# US 11,310,286 B2 · Mechanism for providing external access to a secured networked virtualization environment > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,310,286 B2 - Document ID: US11310286B2 - Status: Granted - Kind: B2 - Application number: 16/747,272 - Filed: 2020-01-20 - Published: 2020-06-04 - Granted: 2022-04-19 - Earliest claimed: 2014-05-09 - Assignees: Nutanix, Inc. - Applicants: Nutanix, Inc. - Inventors: Miao Cui; Kshitiz Jain; Vineet Kahlon - Web page: https://patentgrep.com/patent/US11310286B2 ## CPC - H04L 63/205: {involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24)} - G06F 9/45558: {Hypervisor-specific management and integration aspects} - H04L 63/029: {Firewall traversal, e.g. tunnelling or, creating pinholes} - G06F 2009/45595: {Network integration; Enabling network access in virtual machine instances} - H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A method for providing external access into a secured networked virtualization environment, includes performing a leadership election amongst nodes of the secured networked virtualization environment to elect a leader node, assigning a cluster virtual IP address to the leader node and generating a reverse tunnel, using a processor, by the leader node to allow for an external entity to communicate with the secured networked virtualization environment. ## Claims ### Claim 1 A non-transitory computer readable medium having stored thereon a sequence of instructions which, when executed by a processor causes a set of acts, the set of acts comprising: electing a leader node from a cluster of nodes within a secured networked virtualization environment, respective nodes of the cluster of nodes each having an IP address; assigning a cluster virtual IP address to the leader node, the cluster virtual IP address being different from the IP address of the leader node; and generating a reverse tunnel with at least the cluster virtual IP address, wherein the reverse tunnel gives a node external to the secured networked virtualization environment access to the secured networked virtualization environment. ### Claim 2 (depends on 1) The computer readable medium of claim 1, wherein electing the leader node is performed by electing a first node corresponding to a first position in a queue as the leader node, wherein the queue is populated based on an order of receipt of heartbeat responses. ### Claim 3 (depends on 1) The computer readable medium of claim 1, wherein the IP address for each of the respective nodes comprise a private IP address and communications within the secured networked virtualization environment utilize a corresponding private IP address. ### Claim 4 (depends on 1) The computer readable medium of claim 1, wherein generating the reverse tunnel comprises identifying, by the leader node, a port number at the node external to the secured networked virtualization environment through which the node external to the secured networked virtualization environment is to communicate with the leader node. ### Claim 5 (depends on 1) The computer readable medium of claim 1, wherein generating the reverse tunnel comprises identifying a port number at the node external to the secured networked virtualization environment by requesting the node external to the secured networked virtualization environment for an available port number and receiving the available port number from the node external to the secured networked virtualization environment. ### Claim 6 (depends on 1) The computer readable medium of claim 1, wherein generating the reverse tunnel comprises performing a secured shell (SSH) command using a port number, the cluster virtual IP address and a public SSH key for the node external to the secured networked virtualization environment. ### Claim 7 (depends on 1) The computer readable medium of claim 1, wherein the node external to the secured networked virtualization environment is identified by iterating over a list of external entities associated with the secured networked virtualization environment. ### Claim 8 (depends on 1) The computer readable medium of claim 1, wherein a list of external entities associated with the secured networked virtualization environment is updated by requesting a current external entity from the list of external entities for an updated list of external entities and modifying the list of external entities to add or remove an external entity. ### Claim 9 (depends on 1) The computer readable medium of claim 1, wherein a list of external entities associated with the secured networked virtualization environment is assigned to the secured networked virtualization environment based on a unique identifier for the secured networked virtualization environment. ### Claim 10 (depends on 1) The computer readable medium of claim 1, wherein a node of the cluster of nodes present storage aggregated from a plurality of storage devices spread across the cluster of nodes. ### Claim 11 A method, comprising: electing a leader node from a cluster of nodes within a secured networked virtualization environment, respective nodes of the cluster of nodes each having an IP address; assigning a cluster virtual IP address to the leader node, the cluster virtual IP address being different from the IP address of the leader node; and generating a reverse tunnel with at least the cluster virtual IP address, wherein the reverse tunnel gives a node external to the secured networked virtualization environment access to the secured networked virtualization environment. ### Claim 12 (depends on 11) The method of claim 11, wherein electing the leader node is performed by electing a first node corresponding to a first position in a queue as the leader node, wherein the queue is populated based on an order of receipt of heartbeat responses. ### Claim 13 (depends on 11) The method of claim 11, wherein the IP address for each of the respective nodes comprise a private IP address and communications within the secured networked virtualization environment utilize a corresponding private IP address. ### Claim 14 (depends on 11) The method of claim 11, wherein generating the reverse tunnel comprises identifying, by the leader node, a port number at the node external to the secured networked virtualization environment through which the node external to the secured networked virtualization environment is to communicate with the leader node. ### Claim 15 (depends on 11) The method of claim 11, wherein generating the reverse tunnel comprises identifying a port number at the node external to the secured networked virtualization environment by requesting the node external to the secured networked virtualization environment for an available port number and receiving the available port number from the node external to the secured networked virtualization environment. ### Claim 16 (depends on 11) The method of claim 11, wherein generating the reverse tunnel comprises performing a secured shell (SSH) command using a port number, the cluster virtual IP address and a public SSH key for the node external to the secured networked virtualization environment. ### Claim 17 (depends on 11) The method of claim 11, wherein a list of external entities associated with the secured networked virtualization environment is updated by requesting a current external entity from the list of external entities for an updated list of external entities and modifying the list of external entities to add or remove an external entity. ### Claim 18 (depends on 11) The method of claim 11, wherein a list of external entities associated with the secured networked virtualization environment is assigned to the secured networked virtualization environment based on a unique identifier for the secured networked virtualization environment. ### Claim 19 (depends on 11) The method of claim 11, wherein a node of the cluster of nodes present storage aggregated from a plurality of storage devices spread across the cluster of nodes. ### Claim 20 (depends on 11) The method of claim 11, wherein the node external to the secured networked virtualization environment is identified by iterating over a list of external entities associated with the secured networked virtualization environment. ### Claim 21 A system comprising: a memory to hold a sequence of instructions; and a processor to execute the sequence of instructions, which when executed cause a set of acts, the set of acts comprising: electing a leader node from a cluster of nodes within a secured networked virtualization environment, respective nodes of the cluster of nodes each having an IP address; assigning a cluster virtual IP address to the leader node, the cluster virtual IP address being different from the IP address of the leader node; and generating a reverse tunnel with at least the cluster virtual IP address, wherein the reverse tunnel gives a node external to the secured networked virtualization environment access to the secured networked virtualization environment. ### Claim 22 (depends on 21) The system of claim 21, wherein electing the leader node is performed by electing a first node corresponding to a first position in a queue as the leader node, wherein the queue is populated based on an order of receipt of heartbeat responses. ### Claim 23 (depends on 21) The system of claim 21, wherein the IP address for each of the respective nodes comprise a private IP address and communications within the secured networked virtualization environment utilize a corresponding private IP address. ### Claim 24 (depends on 21) The system of claim 21, wherein generating the reverse tunnel comprises identifying, by the leader node, a port number at the node external to the secured networked virtualization environment through which the node external to the secured networked virtualization environment is to communicate with the leader node. ### Claim 25 (depends on 21) The system of claim 21, wherein generating the reverse tunnel comprises identifying a port number at the node external to the secured networked virtualization environment by requesting the node external to the secured networked virtualization environment for an available port number and receiving the available port number from the node external to the secured networked virtualization environment. ### Claim 26 (depends on 21) The system of claim 21, wherein a list of external entities associated with the secured networked virtualization environment is updated by requesting a current external entity from the list of external entities for an updated list of external entities and modifying the list of external entities to add or remove an external entity. ### Claim 27 (depends on 21) The system of claim 21, wherein a list of external entities associated with the secured networked virtualization environment is assigned to the secured networked virtualization environment based on a unique identifier for the secured networked virtualization environment. ### Claim 28 (depends on 21) The system of claim 21, wherein a node of the cluster of nodes present storage aggregated from a plurality of storage devices spread across the cluster of nodes. ### Claim 29 (depends on 21) The system of claim 21, wherein generating the reverse tunnel comprises performing a secured shell (SSH) command using a port number, the cluster virtual IP address and a public SSH key for the node external to the secured networked virtualization environment. ### Claim 30 (depends on 21) The system of claim 21, wherein the node external to the secured networked virtualization environment is identified by iterating over a list of external entities associated with the secured networked virtualization environment.