Method and system for identity-based authentication of virtual machines

• US 9,027,087 B2
• Filed: 03/14/2013
• Issued: 05/05/2015
• Est. Priority Date: 03/14/2013
• Status: Active Grant

• Current Assignee: Rackspace US Incorporated (Apollo Global Management, Inc.)
• Original Assignee: Rackspace US Incorporated (Apollo Global Management, Inc.)
• Inventors: Ishaya, Vishvananda, Carlin, Erik, Voccio, Paul
• Primary Examiner(s): Lipman, Jacob
• Application Number:
  US13/829,781
• Publication Number:
  US 20140282889A1
• Time in Patent Office: 782 Days
• Field of Search: 726/4
• US Class Current: 726/4
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: G06F 9/468 Specific access rights for resources, e.g. using capability register
• CPC Class Codes: G06F 9/5072 Grid computing
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

A cloud computing system configured to run virtual machine instances is disclosed. The cloud computing system assigns an identity to each virtual machine instance. When the virtual machine instance accesses initial configuration resources, it provides this identity to the resources to authenticate itself. This allows for flexible and extensible initial configuration of virtual machine instances.

Claims

1. A cloud computing system, the system comprising:

a resource having configuration information;

a virtual machine instance operably coupled to the resource, wherein the virtual machine instance has an identity; and

an authentication manager configured to authenticate the virtual machine instance based on the identity of the virtual machine instance, without storing credentials for authentication of the virtual machine instance with the virtual machine instance.

2. The cloud computing system of claim 1, wherein the identity is a MAC address.

3. The cloud computing system of claim 1, wherein the resource is a second virtual machine instance.

4. The cloud computing system of claim 1, wherein the resource is a metadata service configured to store configuration information.

5. The cloud computing system of claim 1, wherein the resource is a network controller configured to provide network configuration information to the virtual machine instance.

6. The cloud computing system of claim 1, wherein the authentication manager is further configured to allow a user to setup permissions for the identity, and to control access by the virtual machine instance to the resource based on the permissions.

7. The cloud computing system of claim 1, wherein the authentication manager is further configured to allow a user to setup permissions for a group of identities.

8. The cloud computing system of claim 1, wherein the authentication manager is configured to permit access to the resource based on whether the virtual machine instance is authenticated.

9. A method for controlling access to a resource, the method comprising:

instantiating a virtual machine instance;

assigning an identity to the virtual machine instance;

receiving a request for access to the resource from the virtual machine instance, the request including the identity of the virtual machine instance;

determining whether to authenticate the virtual machine instance based on the identity in the request, and

authenticating, based on the determining, the virtual machine instance, without storing credentials for authentication of the virtual machine instance with the virtual machine instance.

10. The method of claim 9, further comprising:

permitting the virtual machine to access the resource based on the result of the determining step.

11. The method of claim 9, further comprising:

denying the virtual machine instance access to the resource based on the result of the determining step.

12. The method of claim 9, further comprising:

receiving permission information from a user, the permission information defining access rights to the resource for the identity;

wherein the determining step further includes determining whether the virtual machine instance may access the resource based on the permissions information.

13. The method of claim 9, wherein the step of assigning an identity to the virtual machine instance is performed before the step of instantiating the virtual machine.

14. The method of claim 9, wherein the step of assigning an identity to the virtual machine instance is performed after the step of instantiating the virtual machine.

15. The method of claim 9, wherein assigning the identity to the virtual machine instance includes assigning a MAC address to the virtual machine instance.

16. A method for controlling access of virtual machines to resources in a cloud computing system, the method comprising:

receiving a request to instantiate a virtual machine instance;

instantiating the virtual machine instance;

assigning the virtual machine instance a unique, immutable attribute;

performing an initial boot of the virtual machine instance;

receiving a request from the virtual machine instance to access a resource, the request including the unique, immutable attribute;

determining whether to authenticate the virtual machine instance based on permissions configured for the unique, immutable attribute assigned to the virtual machine instance;

authenticating, based on the determining, the virtual machine instance without storing credentials for authentication of the virtual machine instance with the virtual machine instance;

if the virtual machine is authenticated, transmitting a response to the virtual machine instance; and

if the virtual machine is not authenticated, transmitting an error response to the virtual machine instance.

17. The method of claim 16, wherein assigning the unique, immutable attribute includes assigning a MAC address.

18. The method of claim 16, wherein the step of assigning an identity to the virtual machine instance is performed after the step of instantiating the virtual machine.

19. The method of claim 16, wherein the step of assigning an identity to the virtual machine instance is performed before the step of instantiating the virtual machine.

20. The method of claim 16, wherein determining whether to authenticate includes determining whether a type of the request is included in a set of request types that are allowed for an access level associated with the unique, immutable attribute.