US20150334115A1 - Dynamic provisioning of virtual systems - Google Patents

Dynamic provisioning of virtual systems Download PDF

Info

Publication number
US20150334115A1
US20150334115A1 US14/810,992 US201514810992A US2015334115A1 US 20150334115 A1 US20150334115 A1 US 20150334115A1 US 201514810992 A US201514810992 A US 201514810992A US 2015334115 A1 US2015334115 A1 US 2015334115A1
Authority
US
United States
Prior art keywords
server
virtual
new virtual
authentication request
authentication
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Abandoned
Application number
US14/810,992
Inventor
Nathan Jenne
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Hewlett Packard Enterprise Development LP
Original Assignee
Hewlett Packard Enterprise Development LP
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Hewlett Packard Enterprise Development LP filed Critical Hewlett Packard Enterprise Development LP
Priority to US14/810,992 priority Critical patent/US20150334115A1/en
Assigned to HEWLETT PACKARD ENTERPRISE DEVELOPMENT LP reassignment HEWLETT PACKARD ENTERPRISE DEVELOPMENT LP ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: HEWLETT-PACKARD DEVELOPMENT COMPANY, L.P.
Publication of US20150334115A1 publication Critical patent/US20150334115A1/en
Abandoned legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0884—Network architectures or network communication protocols for network security for authentication of entities by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G06F2009/45595—Network integration; Enabling network access in virtual machine instances

Definitions

  • a virtual server is one that hosts a number of virtual machines.
  • a virtual machine is a separate isolated guest operating system installation that operates within the virtual server operating system. Virtualization of the guest operating system may be done through either hardware virtualization, software emulation, or sometimes a combination of both. Computing entities that interact with a virtual machine do so as if the virtual machine were a physical computing system.
  • a server system can run multiple virtual systems, each operating within isolation of each other.
  • the virtual server can also provide different instruction set architectures to different virtual machines.
  • a virtual system may be moved to different physical servers, thus allowing greater mobility of a system.
  • an entity that controls a virtual server system may be different than the entity or entities that control the multiple virtual systems that run on the virtual server.
  • the owner of a virtual system may enter into a business arrangement that allows the virtual system to run on the virtual server. This can often result in forced sharing of sensitive information.
  • the owner of the virtual system has to have access to the virtual system in order to allow that virtual system to communicate over a network.
  • the administrative effort that is needed to configure the virtual systems for operation over the network may be relatively burdensome.
  • FIG. 1 is a diagram showing an illustrative virtual server system, according to one example of principles described herein.
  • FIG. 2 is a diagram showing illustrative virtual system operation, according to one example of principles described herein.
  • FIG. 3 is a diagram showing illustrative dynamic virtual system provisioning, according to one example of principles described herein.
  • FIG. 4 is a diagram showing illustrative virtual system changes, according to one example of principles described herein.
  • FIG. 5 is a flowchart showing an illustrative method for dynamic provisioning of virtual systems, according to one example of principles described herein.
  • an entity that controls a virtual server system may be different than the entity or entities that control the multiple virtual systems that run on the virtual server.
  • the owner of a virtual system may enter into a business arrangement that allows the virtual system to run on the virtual server. This can often result in forced sharing of sensitive information.
  • the owner of the virtual system has to have access to the virtual system in order to allow that virtual system to communicate over a network.
  • the administrative effort that is needed to configure the virtual systems for operation over the network may be relatively burdensome.
  • VLAN Virtual Local Area Network
  • VID Virtual Local Area Network identifier
  • the network device connected to the virtual server can forward the traffic accordingly. This, however, relies on a specific configuration of the network device to handle the VLAN to which the virtual system belongs.
  • the present specification discloses methods and system for dynamic network provisioning that allows for more isolation between the operator of the virtual server and the operator of the virtual systems that run on that server.
  • the virtual server is designed to perform network authentication on behalf of the virtual systems that it is hosting.
  • Network authentication is performed through an authentication server such as a Remote Access Dial-in User Service (RADIUS) server.
  • RADIUS Remote Access Dial-in User Service
  • a RADIUS networking protocol is used to send data from the virtual system to the RADIUS server.
  • the RADIUS server is preconfigured to recognize the virtual system as being authorized to operate on the network.
  • the RADIUS server then sends provisioning information back to the network device connected to the virtual system running the recently authenticated virtual machine.
  • the provisioning information is used to configure the port on the network device that connects to the virtual server. With the port configured, the virtual machine can operate securely on the network according to the access granted by the provisioning information.
  • the RADIUS server is designed to recognize packets by the source address attached to the data packet containing the request for authorization.
  • This address is a physical address such as a Media Access Control (MAC) address.
  • MAC Media Access Control
  • virtual machines are designed to present themselves as physical devices, data packets from a specific virtual machine are tagged with the MAC address of that virtual machine.
  • the virtual server is designed to perform network authentication on behalf of a hosted virtual system by impersonating the physical address of that virtual system. Specifically, as the virtual system is aware of the physical address of its hosted virtual systems, it can use that physical address to send a request to the authentication server. This request will indicate as the physical address of the virtual system to be authenticated as the source. The authentication server will then send the provisioning information to the network device connected to the virtual system. With the port properly configured, the virtual system can send and receive data packets on behalf of the authenticated virtual machine by using the physical address of that virtual machine.
  • Virtual systems may be transferred between different virtual servers with less effort. Moreover, more isolation between the virtual systems and the virtual server may be achieved.
  • FIG. 1 is a diagram showing an illustrative virtual server system ( 100 ) that can be used to host multiple virtual systems.
  • the virtual server system is a physical computing system.
  • the virtual server system ( 100 ) includes a memory ( 102 ) having software ( 104 ) and data ( 106 ) stored thereon.
  • the virtual server system ( 100 ) also includes a processor ( 108 ) and a user interface ( 110 ).
  • RAM Random Access Memory
  • the virtual server system ( 100 ) also includes a processor ( 108 ) for executing the software ( 104 ) and using or updating the data ( 106 ) stored in memory ( 102 ).
  • the software ( 104 ) may include an operating system.
  • An operating system allows other applications to interact properly with the hardware of the physical computing system.
  • Such other applications may include virtual system management software ( 112 ).
  • Virtual system management software is used to manage and run multiple virtual systems on the server system ( 100 ). Such virtual system management software is sometimes referred to as a hypervisor.
  • a network interface ( 110 ) is used to connect the virtual server system ( 100 ) to a network. This connection may be done through a physical connection such as an ethernet cable, coaxial cable, or fiber optic cable. Alternatively, the network interface ( 110 ) may communicate with the network wirelessly.
  • the virtual system management software ( 112 ) allows each of the virtual systems running on the server system ( 100 ) to use the network interface ( 110 ) to access the network.
  • FIG. 2 is a diagram showing illustrative virtual system operation.
  • a hypervisor ( 204 ) runs on a physical computing system ( 202 ) such as a virtual server system.
  • the hypervisor manages a number of virtual systems ( 206 ).
  • a hypervisor ( 204 ) is used to manage multiple virtual systems ( 206 ) running on the same physical computing system ( 202 ).
  • the hypervisor ( 204 ) presents the virtual systems ( 206 ) with a virtual operating platform and manages execution of the virtual operating systems of the virtual systems ( 206 ) on the physical computing system ( 202 ).
  • the hypervisor ( 204 ) is designed to treat each of the different operating systems of the virtual systems separately.
  • different virtual systems can run completely independent of the other virtual systems. This isolation is useful, especially in cases where the different virtual systems are operated by different entities. For example, it may be the case that virtual system 1 ( 206 - 1 ) and virtual system 2 ( 206 - 2 ) are operated by a first entity.
  • Virtual system 3 ( 206 - 3 ) may be operated by a second entity. Those entities may be running secure programs and do not want their programs mixed with other entities.
  • FIG. 3 is a diagram showing illustrative dynamic virtual system provisioning ( 300 ).
  • a virtual system ( 304 ) is first created or transferred to a particular virtual server system ( 302 )
  • that virtual system will not be able to interact with a network ( 308 ) until it is authenticated on that network.
  • Authentication is typically performed using 802.1X protocol as defined by the Institute for Electrical and Electronics Engineers (IEEE).
  • the 802.1X protocol is set up so that when a device first connects to a particular physical port of a network device ( 306 ), standard traffic is not allowed for that device. Rather, a special type of traffic used for authentication is used.
  • the recently connected device sends a request for authentication to an authentication server ( 310 ) such as a RADIUS server. After being authenticated and authorized, the authentication server ( 310 ) sends provisioning information to the network device ( 306 ) to which the device was recently connected.
  • the network device then configures the port that is physically connected to the authenticated device so that that port will route network traffic from that device as normal.
  • the virtual server system ( 302 ) is configured to perform this authentication process on behalf of the virtual system ( 306 ).
  • the virtual system itself has already been authenticated and thus allowed access to the network ( 308 ).
  • the packets associated with that traffic will be tagged with the physical address of the virtual system.
  • the virtual server system sends a request to the authentication server using the 802.1X protocol.
  • the virtual system tags the appropriate packets with the physical address of the virtual system to be authenticated. This process is sometimes referred to as “spoofing”.
  • the virtual server system effectively impersonates the physical address of the virtual system which is being authorized.
  • the authentication server ( 310 ) receives the authentication request from the virtual server system ( 302 ). However, because the packets associated with the request have been tagged with the physical address of one of the virtual systems ( 304 ), the authentication believes it is receiving the request from the virtual system ( 304 ) itself. The authentication server then checks to see if that device is authorized to operate on the network. If so, then the authentication server sends the appropriate provisioning information to the network device ( 306 ) connected to the virtual server system. This network device ( 306 ) is often referred to as the neighbor network device ( 306 ).
  • the provisioning information sent by the authentication server ( 310 ) informs the neighbor network device ( 306 ) how to configure the port connected to the virtual server system ( 302 ).
  • the provisioning information may include policy information such as VIDs that should be assigned to traffic from that port with a specific physical address.
  • the provisioning information may also include other information such as rate limiting information or Class of Server (CoS) information.
  • any traffic with the physical address of an authenticated system that is received on the configured port will be allowed to be routed as normal.
  • the virtual server system ( 302 ) performed the authentication, the virtual system ( 304 ) itself is subsequently allowed to operate as normal over the network.
  • the virtual server system ( 302 ) can perform this authentication on behalf of each virtual system ( 304 ) it is hosting.
  • FIG. 4 is a diagram showing illustrative virtual system changes ( 400 ).
  • the virtual server system can authenticate a virtual system; it can also log the virtual system off of the network. If a virtual system is logged off, then a data packet with the physical address of the logged off system will no longer be routed if received by the port on which the system was previously authorized.
  • the mobility of such systems is made easier.
  • a virtual system ( 404 ) is transferred from a first virtual server system ( 402 - 1 ) to a second virtual server system ( 402 - 2 ).
  • the first virtual server system ( 402 - 1 ) first logs the virtual system ( 404 ) off.
  • the neighbor network device ( 406 - 1 ) connected to the first virtual server system ( 406 - 1 ) will no longer route traffic with the physical address of the virtual system ( 404 ).
  • the virtual server system ( 402 - 2 ) When the virtual system ( 404 ) is loaded to the second virtual server system ( 402 - 2 ), that virtual server system ( 402 - 2 ) will perform authentication on behalf of the virtual system ( 404 ) as described above. Because the provisioning for the virtual system is done dynamically by the switch, the virtual server system administrator has a reduced administrative load.
  • FIG. 5 is a flowchart showing an illustrative method ( 500 ) for dynamic provisioning of virtual systems.
  • the method includes, with a server system that hosts virtual systems, detecting (block 502 ) a new virtual system on the server system, and with the server system, using (block 504 ) a physical address of the new virtual system to perform network authentication on behalf of the new virtual system.
  • Virtual systems may be transferred between different virtual servers with less effort.
  • more isolation between the virtual systems and the virtual server may be achieved.

Abstract

A method for dynamic provisioning of virtual systems includes, with a server system that hosts virtual systems, detecting a new virtual system on the server system, and with the server system, using a physical address of the new virtual system to perform network authentication on behalf of the new virtual system.

Description

    BACKGROUND
  • Many physical network servers are designed to act as virtual servers. A virtual server is one that hosts a number of virtual machines. A virtual machine is a separate isolated guest operating system installation that operates within the virtual server operating system. Virtualization of the guest operating system may be done through either hardware virtualization, software emulation, or sometimes a combination of both. Computing entities that interact with a virtual machine do so as if the virtual machine were a physical computing system.
  • There are many advantages to using virtual machines. Most notably, a server system can run multiple virtual systems, each operating within isolation of each other. The virtual server can also provide different instruction set architectures to different virtual machines. Additionally, a virtual system may be moved to different physical servers, thus allowing greater mobility of a system.
  • In many cases, an entity that controls a virtual server system may be different than the entity or entities that control the multiple virtual systems that run on the virtual server. For example, the owner of a virtual system may enter into a business arrangement that allows the virtual system to run on the virtual server. This can often result in forced sharing of sensitive information. Specifically, the owner of the virtual system has to have access to the virtual system in order to allow that virtual system to communicate over a network. Moreover, the administrative effort that is needed to configure the virtual systems for operation over the network may be relatively burdensome.
    • BRIEF DESCRIPTION OF THE DRAWINGS
  • The accompanying drawings illustrate various examples of the principles described herein and are a part of the specification. The drawings are merely examples and do not limit the scope of the claims.
  • FIG. 1 is a diagram showing an illustrative virtual server system, according to one example of principles described herein.
  • FIG. 2 is a diagram showing illustrative virtual system operation, according to one example of principles described herein.
  • FIG. 3 is a diagram showing illustrative dynamic virtual system provisioning, according to one example of principles described herein.
  • FIG. 4 is a diagram showing illustrative virtual system changes, according to one example of principles described herein.
  • FIG. 5 is a flowchart showing an illustrative method for dynamic provisioning of virtual systems, according to one example of principles described herein.
    •
  • Throughout the drawings, identical reference numbers designate similar, but not necessarily identical, elements.
    • DETAILED DESCRIPTION
  • As mentioned above, an entity that controls a virtual server system may be different than the entity or entities that control the multiple virtual systems that run on the virtual server. For example, the owner of a virtual system may enter into a business arrangement that allows the virtual system to run on the virtual server. This can often result in forced sharing of sensitive information. Specifically, the owner of the virtual system has to have access to the virtual system in order to allow that virtual system to communicate over a network. Moreover, the administrative effort that is needed to configure the virtual systems for operation over the network may be relatively burdensome.
  • Typically, when a new virtual system is first placed onto a virtual server, the virtual system has to be authenticated on the network in order to be able to send and receive data over the network. This authentication may be done through a Virtual Local Area Network (VLAN) identifier (VID) that is tagged onto packets transmitted from that virtual system. The VID identifies a specific VLAN on which the virtual system is authorized to operate. If the packet contains the appropriate VID, then the network device connected to the virtual server can forward the traffic accordingly. This, however, relies on a specific configuration of the network device to handle the VLAN to which the virtual system belongs.
  • In light of this and other issues, the present specification discloses methods and system for dynamic network provisioning that allows for more isolation between the operator of the virtual server and the operator of the virtual systems that run on that server. According to certain illustrative examples, the virtual server is designed to perform network authentication on behalf of the virtual systems that it is hosting.
  • Network authentication is performed through an authentication server such as a Remote Access Dial-in User Service (RADIUS) server. Using such authentication, a RADIUS networking protocol is used to send data from the virtual system to the RADIUS server. The RADIUS server is preconfigured to recognize the virtual system as being authorized to operate on the network. The RADIUS server then sends provisioning information back to the network device connected to the virtual system running the recently authenticated virtual machine. The provisioning information is used to configure the port on the network device that connects to the virtual server. With the port configured, the virtual machine can operate securely on the network according to the access granted by the provisioning information.
  • The RADIUS server is designed to recognize packets by the source address attached to the data packet containing the request for authorization. This address is a physical address such as a Media Access Control (MAC) address. As virtual machines are designed to present themselves as physical devices, data packets from a specific virtual machine are tagged with the MAC address of that virtual machine.
  • According to certain illustrative examples, the virtual server is designed to perform network authentication on behalf of a hosted virtual system by impersonating the physical address of that virtual system. Specifically, as the virtual system is aware of the physical address of its hosted virtual systems, it can use that physical address to send a request to the authentication server. This request will indicate as the physical address of the virtual system to be authenticated as the source. The authentication server will then send the provisioning information to the network device connected to the virtual system. With the port properly configured, the virtual system can send and receive data packets on behalf of the authenticated virtual machine by using the physical address of that virtual machine.
  • Through use of methods and systems embodying principles described herein, less administrative effort may be employed to set up virtual systems on new or different virtual servers. Virtual systems may be transferred between different virtual servers with less effort. Moreover, more isolation between the virtual systems and the virtual server may be achieved.
  • In the following description, for purposes of explanation, numerous specific details are set forth in order to provide a thorough understanding of the present systems and methods. It will be apparent, however, to one skilled in the art that the present apparatus, systems and methods may be practiced without these specific details. Reference in the specification to “an example” or similar language means that a particular feature, structure, or characteristic described in connection with that example is included as described, but may not be included in other examples.
  • Referring now to the figures, FIG. 1 is a diagram showing an illustrative virtual server system (100) that can be used to host multiple virtual systems. As mentioned above, the virtual server system is a physical computing system. According to certain illustrative examples, the virtual server system (100) includes a memory (102) having software (104) and data (106) stored thereon. The virtual server system (100) also includes a processor (108) and a user interface (110).
  • There are many types of memory available. Some types of memory, such as solid state drives, are designed for storage. These types of memory typically have large storage volume but relatively slow performance. Other types of memory, such as those used for Random Access Memory (RAM), are optimized for speed and are often referred to as “working memory.” The various forms of memory may store information in the form of software (104) and data (106). Throughout this specification and the appended claims, the term software refers to any type of machine readable instructions.
  • The virtual server system (100) also includes a processor (108) for executing the software (104) and using or updating the data (106) stored in memory (102). The software (104) may include an operating system. An operating system allows other applications to interact properly with the hardware of the physical computing system. Such other applications may include virtual system management software (112). Virtual system management software is used to manage and run multiple virtual systems on the server system (100). Such virtual system management software is sometimes referred to as a hypervisor.
  • A network interface (110) is used to connect the virtual server system (100) to a network. This connection may be done through a physical connection such as an ethernet cable, coaxial cable, or fiber optic cable. Alternatively, the network interface (110) may communicate with the network wirelessly. The virtual system management software (112) allows each of the virtual systems running on the server system (100) to use the network interface (110) to access the network.
  • FIG. 2 is a diagram showing illustrative virtual system operation. According to certain illustrative examples, a hypervisor (204) runs on a physical computing system (202) such as a virtual server system. The hypervisor manages a number of virtual systems (206).
  • As mentioned above, a hypervisor (204) is used to manage multiple virtual systems (206) running on the same physical computing system (202). The hypervisor (204) presents the virtual systems (206) with a virtual operating platform and manages execution of the virtual operating systems of the virtual systems (206) on the physical computing system (202).
  • The hypervisor (204) is designed to treat each of the different operating systems of the virtual systems separately. Thus, different virtual systems can run completely independent of the other virtual systems. This isolation is useful, especially in cases where the different virtual systems are operated by different entities. For example, it may be the case that virtual system 1 (206-1) and virtual system 2 (206-2) are operated by a first entity. Virtual system 3 (206-3) may be operated by a second entity. Those entities may be running secure programs and do not want their programs mixed with other entities.
  • FIG. 3 is a diagram showing illustrative dynamic virtual system provisioning (300). As mentioned above, when a virtual system (304) is first created or transferred to a particular virtual server system (302), that virtual system will not be able to interact with a network (308) until it is authenticated on that network. Authentication is typically performed using 802.1X protocol as defined by the Institute for Electrical and Electronics Engineers (IEEE).
  • The 802.1X protocol is set up so that when a device first connects to a particular physical port of a network device (306), standard traffic is not allowed for that device. Rather, a special type of traffic used for authentication is used. The recently connected device sends a request for authentication to an authentication server (310) such as a RADIUS server. After being authenticated and authorized, the authentication server (310) sends provisioning information to the network device (306) to which the device was recently connected. The network device then configures the port that is physically connected to the authenticated device so that that port will route network traffic from that device as normal.
  • According to certain illustrative examples, the virtual server system (302) is configured to perform this authentication process on behalf of the virtual system (306). Presumably, the virtual system itself has already been authenticated and thus allowed access to the network (308). Thus, when the virtual server system (306) sends network traffic to the network, the packets associated with that traffic will be tagged with the physical address of the virtual system. To authenticate one of the virtual systems, the virtual server system sends a request to the authentication server using the 802.1X protocol. However, instead of using its own physical address to tag the data packets associated with the request, the virtual system tags the appropriate packets with the physical address of the virtual system to be authenticated. This process is sometimes referred to as “spoofing”. The virtual server system effectively impersonates the physical address of the virtual system which is being authorized.
  • Using such a technique, the authentication server (310) receives the authentication request from the virtual server system (302). However, because the packets associated with the request have been tagged with the physical address of one of the virtual systems (304), the authentication believes it is receiving the request from the virtual system (304) itself. The authentication server then checks to see if that device is authorized to operate on the network. If so, then the authentication server sends the appropriate provisioning information to the network device (306) connected to the virtual server system. This network device (306) is often referred to as the neighbor network device (306).
  • The provisioning information sent by the authentication server (310) informs the neighbor network device (306) how to configure the port connected to the virtual server system (302). The provisioning information may include policy information such as VIDs that should be assigned to traffic from that port with a specific physical address. The provisioning information may also include other information such as rate limiting information or Class of Server (CoS) information.
  • After the network device has been properly configured, any traffic with the physical address of an authenticated system that is received on the configured port will be allowed to be routed as normal. Thus, even though the virtual server system (302) performed the authentication, the virtual system (304) itself is subsequently allowed to operate as normal over the network. The virtual server system (302) can perform this authentication on behalf of each virtual system (304) it is hosting.
  • FIG. 4 is a diagram showing illustrative virtual system changes (400). Just like the virtual server system can authenticate a virtual system; it can also log the virtual system off of the network. If a virtual system is logged off, then a data packet with the physical address of the logged off system will no longer be routed if received by the port on which the system was previously authorized. As virtual server systems are able to perform authentication and logoff procedures on behalf of a virtual system, the mobility of such systems is made easier.
  • According to certain illustrative examples, a virtual system (404) is transferred from a first virtual server system (402-1) to a second virtual server system (402-2). The first virtual server system (402-1) first logs the virtual system (404) off. Thus, the neighbor network device (406-1) connected to the first virtual server system (406-1) will no longer route traffic with the physical address of the virtual system (404).
  • When the virtual system (404) is loaded to the second virtual server system (402-2), that virtual server system (402-2) will perform authentication on behalf of the virtual system (404) as described above. Because the provisioning for the virtual system is done dynamically by the switch, the virtual server system administrator has a reduced administrative load.
  • FIG. 5 is a flowchart showing an illustrative method (500) for dynamic provisioning of virtual systems. According to certain illustrative examples, the method includes, with a server system that hosts virtual systems, detecting (block 502) a new virtual system on the server system, and with the server system, using (block 504) a physical address of the new virtual system to perform network authentication on behalf of the new virtual system.
  • In sum, through use of methods and systems embodying principles described herein, less administrative effort may be employed to set up virtual systems on new or different virtual servers. Virtual systems may be transferred between different virtual servers with less effort. Moreover, more isolation between the virtual systems and the virtual server may be achieved.
  • The preceding description has been presented only to illustrate and describe examples of the principles described. This description is not intended to be exhaustive or to limit these principles to any precise form disclosed. Many modifications and variations are possible in light of the above teaching.

Claims (15)

What is claimed is:
1. A method for dynamic provisioning of virtual systems, the method comprising:
with a server system that hosts virtual systems, detecting a new virtual system on the server system;
with the server system, using a physical address of the new virtual system to perform network authentication on behalf of the new virtual system by impersonating the physical address of the new virtual system; and
with the server system, sending an authentication request to an authentication server on behalf of the new virtual system.
2. The method of claim 1, wherein sending an authentication request to an authentication server on behalf of the new virtual system comprises using the physical address of the new virtual system to send the authentication request to the authentication server.
3. The method of claim 2, wherein the authentication request indicates the physical address of the new virtual system to be authenticated as a source.
4. The method of claim 1, wherein provisioning information received based on the authentication request is used to configure a port on a network device that connects to the server system.
5. The method of claim 4, wherein the provisioning information received based on the authentication request includes at least one of policy information, rate limiting information and class of service information.
6. The method of claim 1, wherein sending the authentication request to the authentication server on behalf of the new virtual system comprises tagging data packets associated with the authentication request with the physical address of the new virtual system.
7. A server system to host a number of virtual systems, the server system comprising:
a processor;
a memory communicatively coupled to the processor, the memory comprising computer executable code that, when executed by the processor, causes the processor to:
detect a new virtual system on the server system;
use a physical address of the new virtual system to perform network authentication on behalf of the new virtual system by impersonating the physical address of the new virtual system; and
send, from the virtual server system, an authentication request to an authentication server on behalf of the new virtual system, in which:
a source of the authentication request is identified as the new virtual system based on the physical address of the new virtual system being indicated as the source of the authentication request.
8. The system of claim 7, wherein the virtual server system is controlled by an entity that is different than an entity that controls the new virtual system.
9. The system of claim 7, wherein sending, from the virtual server system, the authentication request to the authentication server on behalf of the new virtual system comprises using the physical address of the new virtual system to send the authentication request to the authentication server.
10. The system of claim 7, wherein sending, from the virtual server system, the authentication request to the authentication server on behalf of the new virtual system comprises tagging data packets associated with the authentication request with the physical address of the new virtual system.
11. A method for dynamic provisioning of virtual systems, the method comprising:
with a server system that hosts virtual systems, detecting a new virtual system on the server system;
with the server system, transmitting an authentication request on behalf of the new virtual system, a data packet associated with the request indicating the source of the packet by the physical address of a virtual system running on the server system;
with the server system, transmitting data packets associated with the virtual system to a neighboring network device, the network device to allow transmission of data packets associated with the virtual system as a result of the authentication request.
12. The method of claim 11, wherein transmitting the authentication request on behalf of the new virtual system comprises using the physical address of the new virtual system to send the authentication request to an authentication server.
13. The method of claim 11, wherein the authentication request is transmitted upon connection of the new virtual system to a physical port of the neighboring network device.
14. The method of claim 11, wherein transmitting the authentication request to the authentication server on behalf of the new virtual system comprises tagging data packets associated with the authentication request with the physical address of the new virtual system.
15. The method of claim 11, further comprising authenticating the virtual server system.
US14/810,992 2012-04-12 2015-07-28 Dynamic provisioning of virtual systems Abandoned US20150334115A1 (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US14/810,992 US20150334115A1 (en) 2012-04-12 2015-07-28 Dynamic provisioning of virtual systems

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
US13/445,374 US9129124B2 (en) 2012-04-12 2012-04-12 Dynamic provisioning of virtual systems
US14/810,992 US20150334115A1 (en) 2012-04-12 2015-07-28 Dynamic provisioning of virtual systems

Related Parent Applications (1)

Application Number Title Priority Date Filing Date
US13/445,374 Continuation US9129124B2 (en) 2012-04-12 2012-04-12 Dynamic provisioning of virtual systems

Publications (1)

Publication Number Publication Date
US20150334115A1 true US20150334115A1 (en) 2015-11-19

Family

ID=49326277

Family Applications (2)

Application Number Title Priority Date Filing Date
US13/445,374 Active 2032-09-22 US9129124B2 (en) 2012-04-12 2012-04-12 Dynamic provisioning of virtual systems
US14/810,992 Abandoned US20150334115A1 (en) 2012-04-12 2015-07-28 Dynamic provisioning of virtual systems

Family Applications Before (1)

Application Number Title Priority Date Filing Date
US13/445,374 Active 2032-09-22 US9129124B2 (en) 2012-04-12 2012-04-12 Dynamic provisioning of virtual systems

Country Status (1)

Country Link
US (2) US9129124B2 (en)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11095501B2 (en) 2017-01-30 2021-08-17 Hewlett Packard Enterprise Development Lp Provisioning and activating hardware resources

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10757082B2 (en) * 2018-02-22 2020-08-25 International Business Machines Corporation Transforming a wrapped key into a protected key
CA3105553A1 (en) * 2021-01-11 2022-07-11 Walmart Apollo, Llc Cloud-based sftp server system

Citations (22)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20040165592A1 (en) * 2003-02-21 2004-08-26 Sbc Properties, L.P. Extended virtual user-to-network interface with ATM network
US7143435B1 (en) * 2002-07-31 2006-11-28 Cisco Technology, Inc. Method and apparatus for registering auto-configured network addresses based on connection authentication
US20080010666A1 (en) * 2004-06-03 2008-01-10 Huawei Technologies Co., Ltd. Method for Transmitting Policy Information Between Network Equipment
US20080222366A1 (en) * 2007-03-09 2008-09-11 Satoshi Hieda Memory sharing system
US20090063849A1 (en) * 2007-08-31 2009-03-05 International Business Machines Corporation Device certificate based appliance configuration
US20100100879A1 (en) * 2008-10-22 2010-04-22 Vmware, Inc. Methods and systems for converting a related group of physical machines to virtual machines
US20100138534A1 (en) * 2008-11-25 2010-06-03 Rishi Mutnuru Systems and methods for monitor an access gateway
US20100175064A1 (en) * 2009-01-06 2010-07-08 Dell Products L.P. System and method for raw device mapping in traditional nas subsystems
US20110131330A1 (en) * 2009-12-02 2011-06-02 International Business Machines Corporation Collocating desktop virtual machines to proximity of the user
US20110153697A1 (en) * 2005-09-15 2011-06-23 Computer Assoicates Think, Inc. Automated Filer Technique for Use in Virtualized Appliances and Applications
US20110176555A1 (en) * 2010-01-21 2011-07-21 Comcast Cable Communications, Llc Controlling networked media capture devices
US8281363B1 (en) * 2008-03-31 2012-10-02 Symantec Corporation Methods and systems for enforcing network access control in a virtual environment
US20120291028A1 (en) * 2011-05-13 2012-11-15 International Business Machines Corporation Securing a virtualized computing environment using a physical network switch
US20130111474A1 (en) * 2011-10-31 2013-05-02 Stec, Inc. System and method to cache hypervisor data
US20130247133A1 (en) * 2011-10-13 2013-09-19 Mcafee, Inc. Security assessment of virtual machine environments
US20140007232A1 (en) * 2011-05-13 2014-01-02 International Business Machines Corporation (Ibm) Method and apparatus to detect and block unauthorized mac address by virtual machine aware network switches
US20140020086A1 (en) * 2012-02-22 2014-01-16 Panasonic Corporation Virtual machine system, confidential information protection method, and confidential information protection program
US20140075532A1 (en) * 2011-06-16 2014-03-13 Telefonaktiebolaget L M Ericsson (Publ) Authentication Server and Communication Device
US20140282889A1 (en) * 2013-03-14 2014-09-18 Rackspace Us, Inc. Method and System for Identity-Based Authentication of Virtual Machines
US8898493B2 (en) * 2008-07-14 2014-11-25 The Regents Of The University Of California Architecture to enable energy savings in networked computers
US9021116B2 (en) * 2010-08-10 2015-04-28 Dell Products, Lp System and method to create virtual links for end-to-end virtualization
US20150128221A1 (en) * 2013-11-07 2015-05-07 International Business Machines Corporation Location based authentication of users to a virtual machine in a computer system

Family Cites Families (101)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6317775B1 (en) * 1995-11-03 2001-11-13 Cisco Technology, Inc. System for distributing load over multiple servers at an internet site
US6732220B2 (en) * 1999-02-17 2004-05-04 Elbrus International Method for emulating hardware features of a foreign architecture in a host operating system environment
US7376827B1 (en) * 1999-11-05 2008-05-20 Cisco Technology, Inc. Directory-enabled network elements
US6976258B1 (en) 1999-11-30 2005-12-13 Ensim Corporation Providing quality of service guarantees to virtual hosts
US7162542B2 (en) * 2000-04-13 2007-01-09 Intel Corporation Cascading network apparatus for scalability
US6985937B1 (en) 2000-05-11 2006-01-10 Ensim Corporation Dynamically modifying the resources of a virtual server
US8204082B2 (en) * 2000-06-23 2012-06-19 Cloudshield Technologies, Inc. Transparent provisioning of services over a network
US7093280B2 (en) * 2001-03-30 2006-08-15 Juniper Networks, Inc. Internet security system
US7774075B2 (en) * 2002-11-06 2010-08-10 Lin Julius J Y Audio-visual three-dimensional input/output
US7962545B2 (en) * 2002-12-27 2011-06-14 Intel Corporation Dynamic service registry for virtual machines
US8036237B2 (en) * 2003-05-16 2011-10-11 Tut Systems, Inc. System and method for transparent virtual routing
WO2004110026A1 (en) * 2003-06-05 2004-12-16 Wireless Security Corporation Methods and systems of remote authentication for computer networks
US8776050B2 (en) * 2003-08-20 2014-07-08 Oracle International Corporation Distributed virtual machine monitor for managing multiple virtual resources across multiple physical nodes
US7735114B2 (en) * 2003-09-04 2010-06-08 Foundry Networks, Inc. Multiple tiered network security system, method and apparatus using dynamic user policy assignment
US7266668B2 (en) * 2003-11-24 2007-09-04 Copan Systems Inc. Method and system for accessing a plurality of storage devices
US7627679B1 (en) 2003-12-30 2009-12-01 At&T Intellectual Property Ii, L.P. Methods and systems for provisioning network services
EP1571781A1 (en) * 2004-03-03 2005-09-07 France Telecom Sa Proccess and system for authenticating a client for access to a virtual network giving access to services.
US7640543B2 (en) * 2004-06-30 2009-12-29 Intel Corporation Memory isolation and virtualization among virtual machines
US7155558B1 (en) * 2004-07-21 2006-12-26 Vmware, Inc. Providing access to a raw data storage unit in a computer system
US7508757B2 (en) * 2004-10-15 2009-03-24 Alcatel Lucent Network with MAC table overflow protection
US8244882B2 (en) * 2004-11-17 2012-08-14 Raytheon Company On-demand instantiation in a high-performance computing (HPC) system
US7360154B2 (en) * 2004-11-17 2008-04-15 Cisco Technology, Inc. System and method for virtual router enabled electronic documents
US20070036178A1 (en) * 2005-02-02 2007-02-15 Susan Hares Layer 2 virtual switching environment
US7428626B2 (en) * 2005-03-08 2008-09-23 Microsoft Corporation Method and system for a second level address translation in a virtual machine environment
US20060259759A1 (en) * 2005-05-16 2006-11-16 Fabio Maino Method and apparatus for securely extending a protected network through secure intermediation of AAA information
US8089795B2 (en) * 2006-02-09 2012-01-03 Google Inc. Memory module with memory stack and interface with enhanced capabilities
JP4842593B2 (en) * 2005-09-05 2011-12-21 株式会社日立製作所 Device control takeover method for storage virtualization apparatus
US7869436B1 (en) * 2005-10-13 2011-01-11 Cisco Technology, Inc. Methods and apparatus for connecting to virtual networks using non supplicant authentication
US7472197B2 (en) * 2005-10-31 2008-12-30 Ut Starcom, Inc. Method and apparatus for automatic switching of multicast/unicast live TV streaming in a TV-over-IP environment
US8284783B1 (en) * 2005-11-15 2012-10-09 Nvidia Corporation System and method for avoiding neighbor cache pollution
US20070174429A1 (en) * 2006-01-24 2007-07-26 Citrix Systems, Inc. Methods and servers for establishing a connection between a client system and a virtual machine hosting a requested computing environment
US7890985B2 (en) * 2006-05-22 2011-02-15 Microsoft Corporation Server-side media stream manipulation for emulation of media playback functions
US8929327B2 (en) * 2006-05-26 2015-01-06 Mcmaster University Reducing handoff latency for a mobile station
US8365294B2 (en) * 2006-06-30 2013-01-29 Intel Corporation Hardware platform authentication and multi-platform validation
US7797566B2 (en) * 2006-07-11 2010-09-14 Check Point Software Technologies Ltd. Application cluster in security gateway for high availability and load sharing
US7574202B1 (en) * 2006-07-21 2009-08-11 Airsurf Wireless Inc. System and methods for a secure and segregated computer network
US8014413B2 (en) * 2006-08-28 2011-09-06 Intel Corporation Shared input-output device
US8249081B2 (en) * 2006-09-29 2012-08-21 Array Networks, Inc. Dynamic virtual private network (VPN) resource provisioning using a dynamic host configuration protocol (DHCP) server, a domain name system (DNS) and/or static IP assignment
US8082542B2 (en) * 2006-10-04 2011-12-20 International Business Machines Corporation Load time in-lining of subroutines
US8468591B2 (en) * 2006-10-13 2013-06-18 Computer Protection Ip, Llc Client authentication and data management system
US8612971B1 (en) * 2006-10-17 2013-12-17 Manageiq, Inc. Automatic optimization for virtual systems
JP4847272B2 (en) * 2006-10-18 2011-12-28 株式会社日立製作所 Computer system for managing power supply for each logical partition, storage device, and control method thereof
US7774498B1 (en) * 2006-11-06 2010-08-10 Cisco Technology, Inc. Methods and apparatus for trusted application centric QoS provisioning
US7936670B2 (en) * 2007-04-11 2011-05-03 International Business Machines Corporation System, method and program to control access to virtual LAN via a switch
US8230108B2 (en) * 2007-04-13 2012-07-24 Hart Communication Foundation Routing packets on a network using directed graphs
US7952999B1 (en) * 2007-05-08 2011-05-31 Juniper Networks, Inc. Feedback control of processor use in virtual systems
US7783822B2 (en) * 2007-07-25 2010-08-24 Hewlett-Packard Development Company, L.P. Systems and methods for improving performance of a routable fabric
US8527691B2 (en) * 2007-07-31 2013-09-03 Panasonic Corporation Nonvolatile memory device and nonvolatile memory system with fast boot capability
US8122505B2 (en) * 2007-08-17 2012-02-21 International Business Machines Corporation Method and apparatus for detection of malicious behavior in mobile ad-hoc networks
US8127296B2 (en) * 2007-09-06 2012-02-28 Dell Products L.P. Virtual machine migration between processors having VM migration registers controlled by firmware to modify the reporting of common processor feature sets to support the migration
JP4488077B2 (en) * 2008-02-29 2010-06-23 日本電気株式会社 Virtualization system, virtualization method, and virtualization program
US20090222517A1 (en) * 2008-02-29 2009-09-03 Dimitris Kalofonos Methods, systems, and apparatus for using virtual devices with peer-to-peer groups
US20090240874A1 (en) * 2008-02-29 2009-09-24 Fong Pong Framework for user-level packet processing
US8261317B2 (en) * 2008-03-27 2012-09-04 Juniper Networks, Inc. Moving security for virtual machines
CA2661398C (en) * 2008-04-05 2016-05-17 Third Brigade Inc. System and method for intelligent coordination of host and guest intrusion prevention in virtualized environment
US8135838B2 (en) * 2008-04-08 2012-03-13 Geminare Incorporated System and method for providing data and application continuity in a computer system
US8484355B1 (en) * 2008-05-20 2013-07-09 Verizon Patent And Licensing Inc. System and method for customer provisioning in a utility computing platform
US8438622B2 (en) * 2008-07-10 2013-05-07 Honesty Online, Llc Methods and apparatus for authorizing access to data
US20100180272A1 (en) * 2009-01-15 2010-07-15 Kevin Kettler System For Enabling Virtual Services On A Business And A Consumer Device
FR2934395B1 (en) * 2008-07-23 2013-01-04 Trusted Logic SYSTEM AND METHOD FOR SECURING A USER INTERFACE
US8036161B2 (en) * 2008-07-30 2011-10-11 Symbol Technologies, Inc. Wireless switch with virtual wireless switch modules
US8340088B2 (en) * 2008-09-11 2012-12-25 Juniper Networks, Inc. Methods and apparatus related to a low cost data center architecture
US8051432B2 (en) * 2008-11-14 2011-11-01 Novell, Inc. Techniques for establishing virtual devices
US8565118B2 (en) * 2008-12-30 2013-10-22 Juniper Networks, Inc. Methods and apparatus for distributed dynamic network provisioning
US8331362B2 (en) * 2008-12-30 2012-12-11 Juniper Networks, Inc. Methods and apparatus for distributed dynamic network provisioning
US9344401B2 (en) 2009-02-04 2016-05-17 Citrix Systems, Inc. Methods and systems for providing translations of data retrieved from a storage system in a cloud computing environment
US8838976B2 (en) * 2009-02-10 2014-09-16 Uniloc Luxembourg S.A. Web content access using a client device identifier
US9106540B2 (en) * 2009-03-30 2015-08-11 Amazon Technologies, Inc. Providing logical networking functionality for managed computer networks
US9158912B2 (en) * 2009-04-01 2015-10-13 Dell Products L.P. Method and apparatus for a virtual machine hosting network with user devices
US8806587B2 (en) * 2009-04-07 2014-08-12 Togewa Holding Ag Method and system for authenticating a network node in a UAM-based WLAN network
JP5478107B2 (en) * 2009-04-22 2014-04-23 株式会社日立製作所 Management server device for managing virtual storage device and virtual storage device management method
US8826269B2 (en) * 2009-06-15 2014-09-02 Microsoft Corporation Annotating virtual application processes
US8234377B2 (en) * 2009-07-22 2012-07-31 Amazon Technologies, Inc. Dynamically migrating computer networks
JP5398404B2 (en) * 2009-07-30 2014-01-29 株式会社Ｐｆｕ Communication cutoff device, server device, method and program
US8560855B2 (en) * 2009-08-27 2013-10-15 Cleversafe, Inc. Verification of dispersed storage network access control information
JP5440190B2 (en) * 2010-01-12 2014-03-12 富士通株式会社 Display terminal, display method, and display program
JP5392137B2 (en) * 2010-02-17 2014-01-22 富士通株式会社 Program, computer and method for communication processing
US8826271B2 (en) * 2010-04-28 2014-09-02 Cavium, Inc. Method and apparatus for a virtual system on chip
US8879554B2 (en) * 2010-05-07 2014-11-04 Cisco Technology, Inc. Preventing MAC spoofs in a distributed virtual switch
US8839239B2 (en) * 2010-06-15 2014-09-16 Microsoft Corporation Protection of virtual machines executing on a host device
US8402527B2 (en) 2010-06-17 2013-03-19 Vmware, Inc. Identity broker configured to authenticate users to host services
US8832811B2 (en) * 2010-08-27 2014-09-09 Red Hat, Inc. Network access control for trusted platforms
US20120054486A1 (en) * 2010-08-31 2012-03-01 MindTree Limited Securing A Virtual Environment And Virtual Machines
US8732290B2 (en) * 2010-10-05 2014-05-20 Citrix Systems, Inc. Virtual workplace software based on organization characteristics
US20120089775A1 (en) * 2010-10-08 2012-04-12 Sandeep Ranade Method and apparatus for selecting references to use in data compression
US9141420B2 (en) * 2010-11-04 2015-09-22 Alcatel Lucent Overload control in a cloud computing environment
US9058211B2 (en) * 2010-12-09 2015-06-16 Verizon Patent And Licensing Inc. Pre-validation in a computing on demand system
US8745734B1 (en) * 2010-12-29 2014-06-03 Amazon Technologies, Inc. Managing virtual computing testing
US20120173757A1 (en) * 2011-01-05 2012-07-05 International Business Machines Corporation Routing optimization for virtual machine migration between geographically remote data centers
US9058107B2 (en) * 2011-03-29 2015-06-16 Os Nexus, Inc. Dynamic provisioning of a virtual storage appliance
WO2012141694A1 (en) * 2011-04-13 2012-10-18 Hewlett-Packard Development Company, L.P. Input/output processing
US8761187B2 (en) * 2011-06-14 2014-06-24 Futurewei Technologies, Inc. System and method for an in-server virtual switch
US9106445B2 (en) * 2011-06-16 2015-08-11 Verizon Patent And Licensing Inc. Virtual extended network
US8595106B2 (en) * 2011-07-29 2013-11-26 Steven R. Morris System and method for detecting fraudulent financial transactions
US8666723B2 (en) * 2011-08-31 2014-03-04 Oregon State Board Of Higher Education On Behalf Of Portland State University System and methods for generating and managing a virtual device
US20130117806A1 (en) * 2011-11-09 2013-05-09 Microsoft Corporation Network based provisioning
US8893125B2 (en) * 2011-11-18 2014-11-18 Broadcom Corporation Network port profile deployment in a pre-provisioned or dynamically provisioned network infrastructure
US8694986B2 (en) * 2011-12-15 2014-04-08 Microsoft Corporation Providing update notifications on distributed application objects
US9285992B2 (en) * 2011-12-16 2016-03-15 Netapp, Inc. System and method for optimally creating storage objects in a storage system
US8601544B1 (en) * 2011-12-21 2013-12-03 Emc Corporation Computer system employing dual-band authentication using file operations by trusted and untrusted mechanisms
US9128780B2 (en) * 2012-02-22 2015-09-08 Microsoft Technology Licensing, Llc Validating license servers in virtualized environments

Patent Citations (22)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7143435B1 (en) * 2002-07-31 2006-11-28 Cisco Technology, Inc. Method and apparatus for registering auto-configured network addresses based on connection authentication
US20040165592A1 (en) * 2003-02-21 2004-08-26 Sbc Properties, L.P. Extended virtual user-to-network interface with ATM network
US20080010666A1 (en) * 2004-06-03 2008-01-10 Huawei Technologies Co., Ltd. Method for Transmitting Policy Information Between Network Equipment
US20110153697A1 (en) * 2005-09-15 2011-06-23 Computer Assoicates Think, Inc. Automated Filer Technique for Use in Virtualized Appliances and Applications
US20080222366A1 (en) * 2007-03-09 2008-09-11 Satoshi Hieda Memory sharing system
US20090063849A1 (en) * 2007-08-31 2009-03-05 International Business Machines Corporation Device certificate based appliance configuration
US8281363B1 (en) * 2008-03-31 2012-10-02 Symantec Corporation Methods and systems for enforcing network access control in a virtual environment
US8898493B2 (en) * 2008-07-14 2014-11-25 The Regents Of The University Of California Architecture to enable energy savings in networked computers
US20100100879A1 (en) * 2008-10-22 2010-04-22 Vmware, Inc. Methods and systems for converting a related group of physical machines to virtual machines
US20100138534A1 (en) * 2008-11-25 2010-06-03 Rishi Mutnuru Systems and methods for monitor an access gateway
US20100175064A1 (en) * 2009-01-06 2010-07-08 Dell Products L.P. System and method for raw device mapping in traditional nas subsystems
US20110131330A1 (en) * 2009-12-02 2011-06-02 International Business Machines Corporation Collocating desktop virtual machines to proximity of the user
US20110176555A1 (en) * 2010-01-21 2011-07-21 Comcast Cable Communications, Llc Controlling networked media capture devices
US9021116B2 (en) * 2010-08-10 2015-04-28 Dell Products, Lp System and method to create virtual links for end-to-end virtualization
US20140007232A1 (en) * 2011-05-13 2014-01-02 International Business Machines Corporation (Ibm) Method and apparatus to detect and block unauthorized mac address by virtual machine aware network switches
US20120291028A1 (en) * 2011-05-13 2012-11-15 International Business Machines Corporation Securing a virtualized computing environment using a physical network switch
US20140075532A1 (en) * 2011-06-16 2014-03-13 Telefonaktiebolaget L M Ericsson (Publ) Authentication Server and Communication Device
US20130247133A1 (en) * 2011-10-13 2013-09-19 Mcafee, Inc. Security assessment of virtual machine environments
US20130111474A1 (en) * 2011-10-31 2013-05-02 Stec, Inc. System and method to cache hypervisor data
US20140020086A1 (en) * 2012-02-22 2014-01-16 Panasonic Corporation Virtual machine system, confidential information protection method, and confidential information protection program
US20140282889A1 (en) * 2013-03-14 2014-09-18 Rackspace Us, Inc. Method and System for Identity-Based Authentication of Virtual Machines
US20150128221A1 (en) * 2013-11-07 2015-05-07 International Business Machines Corporation Location based authentication of users to a virtual machine in a computer system

Non-Patent Citations (3)

* Cited by examiner, † Cited by third party
Title
Donadio, "Virtual Intrusion Detection Systems in the Cloud", IEEE, Bell Labs Technical Journal 17(3), 2012, pp. 113-128. *
Garfinkel, "Terra: A Virtual Machine-Based Platform for Trusted Computing", ACM, SOSP'03, October 19-22, 2003, pp. 193-206. *
Upton, "Detection and Subversion of Virtual Machines", www.cs.virginia.edu, 2006, pp. 1-7 *

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11095501B2 (en) 2017-01-30 2021-08-17 Hewlett Packard Enterprise Development Lp Provisioning and activating hardware resources

Also Published As

Publication number Publication date
US9129124B2 (en) 2015-09-08
US20130275967A1 (en) 2013-10-17

Similar Documents

Publication Publication Date Title
US20210344692A1 (en) Providing a virtual security appliance architecture to a virtual cloud infrastructure
US11469964B2 (en) Extension resource groups of provider network services
CN106599694B (en) Security protection manages method, computer system and computer readable memory medium
US11531749B2 (en) Controlling access to external networks by an air-gapped endpoint
US10333827B2 (en) Adaptive session forwarding following virtual machine migration detection
US8380819B2 (en) Method to allow seamless connectivity for wireless devices in DHCP snooping/dynamic ARP inspection/IP source guard enabled unified network
US8886927B2 (en) Method, apparatus and system for preventing DDoS attacks in cloud system
US20160323245A1 (en) Security session forwarding following virtual machine migration
CN104685500A (en) Providing services to virtual overlay network traffic
US9529995B2 (en) Auto discovery of virtual machines
TW201600997A (en) Method, appliance and computer program product of dynamically generating a packet inspection policy for a policy enforcement point in a centralized management environment
US10116622B2 (en) Secure communication channel using a blade server
CN110301125B (en) Logical port authentication for virtual machines
US20150334115A1 (en) Dynamic provisioning of virtual systems
US9678772B2 (en) System, method, and computer-readable medium
KR101491322B1 (en) Self-configuring local area network security
US9473518B2 (en) Securing network communications with logical partitions
WO2016197892A1 (en) System security using multi-user control
US20110270953A1 (en) Method and system for secure distributed computing
US20170155680A1 (en) Inject probe transmission to determine network address conflict
US8402084B2 (en) Host embedded controller interface bridge
KR102103484B1 (en) Method and system for providing intranet service by customer using virtual networking technology
CN117278436A (en) Monitoring method and device of virtual machine and storage medium
EP3433736A1 (en) Content management
WO2016003860A1 (en) Secure network communications in a mobile device over ipsec

Legal Events

Date Code Title Description
AS Assignment

Owner name: HEWLETT PACKARD ENTERPRISE DEVELOPMENT LP, TEXAS

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:HEWLETT-PACKARD DEVELOPMENT COMPANY, L.P.;REEL/FRAME:037079/0001

Effective date: 20151027

STCB Information on status: application discontinuation

Free format text: ABANDONED -- FAILURE TO RESPOND TO AN OFFICE ACTION