# US 12,223,339 B2 · Management of secrets during deployment of virtual environment > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,223,339 B2 - Document ID: US12223339B2 - Status: Granted - Kind: B2 - Application number: 17/539,161 - Filed: 2021-11-30 - Published: 2023-03-09 - Granted: 2025-02-11 - Earliest claimed: 2021-09-09 - Assignees: Microsoft Technology Licensing, LLC - Applicants: Microsoft Technology Licensing, LLC - Inventors: James Duncan Parsons; Peter John Whiting - Web page: https://patentgrep.com/patent/US12223339B2 ## CPC - G06F 9/45558: {Hypervisor-specific management and integration aspects} - G06F 8/60: Software deployment - G06F 16/212: {with details for data modelling support} - G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - G06F 2009/45562: {Creating, deleting, cloning virtual machine instances} - G06F 2009/4557: {Distribution of virtual machine instances; Migration and load balancing} - G06F 2009/45587: {Isolation or security of virtual machine instances} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Techniques are described for deploying a virtualized computing environment configured in a user-specific configuration, the virtualized network function comprising a plurality of virtual machines. A solution definition file (SDF) identifies a configuration for the deployment. The SDF replaces each secret needed for the deployment with an identifier for the secret. A schema defines a format for each identifier for each secret included in the SDF and a format of the secrets. The secrets and corresponding identifiers are stored in a secure storage. The identifiers are sent to the deployed virtual machines, the identifiers being usable by the virtual machines to obtain the secrets from the secure storage. ## Claims ### Claim 1 A method for deploying, by a deployment function, a user-specific configuration in a virtualized computing environment, the virtualized computing environment comprising a plurality of virtual machines, the method comprising: generating a solution definition file (SDF) that defines the user-specific configuration for a deployment in accordance with the user-specific configuration, the deployment including a set of the plurality of the virtual machines configured to interoperate during the deployment; adding, in the SDF, identifiers for a plurality of secrets to be used by the deployment; generating a schema defining a format for each identifier in the SDF and a format of each of the secrets corresponding to each of the identifiers; validating the secrets for the set of VMs configured to interoperate during the deployment, the validating including detecting whether requirements for any of the secrets have changed and confirming that the secrets conform to rules defined in the schema; storing the secrets to be used by the deployment and corresponding identifiers in a secure storage; deploying the set of the plurality of the virtual machines in a target computing environment in accordance with the SDF; and sending data indicative of the identifiers in the SDF to the deployed virtual machines, the data usable by the virtual machines to obtain the corresponding secret from the secure storage. ### Claim 2 (depends on 1) The method of claim 1, wherein the plurality of secrets are received via user input. ### Claim 3 (depends on 1) The method of claim 1, wherein the plurality of secrets are autogenerated in accordance with the schema. ### Claim 4 (depends on 1) The method of claim 1, wherein the plurality of secrets comprise one or more of passwords, SSH keys, or certificates. ### Claim 5 (depends on 1) The method of claim 1, wherein the secure storage is a key management system. ### Claim 6 (depends on 1) The method of claim 1, wherein the deployment function is configured to: execute as a virtual resource in the virtualized computing environment; execute a series of operations in the virtualized computing environment that coordinate the deployment; and interact with a virtualized infrastructure manager (VIM) and the set of the plurality of the virtual machines to effect the deployment. ### Claim 7 (depends on 1) The method of claim 1, wherein the plurality of secrets are a combination of user-provided secrets and autogenerated secrets. ### Claim 8 A system comprising: one or more processors; and a memory in communication with the one or more processors, the memory having computer-readable instructions stored thereupon that, when executed by the one or more processors, cause the system to perform operations comprising: generating a solution definition file (SDF) that identifies a configuration in accordance with a user-specific configuration, for a deployment of a virtualized computing environment comprising a plurality of virtual machines, the deployment including a set of the plurality of the virtual machines configured to interoperate during the deployment, the SDF replacing a plurality of secrets needed for the deployment with identifiers; generating a schema specifying a format for each identifier included in the SDF and a format of the plurality of secrets, wherein the plurality of secrets and corresponding identifiers are stored in a secure storage; validating the plurality of secrets for the set of virtual machines configured to interoperate during the deployment, the validating including detecting whether requirements for any of the plurality of secrets have changed and confirming that the plurality of secrets conform to rules defined in the schema; deploying the set of the plurality of the virtual machines in the virtualized computing environment; and sending the identifiers to the deployed virtual machines, the identifiers usable by the virtual machines to obtain the plurality of secrets from the secure storage. ### Claim 9 (depends on 8) The system of claim 8, wherein the plurality of secrets are received via user input. ### Claim 10 (depends on 8) The system of claim 8, wherein the plurality of secrets are autogenerated in accordance with the schema. ### Claim 11 (depends on 8) The system of claim 8, wherein the plurality of secrets are a combination of user-provided secrets and autogenerated secrets. ### Claim 12 (depends on 8) The system of claim 8, wherein the plurality of secrets comprise one or more of passwords, SSH keys, or certificates. ### Claim 13 (depends on 8) The system of claim 8, wherein the secure storage is a key management system. ### Claim 14 (depends on 13) The system of claim 13, wherein the deployment is managed by a deployment tool configured to: execute as a virtual resource in the virtualized computing environment; execute a series of operations in the virtualized computing environment that coordinate the deployment; and interact with a virtualized infrastructure manager (VIM) and the set of the plurality of the virtual machines to effect the deployment. ### Claim 15 A computer-readable storage medium having computer-executable instructions stored thereupon which, when executed by one or more processors of a system, cause the system to: generate a solution definition file (SDF) that identifies a configuration in accordance with a user-specific configuration, for a deployment of a virtualized computing environment comprising a plurality of virtual machines, the deployment including a set of the plurality of the virtual machines configured to interoperate during the deployment, the SDF replacing a plurality of secrets needed for the deployment with identifiers; generate a schema defining a format for each identifier for each secret included in the SDF and a format of the plurality of secrets; store the plurality of secrets and corresponding identifiers in a secure storage; validate the plurality of secrets for the set of the plurality of the virtual machines configured to interoperate during the deployment, the validating including detecting whether requirements for any of the plurality of secrets have changed and confirming that the plurality of secrets conform to rules defined in the schema; deploy the set of the plurality of the virtual machines in the virtualized computing environment; and send the identifiers to the deployed virtual machines, the identifiers usable by the virtual machines to obtain the plurality of secrets from the secure storage. ### Claim 16 (depends on 15) The computer-readable storage medium of claim 15, wherein the plurality of secrets are autogenerated in accordance with the schema. ### Claim 17 (depends on 15) The computer-readable storage medium of claim 15, wherein the plurality of secrets are received via user input. ### Claim 18 (depends on 15) The computer-readable storage medium of claim 15, wherein the secure storage is a key management system.