Granted Patent B1

US 8,438,654 · App. 13/618,399 · Granted May 7, 2013

Abstract

Claims (50)

1. A method for associating a virtual machine instance with an access control right in a cloud-based computing environment, the method comprising:

receiving, by a management server from a virtual machine instance executing in a cloud-based computing environment provided by a third-party cloud infrastructure service, a request to perform an action or to be granted access;

using, by the management server, an identifier to determine that the received request was sent by, or on behalf of, the virtual machine instance;

identifying, by the management server, an access control right associated with the virtual machine instance making the request, to determine whether or not to perform the action on behalf of, or grant access to, the requesting virtual machine instance;

determining, by the management server, a scope associated with the virtual machine instance based on the access control right; and

transmitting, by the management server to the third-party cloud infrastructure service, authorization to perform the action or grant the access using the determined scope.

2. The method of claim 1 , wherein the identifier is included in or associated with the received request.

3. The method of claim 1 , wherein authorization to perform the request using the determined scope comprises one of allowing the request, denying the request, partially allowing the request and partially denying the request, and modifying the request.

4. The method of claim 1 , further comprising:

assigning the identifier to the virtual machine instance; and

sending the identifier to the virtual machine instance.

5. The method of claim 2 , further comprising:

assigning the identifier to the virtual machine instance; and

sending the identifier in a request to launch the virtual machine instance.

6. The method of claim 5 , wherein the identifier is unique to the virtual machine instance.

7. The method of claim 1 , wherein the identifier is associated with a group of one or more virtual machine instances of which the virtual machine instance is a member.

8. The method of claim 1 , wherein the request is an authentication request, the method further comprising:

returning a ticket in response to the authentication request.

9. An apparatus for associating a virtual machine instance with an access control right in a cloud-based computing environment, the apparatus comprising:

a cloud management service executing on a processor, the cloud management service configured to:

receive, from a virtual machine instance executing in a cloud-based computing environment provided by a third-party cloud infrastructure service, a request to perform an action or to be granted access;

use an identifier to determine that the received request was sent by, or on behalf of, the virtual machine instance;

identify an access control right associated with the virtual machine instance making the request, to determine whether or not to perform the action on behalf of, or grant access to, the requesting virtual machine instance;

determine a scope associated with the virtual machine instance based on the access control right; and

transmit, to the third-party cloud infrastructure service, authorization to perform the action or grant the access using the determined scope.

10. The apparatus of claim 9 , wherein the identifier is included in or associated with the received request.

11. The apparatus of claim 9 , wherein authorization to perform the request using the determined scope comprises one of allowing the request, denying the request, partially allowing the request and partially denying the request, and modifying the request.

12. The apparatus of claim 9 , the cloud management service:

assigning the identifier to the virtual machine instance; and

sending the identifier to the virtual machine instance.

13. The apparatus of claim 10 , the cloud management service:

assigning the identifier to the virtual machine instance; and

sending the identifier in a request to launch the virtual machine instance.

14. The apparatus of claim 13 , wherein the identifier is unique to the virtual machine instance.

15. The apparatus of claim 9 , wherein the identifier is associated with a group of one or more virtual machine instances of which the virtual machine instance is a member.

16. The apparatus of claim 9 , wherein the request is an authentication request, the cloud management service returning a ticket in response to the authentication request.

17. A method for associating a virtual machine instance with an access control right in a cloud-based computing environment, the method comprising:

receiving, by a management server, a first request for a first virtual machine instance executing in a first cloud-based computing environment provided by a first third-party cloud infrastructure service to perform an action or to be granted access;

using, by the management server, a first identifier to determine that the received first request was sent by, or on behalf of, the first virtual machine instance;

identifying, by the management server, a first access control right associated with the first virtual machine instance making the first request, to determine whether or not to perform the first request;

receiving, by the management server, a second request for a second virtual machine instance executing in a second cloud-based computing environment provided by a second third-party cloud infrastructure service to perform an action or to be granted access;

using, by the management server, a second identifier to determine that the received second request was sent by, or on behalf of, the second virtual machine instance, wherein the second identifier is different from the first identifier; and

identifying, by the management server, a second access control right associated with the second virtual machine instance making the second request, to determine whether or not to perform the second request.

18. The method of claim 17 , further comprising:

determining, by the management server, a scope associated with the first virtual machine instance, based on the first access control right; and

transmitting, by the management server to the first third-party cloud infrastructure service, authorization to perform the first request using the determined scope.

19. The method of claim 17 , further comprising:

determining, by the management server, a scope associated with the second virtual machine instance based on the second access control right; and

transmitting, by the management server to the second third-party cloud infrastructure service, authorization to perform the second request using the determined scope.

20. The method of claim 17 , wherein the first identifier is included in or associated with the received first request and the second identifier is included in or associated with the received second request.

Assignments (7)