Remote credential management for hybrid clouds with enterprise networks

• US 9,571,455 B2
• Filed: 09/02/2014
• Issued: 02/14/2017
• Est. Priority Date: 01/31/2005
• Status: Active Grant

• Current Assignee: Unisys Corporation
• Original Assignee: Unisys Corporation
• Inventors: Johnson, Robert A, Brandt, Mark S, Byrd, Christopher A, Jaing, Kathy Y
• Primary Examiner(s): LEWIS, LISA C
• Application Number:
  US14/474,452
• Publication Number:
  US 20150381596A1
• Time in Patent Office: 896 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/105 Arrangements for software license management or administration, e.g. for managing licenses at corporate level
• CPC Class Codes: G06F 9/45533 Hypervisors; Virtual machine monitors
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0485 Networking architectures for enhanced packet encryption processing, e.g. offloading of IPsec packet processing or efficient security association look-up
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

A system and method of initializing a virtual machine within a secure hybrid cloud is disclosed. One method includes transmitting service mode credentials to a cloud broker from a cloud-based virtual machine, receiving a service mode community of interest key from a credentialing service based on the service mode credentials, and establishing a secure service mode connection based on the service mode community of interest key. The method also includes receiving role VPN credentials at the cloud-based virtual machine and establishing a secure role connection to the cloud broker using the role VPN credentials, thereby providing, in response to the role VPN credentials, a role VPN community of interest key to a virtual data relay dedicated to the cloud-based virtual machine. The method further includes receiving role cloud credentials at the cloud-based virtual machine and establishing secure communications at the cloud-based virtual machine based on the role cloud credentials, including receiving a role cloud community of interest key at the cloud-based virtual machine used for secure communication among the cloud-based virtual machine and other cloud-based virtual machines within a common community of interest with the cloud-based virtual machine.

Claims

1. A method of initializing a virtual machine within a secure hybrid cloud, the method comprising:

transmitting service mode credentials to a cloud broker from a cloud-based virtual machine;

receiving a service mode community of interest key from a credentialing service based on the service mode credentials;

establishing a secure service mode connection based on the service mode community of interest key;

receiving role VPN credentials at the cloud-based virtual machine;

establishing a secure role connection to the cloud broker using the role VPN credentials, thereby providing, in response to the role VPN credentials, a role VPN community of interest key to a virtual data relay dedicated to the cloud-based virtual machine;

receiving role cloud credentials at the cloud-based virtual machine; and

establishing secure communications at the cloud-based virtual machine based on the role cloud credentials, including receiving a role cloud community of interest key at the cloud-based virtual machine used for secure communication among the cloud-based virtual machine and other cloud-based virtual machines within a common community of interest with the cloud-based virtual machine.

2. The method of claim 1, further comprising deleting the role VPN credentials at the cloud-based virtual machine after the virtual data relay dedicated to the cloud-based virtual machine has received the role VPN community of interest key.

3. The method of claim 1, further comprising establishing a licensing tunnel between the cloud-based virtual machine and a licensing service configured to monitor operation of the cloud-based virtual machine.

4. The method of claim 1, wherein establishing the secure role connection to the cloud broker using the role VPN credentials comprises establishing a dedicated secure connection between the cloud-based virtual machine and a virtual data relay using a dedicated secured connection.

5. The method of claim 4, wherein establishing the secure rote to the cloud broker using the role VPN credentials comprises establishing a secure connection between the virtual data relay and a virtual machine within a private domain portion of the secure hybrid cloud, the virtual machine within the private domain portion being a member of a common community of interest with the cloud-based virtual machine.

6. The method of claim 1, wherein the role VPN community of interest key is not distributed to virtual machines within the cloud-based portion of the secure hybrid cloud.

7. The method of claim 1, wherein the secure service mode connection is established by assigning a service mode community of interest key to the virtual data relay and establishing a dedicated secure connection between the virtual data relay and the cloud-based virtual machine.

8. The method of claim 1, further comprising receiving one or more role cloud filters with the role cloud community of interest key at the cloud-based virtual machine.

9. The method of claim 1, wherein one or more role VPN filters are provided to the virtual data relay alongside the role VPN community of interest key.

10. The method of claim 1, wherein receiving a service mode community of interest key is based at least in part on a determination of a boot time of the cloud-based virtual machine by a cloud manager.

11. The method of claim 1, wherein the cloud broker instantiates the virtual relay.