# US 2016/0366135 A1 · Configuration management for virtual machine environment > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2016/0366135 A1 - Document ID: US20160366135A1 - Status: Published application - Kind: A1 - Application number: 14/736,422 - Filed: 2015-06-11 - Published: 2016-12-15 - Earliest claimed: 2015-06-11 - Assignees: International Business Machines Corporation - Applicants: International Business Machines Corporation - Inventors: Sanehiro Furuichi; Takahito Tashiro - Web page: https://patentgrep.com/patent/US20160366135A1 ## CPC - H04L 63/107: {wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals} - H04L 41/0816: the condition being an adaptation, e.g. in response to network events - H04L 41/085: Retrieval of network configuration; Tracking network configuration history - H04L 41/0866: Checking the configuration - H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint} - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 63/10: {for controlling access to devices or network resources} - H04L 63/105: {Multiple levels of security} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A computer-implemented method for controlling a connection between a virtual machine and a physical device comprises receiving a connection request for connecting the physical device to the virtual machine and determining whether the virtual machine satisfies a first connection permission condition and whether the physical device satisfies a second connection permission condition. In response to a determination that the virtual machine does not satisfy the first connection permission condition, a configuration of the virtual machine is changed to satisfy the first connection permission condition. In response to a determination that the physical device does not satisfy the second connection permission condition, a configuration of the physical device is changed to satisfy the second connection permission condition. In response to a determination that the virtual machine satisfies the first connection permission condition and that the physical device satisfies the second connection permission condition, the received connection request is accepted. ## Claims ### Claim 1 A computer-implemented method for controlling a connection between a virtual machine and a physical device, the method comprising: receiving a connection request for connecting the physical device to the virtual machine; in response to receiving the connection request, determining whether the virtual machine satisfies a first connection permission condition and whether the physical device satisfies a second connection permission condition; in response to a determination that the virtual machine does not satisfy the first connection permission condition, changing a configuration of the virtual machine to satisfy the first connection permission condition; in response to a determination that the physical device does not satisfy the second connection permission condition, changing a configuration of the physical device to satisfy the second connection permission condition; and in response to a determination that the virtual machine satisfies the first connection permission condition and that the physical device satisfies the second connection permission condition, accepting the received connection request to connect the physical device to the virtual machine. ### Claim 2 (depends on 1) The computer-implemented method according to claim 1, further comprising: in response to a determination that the change in the configuration of the virtual machine fails or does not satisfy the first connection permission condition, rejecting the connection request; and in response to a determination that the change in the configuration of the physical device fails or does not satisfy the second connection permission condition, rejecting the connection request. ### Claim 3 (depends on 1) The computer-implemented method according to claim 1, wherein the method further comprises: dynamically detecting a change in at least one of the configuration of the virtual machine, a context of the virtual machine, the configuration of the physical device, or a context of the physical device; and in response to a determination that the dynamically detected change does not satisfy at least one of the first connection permission condition or the second connection permission condition, performing at least one of: cancelling the dynamically detected change; invalidating the dynamically detected change; returning the dynamically detected change to a state prior to changing; or disconnecting the connection between the virtual machine and the physical device. ### Claim 4 (depends on 3) The computer-implemented method according to claim 3, further comprising: monitoring the dynamically detected change in the configuration of the virtual machine, the context of the virtual machine, the configuration of the physical device, or the context of the physical device. ### Claim 5 (depends on 1) The computer-implemented method according to claim 1, further comprising: in response to receipt of the connection request, obtaining a latest configuration and a latest context of each of the virtual machine and the physical device. ### Claim 6 (depends on 5) The computer-implemented method according to claim 5, wherein determining whether the virtual machine satisfies the first connection permission condition and whether the physical device satisfies the second connection permission condition comprises: determining whether the latest configuration of the virtual machine and the latest context of the virtual machine satisfy the first connection permission condition; and determining whether the latest configuration of the physical device and the latest context of the physical device satisfy the second connection permission condition. ### Claim 7 (depends on 1) The computer-implemented method according to claim 1, wherein the first connection permission condition comprises a setting of at least one of a configuration of the virtual machine or a context of virtual machine; and wherein the second connection permission condition comprises a setting of at least one of a configuration of the physical device or a context of the physical device. ### Claim 8 A computer system for controlling a connection between a virtual machine and a physical device, the computer system comprising: a virtual machine managing server; an endpoint managing server; and a storage for storing a first connection permission condition for the virtual machine and a second connection permission condition for the physical device; wherein the virtual machine managing server is configured to determine whether the virtual machine satisfies the first connection permission condition and whether the physical device satisfies the second connection permission condition in response to receipt of a connection request for connecting the physical device to the virtual machine; wherein the endpoint managing server is configured to send an instruction for changing a configuration of the virtual machine in response to a determination that the virtual machine does not satisfy the first connection permission condition; wherein the endpoint managing server is configured to send an instruction for changing a configuration of the physical device in response to a determination that the physical device does not satisfy the second connection permission condition; and wherein the virtual machine managing server is configured to accept the connection request to connect the physical device to the virtual machine in response to a determination that the virtual machine satisfies the first connection permission condition and that the physical device satisfies the second connection permission condition. ### Claim 9 (depends on 8) The computer system according to claim 8, wherein the virtual machine managing server is configured to reject the connection request in response to a determination that the change in the configuration of the virtual machine fails or does not satisfy the first connection permission condition; and wherein the virtual managing server is configured to reject the connection request in response to a determination that the change in the configuration of the physical device fails or does not satisfy the second connection permission condition. ### Claim 10 (depends on 8) The computer system according to claim 8, wherein the endpoint managing server is configured to dynamically detect a change in at least one of the configuration of the virtual machine, a context of the virtual machine, the configuration of the physical device, or a context of the physical device; and wherein, in response to a determination that the dynamically detected change does not satisfy at least one of the first connection permission condition or the second connection permission condition, the endpoint managing server is further configured to: cancel the dynamically detected change; invalidate the dynamically detected change; return the dynamically detected change to a state prior to changing; or disconnect the connection between the virtual machine and the physical device. ### Claim 11 (depends on 10) The computer system according to claim 10, wherein the endpoint managing server is configured to monitor the dynamically detected change in at least one of the configuration of the virtual machine, the context of the virtual machine, the configuration of the physical device, or the context of the physical device. ### Claim 12 (depends on 8) The computer system according to claim 8, wherein the endpoint managing server is configured to obtain a latest configuration and a latest context of each of the virtual machine and the physical device. ### Claim 13 (depends on 12) The computer system according to claim 12, wherein the computer system further comprises a connection determining module; wherein the connection determining module is configured to decide whether the latest configuration of the virtual machine and the latest context of the virtual machine satisfy the first connection permission condition; and wherein the connection determining module is further configured to decide whether the latest configuration of the physical device and the latest context of the physical device satisfy the second connection permission condition. ### Claim 14 (depends on 8) The computer system according to claim 8, wherein the first connection permission condition comprises a setting of at least one of a configuration of the virtual machine or a context of virtual machine; and wherein the second connection permission condition comprises a setting of at least one of a configuration of the physical device or a context of the physical device. ### Claim 15 A computer program product for controlling a connection between a virtual machine and a physical device, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a processor to cause the processor to: determine whether the virtual machine satisfies a first connection permission condition and whether the physical device satisfies a second connection permission condition in response to receiving a connection request for connecting the physical device to the virtual machine; change a configuration of the virtual machine to satisfy the first connection permission condition in response to a determination that the virtual machine does not satisfy the first connection permission condition; change a configuration of the physical device to satisfy the second connection permission condition in response to a determination that the physical device does not satisfy the second connection permission condition; and accept the received connection request to connect the physical device to the virtual machine in response to a determination that the virtual machine satisfies the first connection permission condition and that the physical device satisfies the second connection permission condition. ### Claim 16 (depends on 15) The computer program product according to claim 15, wherein the program instructions are further configured to cause the processor to: reject the connection request in response to a determination that the change in the configuration of the virtual machine fails or does not satisfy the first connection permission condition; and reject the connection request in response to a determination that the change in the configuration of the physical device fails or does not satisfy the second connection permission condition. ### Claim 17 (depends on 15) The computer program product according to claim 15, wherein the program instructions are further configured to cause the processor to: dynamically detect a change in at least one of the configuration of the virtual machine, a context of the virtual machine, the configuration of the physical device, or a context of the physical device; and in response to a determination that the dynamically detected change does not satisfy at least one of the first connection permission condition or the second connection permission condition, perform at least one of: cancelling the dynamically detected change; invalidating the dynamically detected change; returning the dynamically detected change to a state prior to changing; or disconnecting the connection between the virtual machine and the physical device. ### Claim 18 (depends on 15) The computer program product according to claim 15, wherein the program instructions are further configured to cause the processor to obtain a latest configuration and a latest context of each of the virtual machine and the physical device in response to receipt of the connection request. ### Claim 19 (depends on 18) The computer program product according to claim 18, wherein the program instructions are further configured to cause the processor to: determine whether the latest configuration of the virtual machine and the latest context of the virtual machine satisfy the first connection permission condition; and determine whether the latest configuration of the physical device and the latest context of the physical device satisfy the second connection permission condition. ### Claim 20 (depends on 15) The computer program product according to claim 15, wherein the first connection permission condition comprises a setting of at least one of a configuration of the virtual machine or a context of virtual machine; and wherein the second connection permission condition comprises a setting of at least one of a configuration of the physical device or a context of the physical device.