# US 11,307,886 B2 · Secure access to a virtual machine > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,307,886 B2 - Document ID: US11307886B2 - Status: Granted - Kind: B2 - Application number: 16/676,206 - Filed: 2019-11-06 - Published: 2020-03-05 - Granted: 2022-04-19 - Earliest claimed: 2010-04-20 - Assignees: International Business Machines Corporation - Applicants: International Business Machines Corporation - Inventors: Rohith K. Ashok; Aaron K. Shook; Daniel E. Jemiolo; Todd E. Kaplinger - Web page: https://patentgrep.com/patent/US11307886B2 ## CPC - G06F 9/45558: {Hypervisor-specific management and integration aspects} - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - H04L 63/102: {Entity profiles} - G06F 2009/45587: {Isolation or security of virtual machine instances} - G06F 2009/45595: {Network integration; Enabling network access in virtual machine instances} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method for providing secure access to a virtual machine includes dispensing an image corresponding to a virtual machine from a management appliance to a distributed computing system such that the virtual machine is implemented by at least one of a plurality of interconnected physical computing devices in the distributed computing system; establishing a trusted relationship between the management appliance and the virtual machine; and providing a user with access to the virtual machine from the management appliance without further authentication credentials from the user. ## Claims ### Claim 1 A method for providing secure access to a virtual machine instance comprising: dispensing a virtual machine instance within a hypervisor from a remote server acting as a management appliance such that the virtual machine instance is implemented by at least one of a plurality of interconnected physical computing devices in a distributed computing system; filtering a request for access to the virtual machine instance based on access privileges of a user among a plurality of users accessing the remote server comprising restricting the user's access to the virtual machine instance based on credentials provided by the user upon accessing the remote server in response to a determination that the user has access to the remote server and not the virtual machine instance; and establishing a trusted relationship between the remote server and the virtual machine instance; wherein the trusted relationship is established through public-key cryptography, the method further comprising: associating a public key with the virtual machine instance; associating a private key with the remote server; and maintaining the private key in a secured storage location accessible to a processor of the remote server. ### Claim 2 (depends on 1) The method of claim 1, further comprising permitting user access to the virtual machine instance from the remote server based on the trusted relationship without further authentication credentials from the user. ### Claim 3 (depends on 1) The method of claim 1, wherein the trusted relationship is established based on criteria selected from the group consisting of establishing the trusted relationship upon the dispensing virtual machine instance from the remote server to the distributed computing system or establishing the trusted relationship in response to the user attempting to access the virtual machine instance. ### Claim 4 (depends on 1) The method of claim 1, further comprising setting the trusted relationship to expire after a predetermined amount of time. ### Claim 5 (depends on 1) The method of claim 1, further comprising assigning a different level of access to each of the plurality of users. ### Claim 6 (depends on 1) The method of claim 1, wherein the filtering comprises catching the request before the requests are processed through a transfer protocol. ### Claim 7 A remote server comprising: at least one processor; and a memory communicatively coupled to the at least one processor, wherein the memory comprises executable code stored thereon such that the at least one processor, upon executing the executable code: dispenses virtual machine instance via a hypervisor to a distributed computing system comprising a plurality of interconnected computing devices, such that at least one of the computing devices implements the virtual machine instance; filters a request for access to the virtual machine instance based on access privileges of a user among a plurality of users accessing the remote server before the request is processed through a transfer protocol, wherein the filtering comprises, in response to a determination that the user has access to the remote server and not the virtual machine instance, restricting the user's access to the virtual machine instance based on credentials provided by the user upon accessing the remote server; and establishes a trusted relationship with the virtual machine instance implemented on the at least one of the computing devices; wherein the at least one processor establishes the trusted relationship through public-key cryptography comprising: associating a public key with the virtual machine instance, associating a private key with the remote server; and maintains the private key in a secured storage location. ### Claim 8 (depends on 7) The remote server of claim 7, wherein the at least one processor further provides a user with access to the virtual machine instance based on the trusted relationship without further authentication credentials from the user. ### Claim 9 (depends on 7) The remote server of claim 7, wherein said computer readable program code, when executed by a processor, assigns a different level of access to each of a plurality of users. ### Claim 10 (depends on 7) The remote server of claim 7, wherein the at least one processor establishes the trusted relationship upon dispensing the image corresponding to the virtual machine instance. ### Claim 11 (depends on 7) The remote server of claim 7, wherein the secure storage location is accessible by the remote server and the virtual machine instance. ### Claim 12 A computer program product for providing secure access to a virtual machine instance on a distributed computing system, the computer program product comprising: a computer readable storage medium having computer readable code embodied therewith, the computer readable program code to, when executed by a processor: dispense a virtual machine instance within a hypervisor from a remote server to a computing device; establish a trusted relationship between the remote server and the virtual machine instance implemented on the computing device; provide a user with access to the virtual machine instance from remote server based on the trusted relationship without further authentication credentials from the user, wherein the trusted relationship is established with public-key cryptography, the computer readable program code further to, when executed by the processor: associate a public key with the virtual machine instance; associate a private key with the remote server; and maintain the private key in a secured storage location; and filter a request for access to the virtual machine instance based on access privileges of a user among a plurality of users accessing the remote server comprising restricting the user's access to the virtual machine instance based on credentials provided by the user upon accessing the remote server in response to a determination that the user has access to the remote server and not the virtual machine instance. ### Claim 13 (depends on 12) The computer program product of claim 12, wherein the computer readable program code, when executed by the processor, further: filters a request for access to the virtual machine instance based on the access privileges of the current user among a plurality of users accessing the remote server, wherein the filtering comprises, in response to a determination that the user among a plurality of users accessing the remote server has access to the remote server and not the virtual machine instance, restricting the user's access to the virtual machine instance based on credentials provided by the user upon accessing the remote server. ### Claim 14 (depends on 12) The computer program product of claim 12, wherein the computer readable program code, when executed by the processor, assigns a different level of access to each of the plurality of users. ### Claim 15 (depends on 13) The computer program product of claim 13, wherein the filtering comprises catching the request before the requests are processed through a transfer protocol. ### Claim 16 (depends on 12) The computer program product of claim 12, wherein the computer readable program code, when executed by the processor, establishes the trusted relationship through public-key cryptography comprising: associating a public key with the virtual machine instance, associating a private key with the remote server; and maintains the private key in a secured storage location. ### Claim 17 (depends on 16) The computer program product of claim 16, wherein the computer readable program code, when executed by the processor, maintains the private key in a secured storage location.