# US 12,010,112 B2 · Remote secured console over a secured connection for inoperable virtual machine > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,010,112 B2 - Document ID: US12010112B2 - Status: Granted - Kind: B2 - Application number: 17/706,165 - Filed: 2022-03-28 - Published: 2023-09-28 - Granted: 2024-06-11 - Earliest claimed: 2022-03-28 - Assignees: Lenovo Global Technology (United States) Inc. - Applicants: Lenovo Global Technology (United States) Inc. - Inventors: Alexandru Cozma; Jeffery J Van Heuklon; Ioana Voicu; Ionut Dobre - Web page: https://patentgrep.com/patent/US12010112B2 ## CPC - H04L 63/0853: {using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234)} - G06F 9/45512: {Command shells} - G06F 9/45558: {Hypervisor-specific management and integration aspects} - G06F 21/33: using certificates - H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)} - G06F 2009/45587: {Isolation or security of virtual machine instances} - G06F 2009/45595: {Network integration; Enabling network access in virtual machine instances} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A method for creation of a secured connection for an inoperable virtual machine includes receiving a token at an on-host service running on an inoperable virtual machine (“VM”) on a server. The token is generated by a remote service person. The method includes receiving a user generated password from a user having direct access to the on-host service. The method includes creating a secured connection, using the token and password, between the on-host service and a remote server of the service person. The method includes transmitting a VM identifier of the inoperable VM to the user and receiving communications from the remote server. The communications include commands for the inoperable VM. The service person accesses the on-host service and inoperable VM using the VM identifier and the password. The password and VM identifier are transmitted to the service person by the user via a channel separate from the secured connection. ## Claims ### Claim 1 A method comprising: receiving a token at an on-host service running on an inoperable virtual machine (“VM”) running on a server, the token generated by a service person located remote from the server; receiving, at the on-host service, a password from a user, the user having direct access to the on-host service; creating, by the on-host service, a secured connection between the on-host service and a remote server accessible to the service person, the secured connection created using the token and the password; transmitting a VM identifier of the inoperable VM to the user; and receiving communications from the remote server, the communications comprising one or more commands directed to the inoperable VM, wherein the service person accesses the on-host service and the inoperable VM using the VM identifier and the password, the password and the VM identifier transmitted to the service person by the user via a channel separate from the secured connection, wherein the channel separate from the secured connection comprises a voice connection and/or an electronic message, and wherein the service person transmits the token to the user and the user inputs the token to the on-host service, wherein the service person transmits the token using a voice connection and/or an electronic message. ### Claim 2 (depends on 1) The method of claim 1, wherein creating the secured connection further comprises using web proxy information regarding a web proxy between the inoperable VM and the remote server to create the secured connection. ### Claim 3 (depends on 1) The method of claim 1, wherein the secured connection comprises a WebSocket. ### Claim 4 (depends on 1) The method of claim 1, wherein the token is unique to the secured connection and the on-host service and the remote server use the token to encrypt communications over the secured connection. ### Claim 5 (depends on 1) The method of claim 1, further comprising storing a hash of previous passwords and rejecting the password generated by the user in response to a hash of the password matching a hash of a previous password. ### Claim 6 (depends on 1) The method of claim 1, wherein the service person accesses the remote server via a web browser accessing a webpage hosted by the remote server. ### Claim 7 (depends on 1) The method of claim 1, further comprising terminating the secured connection in response to reaching a time limit and/or reaching a time limit after a period inactivity on the secured connection. ### Claim 8 (depends on 1) The method of claim 1, wherein the user accesses the on-host service via a user interface through the server. ### Claim 9 An apparatus comprising: a processor; and non-transitory computer readable storage media storing code, the code being executable by the processor to perform operations comprising: receiving a token at an on-host service running on an inoperable virtual machine (“VM”) running on a server, the token generated by a service person located remote from the server; receiving, at the on-host service, a password from a user, the user having direct access to the on-host service; creating, by the on-host service, a secured connection between the on-host service and a remote server accessible to the service person, the secured connection created using the token and the password; transmitting a VM identifier of the inoperable VM to the user; and receiving communications from the remote server, the communications comprising one or more commands directed to the inoperable VM, wherein the service person accesses the on-host service and the inoperable VM using a VM identifier and the password, the password and the VM identifier transmitted to the service person by the user via a channel separate from the secured connection, wherein the channel separate from the secured connection comprises a voice connection and/or an electronic message, and wherein the service person transmits the token to the user and the user inputs the token to the on-host service, wherein the service person transmits the token using a voice connection and/or an electronic message. ### Claim 10 (depends on 9) The apparatus of claim 9, wherein creating the secured connection further comprises using web proxy information regarding a web proxy between the inoperable VM and the remote server to create the secured connection. ### Claim 11 (depends on 9) The apparatus of claim 9, wherein the secured connection comprises a WebSocket. ### Claim 12 (depends on 9) The apparatus of claim 9, wherein the token is unique to the secured connection and the on-host service and the remote server use the token to encrypt communications over the secured connection. ### Claim 13 (depends on 9) The apparatus of claim 9, the operations further comprising storing a hash of previous passwords and rejecting the password generated by the user in response to a hash of the password matching a hash of a previous password. ### Claim 14 (depends on 9) The apparatus of claim 9, wherein the service person accesses the remote server via a web browser accessing a webpage hosted by the remote server. ### Claim 15 (depends on 9) The apparatus of claim 9, the operations further comprising terminating the secured connection in response to reaching a time limit and/or reaching a time limit after a period inactivity on the secured connection. ### Claim 16 A non-transitory computer readable storage medium storing code, the code being configured to be executable by a processor to perform operations comprising: receiving a token at an on-host service running on an inoperable virtual machine (“VM”) running on a server, the token generated by a service person located remote from the server; receiving, at the on-host service, a password from a user, the user having direct access to the on-host service; creating, by the on-host service, a secured connection between the on-host service and a remote server accessible to the service person, the secured connection created using the token and the password; transmitting a VM identifier of the inoperable VM to the user; and receiving communications from the remote server, the communications comprising one or more commands directed to the inoperable VM, wherein the service person accesses the on-host service and the inoperable VM using the VM identifier and the password, the password and the VM identifier transmitted to the service person by the user via a channel separate from the secured connection, wherein the channel separate from the secured connection comprises a voice connection and/or an electronic message, and wherein the service person transmits the token to the user and the user inputs the token to the on-host service, wherein the service person transmits the token using a voice connection and/or an electronic message. ### Claim 17 (depends on 16) The non-transitory computer readable storage medium of claim 16, wherein creating the secured connection further comprises using web proxy information regarding a web proxy between the inoperable VM and the remote server to create the secured connection.