Secure virtual machine

• US 9,954,825 B2
• Filed: 03/16/2016
• Issued: 04/24/2018
• Est. Priority Date: 03/16/2016
• Status: Active Grant

• Current Assignee: Ntrepid, LLC
• Original Assignee: Ntrepid Corporation
• Inventors: Prey, Chad, Ryzhak, Alexander, Thompson, Jeff, Thompson, John, Rintoul, Bradley, Browning, Adam, Martinka, Michael E., Mullen, Darby
• Primary Examiner(s): McNally, Michael S
• Application Number:
  US15/072,092
• Publication Number:
  US 20170272404A1
• Time in Patent Office: 769 Days
• Field of Search: 726 15, 726 25
• CPC Class Codes: G06F 2009/45575 Starting, stopping, suspending or resuming virtual machine instances
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 2009/45595 Network integration; Enabling network access in virtual machine instances
• CPC Class Codes: G06F 9/45504 Abstract machines for programme code execution, e.g. Java virtual machine [JVM], interpreters, emulators
• CPC Class Codes: G06F 9/45533 Hypervisors; Virtual machine monitors
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226

Abstract

Various embodiments pertain to computing devices and virtual machines. In particular, various embodiments relate to the start-up, operation, and communication of virtual machines. A method includes initiating operation of a virtual machine on a computing device, and sending a token from the computing device to a virtual machine, where the token is used to connect the computing device and the virtual machine. The method also includes establishing a virtual private network between the virtual machine and a network node using the token, and launching a user interface of the virtual machine on the computing device after the virtual private network has been established.

Claims

1. A method, comprising:

initiating operation of a virtual machine on a computing device, wherein a user cannot access a user interface of the virtual machine until after a virtual private network is established;

sending a token from the computing device to the virtual machine, wherein the token is used to connect the computing device to the virtual machine;

establishing the virtual private network between the virtual machine and a network node using the token; and

launching the user interface of the virtual machine on the computing device after the virtual private network has been established.

2. The method according to claim 1, wherein the token is configured for at least a short term or a single use.

3. The method according to claim 1, wherein the token is random and does not include any user identifying information.

4. The method according to claim 1, further comprising:

generating the token in another network node.

5. The method according to claim 4, further comprising:

retrieving the token with a host-side application.

6. The method according to claim 5, wherein the host-side application communicates with the virtual machine.

7. The method according to claim 6, wherein the host-side application sends at least one uniform resource locator to the virtual machine.

8. The method according to claim 7, wherein the uniform resource locator is sent to the virtual machine via the network node.

9. The method according to claim 1, further comprising:

generating the token in the computing device with the use of an algorithm.

10. The method according to claim 1, wherein establishing the virtual private network is automatic.

11. The method according to claim 1, wherein the virtual private network is the only network data path into the virtual machine and out of the virtual machine.

12. The method according to claim 1, further comprising:

locking down all communications between the virtual machine and all external devices and networks if the virtual private network is disrupted or dropped.

13. The method according to claim 1, further comprising:

re-establishing the virtual private network automatically if the virtual private network drops.

14. The method according to claim 1, wherein a user desktop on the computing device and the virtual machine are different instances on a virtual device interface server.

15. An apparatus comprising:

at least one memory comprising computer program code;

at least one processor;

wherein the at least one memory and the computer program code are configured, with the at least one processor, to cause the apparatus at least to;

initiate operation of a virtual machine on a computing device, wherein a user cannot access a user interface of the virtual machine until after a virtual private network is established;

send a token from the computing device to the virtual machine, wherein the token is used to connect the computing device to the virtual machine;

establish the virtual private network between the virtual machine and a network node using the token; and

launch the user interface of the virtual machine on the computing device after the virtual private network has been established.

16. The apparatus according to claim 15, wherein the at least one memory and the computer program code are configured, with the at least one processor, to cause the apparatus at least to:

generate the token in another network node.

17. The apparatus according to claim 15, wherein the at least one memory and the computer program code are configured, with the at least one processor, to cause the apparatus at least to:

generate the token in the computing device with the use of an algorithm.

18. The apparatus according to claim 15, wherein the at least one memory and the computer program code are configured, with the at least one processor, to cause the apparatus at least to:

retrieve the token with a host-side application.

19. The apparatus according to claim 15, wherein establishing the virtual private network is automatic.

20. The apparatus according to claim 15, wherein the virtual private network is the only network data path into the virtual machine and out of the virtual machine.

21. The apparatus according to claim 15, further comprising:

locking down all communications between the virtual machine and all external devices and networks, including the network node, if the virtual private network is disrupted or dropped.

22. The apparatus according to claim 15, wherein the at least one memory and the computer program code are configured, with the at least one processor, to cause the apparatus at least to:

re-establish the virtual private network automatically if the virtual private network drops.

23. The method according to claim 15, wherein a user desktop on the computing device and the virtual machine are different instances on a virtual device interface server.

24. A method comprising:

receiving a token initiating operation of a virtual machine, wherein a user cannot access a user interface of the virtual machine until after a virtual private network is established;

establishing the virtual private network between the virtual machine and a network node using the token before displaying the user interface to the virtual machine on the computing device; and

communicating with the virtual machine.

25. The method according to claim 24, wherein the token is retrieved from another network node by the computing device.

26. The method according to claim 24, wherein a host-side application is used to generate the token.

27. The method according to claim 24, wherein establishing the virtual private network is automatic.

28. The method according to claim 24, wherein the virtual private network is the only network data path into the virtual machine and out of the virtual machine.

29. The method according to claim 24, further comprising:

locking down all communications between the virtual machine and all external devices and networks, including the network node, if the virtual private network is disrupted or dropped.

30. The method according to claim 24, further comprising:

re-establishing the virtual private network automatically if the virtual private network is disrupted.

31. An apparatus comprising:

at least one memory comprising computer program code;

at least one processor;

wherein the at least one memory and the computer program code are configured, with the at least one processor, to cause the apparatus at least to;

receive a token initiating operation of a virtual machine, wherein a user cannot access a user interface of the virtual machine until after a virtual private network is established;

establish the virtual private network between the virtual machine and a network node using the token before displaying the user interface to the virtual machine on the computing device; and

communicate with the virtual machine.

32. The apparatus according to claim 31, wherein the token is retrieved from another network node by the computing device.

33. The apparatus according to claim 31, wherein a host-side application is used to generate the token.

34. The apparatus according to claim 31, wherein the computing device uses an algorithm to generate the token.

35. The apparatus according to claim 31, wherein establishing the virtual private network is automatic.

36. The apparatus according to claim 31, wherein the virtual private network is the only network data path into the virtual machine and out of the virtual machine.

37. The apparatus according to claim 31, wherein the at least one memory and the computer program code are configured, with the at least one processor, to cause the apparatus at least to:

lock down all communications between the virtual machine and all external devices and networks, including the network node, if the virtual private network is disrupted or dropped.

38. The apparatus according to claim 31, wherein the at least one memory and the computer program code are configured, with the at least one processor, to cause the apparatus at least to:

re-establish the virtual private network automatically if the virtual private network is disrupted.