Granted Patent B2

US 8,984,621 · App. 12/714,452 · Granted Mar 17, 2015

Abstract

Claims (33)

1. A method implemented and residing within a non-transitory computer-readable storage medium that is executed by a processor as a cloud service, the processor configured to perform the method, comprising:

receiving a virtual machine (VM) request from a portal;

instantiating a VM to be accessed at a dynamically created Internet Protocol (IP) address and at a dynamically created communication port number, the dynamically created IP address and dynamically created port number representing a combination dynamically created for accessing the instantiated VM, the VM instantiated as needed or requested;

acquiring a secure token for a communication session to the VM, the secure token is unique to the VM, an authenticated principal requesting the VM, and the communication session, and generating the secure token collectively as pieces by the cloud service, the portal, and an identity service, the collective pieces form the secure token;

returning the IP address, the port number, and the secure token back to the portal for the portal to communicate to the identity service that dynamically generates policy to be enforced during the communication session, the identity service also providing the IP address, the port number, and the secure token to the authenticated principal to use during the communication session with the VM and the identity service provides the policy to a secure socket layer virtual private network (SSL VPN) server for the SSL VPN server to enforce the policy when the principal initiates the communication session with the VM via a SSL VPN connection through the SSL VPN, the cloud service, the identity service, and the portal are all in trusted communication with one another, each of these entities are authenticated to one another and secure communications used between the entities including encrypted communications and usage of secure protocols; and

forcing the secure token to expire after a configured period of idleness is detected and shutting down the VM automatically on a detected expiration of the secure token.

2. The method of claim 1 , wherein receiving further includes detecting with the VM request a principal identity for the principal that originated the VM request to the portal.

3. The method of claim 1 , wherein receiving further includes redirecting, by the portal, the principal to the identity service for authentication of the principal.

4. The method of claim 1 , wherein receiving further includes presenting, by the portal, a list of available VMs to the principal, the VM request generated by the portal once the principal selects the VM from the list.

5. The method of claim 1 , wherein instantiating further includes using the IP address of a previous different VM that is being recycled for use with the VM to satisfy the VM request, a previous communication with the different VM terminated when the VM request is received for processing.

6. A method implemented and residing within a non-transitory computer-readable storage medium that is executed by a processor of a network to perform the method as a Secure Socket Layer (SSL) Virtual Private Network (VPN) service, comprising:

receiving a request for a SSL VPN connection to a Virtual Machine (VM), the request received from a principal to establish a SSL VPN communication session with the VM, the VM dynamically created when requested and generating, by the VM, a secure token upon start up;

requesting an identity service to authenticate the request on behalf of the principal;

obtaining policies from the identity service for enforcement during the SSL VPN communication session;

connecting the principal to the VM via the SSL VPN communication session when the principal is authenticated, connection achieved via an Internet Protocol (IP) address and port number combination acquired initially with the request;

enforcing the policies during the SSL VPN communication session, the SSL VPN service, the identity service, and a portal of the principal are in trusted communication with one another, each of these entities are authenticated to one another and secure communications used between the entities including encrypted communications and usage of secure protocols and the policies unique to the VM, the principal, and the SSL VPN communication session; and

forcing the VM to shut down automatically upon detection of a lifetime expiration being reached for the VM.

7. The method of claim 6 , wherein receiving further includes parsing the IP address, the port number, an identity for the principal, and the secure token from the request.

8. The method of claim 7 , wherein requesting further includes passing the identity and the secure token to the identity service for purposes of authenticating the request.

9. The method of claim 6 , wherein obtaining further includes evaluating at least one policy returned from the identity service that matches the IP address and port number received with the request.

10. The method of claim 6 , wherein obtaining further includes acquiring the policies from the identity service as an assertion.

11. The method of claim 6 , wherein connecting further includes passing the secure token acquired with the request to the VM to establish the SSL VPN communication session, the secure token validated by the VM before the SSL VPN communication session is permitted to proceed.

12. The method of claim 6 , wherein enforcing further includes enlisting a policy enforcer to dynamically evaluate and enforce the policies during the SSL VPN communication session.

13. A multiprocessor-implemented system, comprising:

a portal server including one or more processor and memory;

an identity server including one or more processor and memory;

a cloud server including one or more processor and memory; and

a secure socket layer virtual private network (SSL VPN) server;

wherein the portal server is configured to facilitate authenticating a principal via the identity server for access to a virtual machine (VM), the cloud server is configured to dynamically instantiate the VM when requested or needed, and VM instantiated at a specified Internet Protocol (IP) address and port number combination and the cloud server is configured to provide access to the VM during a SSL VPN session when a secure token is presented, the secure token is unique to the VM, the principal requesting the VM, and the SSL VPN session, and wherein the portal server, the identity server, and the cloud server adapted and configured to collectively generate the secure token and the collective pieces form the secure token, and the SSL VPN server is configured to interact with the identity server, the principal, and the cloud server to authenticate the principal and establish the SSL VPN session at the specified IP address and port number combination with the secure token, wherein, the cloud server, the identity server, and the portal server are all in trusted communication with one another, each of these entities are authenticated to one another and secure communications used between the entities including encrypted communications and usage of secure protocols, and wherein the VM is automatically shut down when the secure token is detected as expiring.

14. The system of claim 13 , wherein the identity server is configured to dynamically associate policies that are to be enforced by the SSL VPN server during the SSL VPN session, the policies based on an identity for the principal.

15. The system of claim 14 , wherein the identity server is configured to supply the policies to the SSL VPN server as an assertion.

16. The system of claim 15 , wherein the assertion includes policies identifying the following: a rote for the principal, the specified IP address, the port number, a time interval for allowing the SSL VPN session between the principal and the VM, an action for the SSL VPN server to take on successful evaluation of the policies, and another action for the SSL server to take on unsuccessful evaluation of the policies.

17. The system of claim 15 , wherein the SSL VPN server is configured to terminate the SSL VPN session when one of the policies are violated during the SSL VPN session.

Assignments (13)