Secure access to virtual machines in heterogeneous cloud environments

1. A computer implemented method comprising:

migrating the virtual machine from the first cloud to a second cloud;

first accessing the virtual machine in the second cloud for a first time based at least in part on one or more first client credentials;

and

second accessing the virtual machine in the second cloud for a second time based at least in part on one or more second client credentials;

authenticating, from the first cloud, the virtual machine in the second cloud based at least in part on one or more first server credentials from the virtual machine in the second cloud;

replacing the one or more first server credentials in the virtual machine in the second cloud with the one or more second server credentials;

wherein at least one of the migrating, first accessing, second accessing, authenticating and replacing is executed by a combination of a hardware device with software.

2. The method of claim 1 , further comprising:

generating a first public-private key pair including a first public key and a first private key, the one or more first server credentials including the first public key or a first fingerprint of the first public key;

inserting the first public key and the first private key into the virtual machine in the first cloud; and

storing, in a database, first information associating the first public key or the first fingerprint to the virtual machine.

3. The method of claim 2 , wherein authenticating, from the first cloud, the virtual machine in the second cloud includes:

matching the one or more first server credentials to a portion of the first information.

4. The method of claim 3 , further comprising:

generating a second public-private key pair including a second public key and a second private key, the one or more second server credentials including the second public key or a second fingerprint of the second public key;

storing, in the database, second information associating the second public key or the second fingerprint to the virtual machine;

receiving, to the first cloud, the one or more second server credentials from the virtual machine in the second cloud; and

authenticating, from the first cloud, the virtual machine in the second cloud based at least in part on matching the one or more second server credentials to a portion of the second information.

5. The method of claim 1 , wherein providing the one or more first client credentials to the virtual machine in the first cloud includes:

generating a first public-private key pair including a first public key and a first private key, the one or more first client credentials including the first public key; and

inserting the first public key into the virtual machine in the first cloud.

6. The method of claim 5 , wherein accessing the virtual machine in the second cloud for the first time includes:

encrypting first data using the first private key to generate first encrypted data; and sending the first encrypted data to the virtual machine in the second cloud,

wherein first access to the virtual machine in the second cloud for the first time is based at least in part on a first decryption of the first encrypted data using the first public key to generate first unencrypted data and a first comparison of the first unencrypted data to the first data.

7. The method of claim 6 , wherein providing the one or more second client credentials to the virtual machine in the second cloud includes:

generating a second public-private key pair including a second public key and a second private key, the one or more second client credentials including the second public key; and

replacing the first public key in the virtual machine in the second cloud with the second public key.

8. The method of claim 7 , further comprising:

encrypting second data using the second private key to generate second encrypted data; and

sending the second encrypted data to the virtual machine in the second cloud,

wherein second access to the virtual machine in the second cloud for the second time is based at least in part on a second decryption of the second encrypted data using the second public key to generate second unencrypted data and a second comparison of the second unencrypted data to the second data.

9. The method of claim 1 , wherein migrating the virtual machine from the first cloud to the second cloud includes:

converting an image of the virtual machine to a cloud format corresponding to the second cloud to generate a converted image;

uploading the converted image to the second cloud; and

powering up the virtual machine in the second cloud.

10. The method of claim 9 , further comprising:

installing a secure tunnel driver in the virtual machine in the first cloud,

wherein the secure tunnel driver enables a secure tunnel to be established to connect the virtual machine in the second cloud to a cloud gateway of the second cloud.

11. The method of claim 1 , wherein the virtual machine is migrated from the first cloud to the second cloud using a virtual machine template.

12. The method of claim 1 , wherein the first cloud is a private cloud and the second cloud is one of a plurality of heterogeneous public clouds.

13. The method of claim 1 , wherein the virtual machine in the second cloud is accessed using Secure Shell (SSH).

14. A computer implemented method comprising:

providing one or more first client credential to a virtual machine in a first cloud;

migrating the virtual machine from the first cloud to a second cloud;

first accessing the virtual machine in the second cloud for a first time based at least in part on the one or more first client credentials;

providing one or more second client credentials to the virtual machine in the second cloud;

second accessing the virtual machine in the second cloud for a second time based at least in part on the one or more second client credentials;

authenticating, from the first cloud, the virtual machine in the second cloud based at least in part on one or more first server credentials; and

replacing the one or more first server credentials in the virtual machine in the second cloud with one or more second server credentials;

wherein at least one of the migrating, first accessing, second accessing, authenticating and replacing is executed by a combination of a hardware device with software.

15. The method of claim 14 , further comprising:

generating a first public-private key pair including a first public key and a first private key, the one or more first server credentials including the first public key or a first fingerprint of the first public key;

inserting the first public key and the first private key into the virtual machine in the first cloud; and

storing, in a database, first information associating the first public key or the first fingerprint to the virtual machine.

16. The method of claim 15 , wherein:

matching, as part of authenticating the virtual machine in the second cloud, one or more first server credentials to a portion of the first information;

generating a second public-private key pair including a second public key and a second private key, the one or more second server credentials including the second public key or a second fingerprint of the second public key;

storing, in the database, second information associating the second public key or the second fingerprint to the virtual machine;

receiving, to the first cloud, the one or more second server credentials from the virtual machine in the second cloud; and

authenticating, from the first cloud, the virtual machine in the second cloud based at least in part on matching the one or more second server credentials to a portion of the second information.

17. A computer implemented method comprising:

providing one or more first client credentials to a virtual machine in a first cloud, the one or more first client credentials including a first public key;

inserting the first public key into the virtual machine in the first cloud;

migrating the virtual machine from the first cloud to a second cloud;

first accessing the virtual machine in the second cloud for a first time based at least in part on the one or more first client credentials;

providing one or more second client credentials to the virtual machine in the second cloud; and

second accessing the virtual machine in the second cloud for a second time based at least in part on the one or more second client credentials;

wherein at least one of the migrating, first accessing and second accessing is executed by a combination of a hardware device with software.

18. The method of claim 17 , further comprising:

encrypting second data using the second public key to generate second encrypted data; and

sending the second encrypted data to the virtual machine in the second cloud,

wherein,

second access to the virtual machine in the second cloud for the second time is based at least in part on a second decryption of the second encrypted data using the second public key to generate second unencrypted data and a second comparison of the second unencrypted data to the second data.

19. The method of claim 18 , wherein migrating the virtual machine from the first cloud to the second cloud includes;

converting an image of the virtual machine to a cloud format corresponding to the second cloud to generate a converted image;

uploading the converted image to the second cloud; and

powering up the virtual machine in the second cloud.