Remote credential management for hybrid clouds with enterprise networks
View Patent ↗A system and method of initializing a virtual machine within a secure hybrid cloud is disclosed. One method includes transmitting service mode credentials to a cloud broker from a cloud-based virtual machine, receiving a service mode community of interest key from a credentialing service based on the service mode credentials, and establishing a secure service mode connection based on the service mode community of interest key. The method also includes receiving role VPN credentials at the cloud-based virtual machine and establishing a secure role connection to the cloud broker using the role VPN credentials, thereby providing, in response to the role VPN credentials, a role VPN community of interest key to a virtual data relay dedicated to the cloud-based virtual machine. The method further includes receiving role cloud credentials at the cloud-based virtual machine and establishing secure communications at the cloud-based virtual machine based on the role cloud credentials, including receiving a role cloud community of interest key at the cloud-based virtual machine used for secure communication among the cloud-based virtual machine and other cloud-based virtual machines within a common community of interest with the cloud-based virtual machine.
1. A method of initializing a virtual machine within a secure hybrid cloud, the method comprising:
transmitting service mode credentials to a cloud broker from a cloud-based virtual machine;
receiving a service mode community of interest key from a credentialing service based on the service mode credentials;
establishing a secure service mode connection based on the service mode community of interest key;
receiving role VPN credentials at the cloud-based virtual machine;
establishing a secure role connection to the cloud broker using the role VPN credentials, thereby providing, in response to the role VPN credentials, a role VPN community of interest key to a virtual data relay dedicated to the cloud-based virtual machine;
receiving role cloud credentials at the cloud-based virtual machine; and
establishing secure communications at the cloud-based virtual machine based on the role cloud credentials, including receiving a role cloud community of interest key at the cloud-based virtual machine used for secure communication among the cloud-based virtual machine and other cloud-based virtual machines within a common community of interest with the cloud-based virtual machine.
2. The method of claim 1 , further comprising deleting the role VPN credentials at the cloud-based virtual machine after the virtual data relay dedicated to the cloud-based virtual machine has received the role VPN community of interest key.
3. The method of claim 1 , further comprising establishing a licensing tunnel between the cloud-based virtual machine and a licensing service configured to monitor operation of the cloud-based virtual machine.
4. The method of claim 1 , wherein establishing the secure role connection to the cloud broker using the role VPN credentials comprises establishing a dedicated secure connection between the cloud-based virtual machine and a virtual data relay using a dedicated secured connection.
5. The method of claim 4 , wherein establishing the secure rote to the cloud broker using the role VPN credentials comprises establishing a secure connection between the virtual data relay and a virtual machine within a private domain portion of the secure hybrid cloud, the virtual machine within the private domain portion being a member of a common community of interest with the cloud-based virtual machine.
6. The method of claim 1 , wherein the role VPN community of interest key is not distributed to virtual machines within the cloud-based portion of the secure hybrid cloud.
7. The method of claim 1 , wherein the secure service mode connection is established by assigning a service mode community of interest key to the virtual data relay and establishing a dedicated secure connection between the virtual data relay and the cloud-based virtual machine.
8. The method of claim 1 , further comprising receiving one or more role cloud filters with the role cloud community of interest key at the cloud-based virtual machine.
9. The method of claim 1 , wherein one or more role VPN filters are provided to the virtual data relay alongside the role VPN community of interest key.
10. The method of claim 1 , wherein receiving a service mode community of interest key is based at least in part on a determination of a boot time of the cloud-based virtual machine by a cloud manager.
11. The method of claim 1 , wherein the cloud broker instantiates the virtual relay.