, which comprises a processing device that executes a cloud engine, the cloud engine to send a one-time password (OTP) and an identifier (ID) to a virtual machine (VM), the VM hosted by a public cloud computing system coupled to the management server via a network, wherein the cloud engine to start an exchange with an authentication server to lead to a state in which both the cloud engine and the authentication server comprise the OTP and the ID, wherein the OTP is generated by one of the cloud engine and the authentication server, and passed to the other one of the cloud engine and the authentication server, wherein the authentication server is to;

create an account at an account creation time,

associate the OTP and the ID for the VM with the account, and

enable the account at an account enablement time that is after the account creation time;

a virtual private network (VPN) server to receive credentials from the VM and a request to access the VPN server; and

the authentication server coupled to the management server and the VPN server to establish a secure connection between the VM and the VPN server upon authenticating the credentials against the OTP and the ID.

7. The system of claim 6, wherein the OTP is generated by each of the cloud engine and the authentication server in view of information shared between the cloud engine and the authentication server.

8. The system of claim 6, wherein the OTP is generated in view of a software token or a seed shared between the cloud engine and the authentication server.

9. The system of claim 6, wherein the authentication server is to store the account for the VM.

10. The system of claim 9, wherein the account is created before a request is received to start the VM, and is enabled upon receipt of the request to start the VM.

11. A non-transitory computer readable storage medium comprising instructions that, when executed by a processing device, cause the processing device to perform operations comprising:

generating a one-time password (OTP) by one of a cloud engine or an authentication server, wherein the cloud engine is executable by the processing device;

passing the OTP to the other one of the cloud engine and the authentication server;

starting, by the cloud engine of a private enterprise computing system, an exchange with the authentication server to lead to a state in which both the cloud engine and the authentication server comprise an identifier (ID) of a virtual machine (VM), the VM hosted by a public cloud computing system coupled to the private enterprise computing system via a network;

sending, by the private enterprise computing system, the OTP and the ID to the VM;

creating an account at an account creation time before starting the VM;

ssociating the OTP and the ID for the VM with the account;

enabling the account at an account enablement time that is after the account creation time;

receiving credentials of the VM and a request to access a virtual private network (VPN) server of the private enterprise computing system;

authenticating the credentials of the VM against the OTP and the ID; and

establishing, by the private enterprise computing system, a secure connection between the VPN server and the VM upon authenticating credentials submitted by the VM against the OTP and the ID.

12. The computer readable storage medium of claim 11, further comprising:

generating the OTP by each of the cloud engine and the authentication server in view of information shared between the cloud engine and the authentication server.

13. The computer readable storage medium of claim 11, further comprising:

generating the OTP using a software token or a seed shared between the cloud engine and the authentication server.

14. The computer readable storage medium of claim 11, wherein

the account is created before receiving a request to start the VM, and wherein the account is enabled upon receiving the request to start the VM.

15. The computer readable storage medium of claim 11, wherein receiving credentials from the VM further comprises:

receiving, by a virtual private network (VPN) server, the credentials from the VM; and

sending, by the VPN server, the credentials to the authentication server for authentication.