Method and apparatus to secure and protect data-centers and generalized utility-based cloud computing environments from uninvited guests in the form of both hardware and software

A network device configured to detect a presence of unauthorized software and hardware in a datacenter, the network device comprising:

• a set of one or more processors;
• and
• a non-transitory machine-readable storage medium having stored therein a cloud orchestration component, which when executed by the set of one or more processors, causes the network device to initiate deployment of a virtual agent on a node in the datacenter, wherein the virtual agent is to perform a security scan of the node and store results of the security scan in a memory allocated to the virtual agent at the node, and wherein the results of the security scan are to be encrypted by the virtual agent using a data encryption key and initiate migration of the virtual agent to a preconfigured location that has been previously configured with a data decryption key for decrypting the results of the security scan prior to the migration of the virtual agent to the preconfigured location, wherein the results of the security scan are to be extracted from the virtual agent and decrypted at the preconfigured location using the data decryption key.

A non-transitory machine-readable medium having computer code stored therein, which when executed by a set of one or more processors of a network device communicatively coupled to a datacenter, causes the network device to perform operations for detecting a presence of unauthorized software and hardware in the datacenter, the operations comprising:

• initiating deployment of a virtual agent on a node in the datacenter, wherein the virtual agent is to perform a security scan of the node and store results of the security scan in a memory allocated to the virtual agent at the node, and wherein the results of the security scan are to be encrypted by the virtual agent using a data encryption key;
• and
• initiating migration of the virtual agent to a preconfigured location that has been previously configured with a data decryption key for decrypting the results of the security scan prior to the migration of the virtual agent to the preconfigured location, wherein the results of the security scan are to be extracted from the virtual agent and decrypted at the preconfigured location using the data decryption key.