Granted Patent B2

US 10,511,483 · App. 15/162,488 · Granted Dec 17, 2019

Inventors: Atul Prabhu (Bangalore, IN); Nishant Krishna (Bihar, IN); Biswajit Kanungo (San Jose, CA)

Assignee: Extreme Networks, Inc.

H04L41/0893G06F21/121G06F9/45533G06F2221/033

Abstract

Claims (49)

1. A method, comprising:

determining a virtual machine (VM) inventory baseline of a system, wherein the determining comprises identifying VMs in a baseline configuration and generating a VM fingerprint for each VM in the VM inventory baseline;

detecting an onboarded VM;

determining whether the onboarded VM is in the VM inventory baseline based on the VM fingerprint;

in response to the onboarded VM being excluded from the VM inventory baseline, setting the onboarded VM to a quarantine stat for a period of time;

comparing an operational posture of the onboarded VM to an operational posture policy of the system;

determining an available maximum number of virtual machines (VMs) permitted in the system according to a license and a current number of VMs in the system;

in response to the operational posture of the onboarded VM meeting the operational posture policy of the system and in response to a determination that the current number of VMs in the system being less than the available maximum number of VMs permitted in the system, setting the onboarded VM from the quarantine state to an operational state; and

in response to the operational posture of the onboarded VM failing to meet the operational policy posture of the system and to the period of time having expired, shutting down the onboarded VM.

2. The method of claim 1 , further comprising in response to the operational posture of the onboarded VM meeting the operational posture policy of the system, updating the VM inventory baseline to include the onboarded VM and a fingerprint of the onboarded VM.

3. The method of claim 1 , wherein comparing the operational posture of the onboarded VM comprises:

assigning a posture assessment agent to the onboarded VM; and

receiving posture assessment information from the posture assessment agent.

4. The method of claim 1 , further comprising:

in response to a determination that the number of VMs in the system is equal to or greater than the available maximum number of VMs permitted in the system, preventing the onboarded VM from being moved from the quarantine state to the operational state.

5. The method of claim 1 , wherein the quarantine state comprises resources that are limited compared to the resources provided by the operational state.

6. The method of claim 1 , wherein the VM fingerprint is based on one or more of a VM ID, a UUID, a MAC address, and a VM operational parameter.

7. A system, comprising:

one or more processors coupled to a nontransitory computer readable medium having stored thereon software instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:

determining a virtual machine (VM) inventory baseline of the system;

generating a VM fingerprint for each VM in the VM inventory baseline;

detecting an onboarded VM;

based on the VM fingerprint, determining whether the onboarded VM is in the VM inventory baseline;

in response to the onboarded VM being excluded from the VM inventory baseline, setting the onboarded VM to a quarantine state;

determining an available maximum number of virtual machines (VMs) permitted in the system according to a license and a current number of VMs in the system;

comparing an operational posture of the onboarded VM to an operational posture policy of the system; and

in response to the operational posture of the onboarded VM meeting the operational posture policy of the system and in response to a determination that the current number of VMs in the system being less than the available maximum number of VMs permitted in the system, setting the onboarded VM from the quarantine state to an operational state.

8. The system of claim 7 , wherein the operations further comprise in response to the operational posture of the onboarded VM meeting the operational posture policy of the system, updating the VM inventory baseline to include the onboarded VM.

9. The system of claim 7 , wherein comparing the operational posture of the onboarded VM comprises;

assigning a posture assessment agent to the onboarded VM;

receiving posture assessment information from the posture assessment agent; and

in response to the operational posture of the onboarded VM failing to meet the operational policy posture of the system shutting down the onboarded VM.

10. The system of claim 7 , wherein the operations further comprise:

in response to a determination that the number of VMs in the system is equal to or greater than the available maximum number of VMs permitted in the system, preventing the onboarded VM from being moved from the quarantine state to the operational state.

11. The system of claim 7 , wherein the VM fingerprint is based on one or more of a VM ID, a UUID, a MAC address, and a VM operational parameter.

12. A nontransitory computer readable medium having stored thereon software instructions that, when executed by one or more processors, cause the one or more processors to perform operations comprising:

determining a virtual machine (VM) inventory baseline of a system, including generating a VM fingerprint for each VM in the VM inventory baseline;

detecting an onboarded VM;

determining whether the onboarded VM is in the VM inventory baseline based on the VM fingerprint;

in response to the onboarded VM being excluded from the VM inventory baseline, setting the onboarded VM to a quarantine state for a period of time;

comparing an operational posture of the onboarded VM to an operational posture policy of the system;

determining an available maximum number of virtual machines (VMs) permitted in the system according to a license and a current number of VMs in the system;

in response to a determination that the number of VMs in the system being equal to or greater than the maximum number of VMs permitted, preventing the onboarded VM from being moved from the quarantine state to an operational state; and

in response to the operational posture of the onboarded VM failing to meet the operational posture policy of the system and to the period of time having expired, shutting down the onboarded VM.

13. The nontransitory computer readable medium of claim 12 , wherein the operations further comprise in response to the operational posture of the onboarded VM meeting the operational posture policy of the system, updating the VM inventory baseline to include the onboarded VM and a fingerprint of the onboarded VM.

14. The nontransitory computer readable medium of claim 12 , wherein comparing the operational posture of the onboarded VM comprises assigning a posture assessment agent to the onboarded VM and receiving posture assessment information from the posture assessment agent.

15. The system of claim 7 , wherein the operations further comprise in response to the operational posture of the onboarded VM failing to meet the operational policy posture of the system and to the period of time having expired, shutting down the onboarded VM.

16. The system of claim 9 , wherein the posture assessment information comprises security posture settings including a list of installed security software and a configuration of security parameter settings.

17. The nontransitory computer readable medium of claim 12 , wherein the operations further comprise in response to the operational posture of the onboarded VM meeting the operational posture policy of the system, setting the onboarded VM from the quarantine state to the operational state.

Assignments (9)

Continuity (1)

Cited By (1)

US 12,273,409