# US 8,544,003 B1 · System and method for managing virtual machine configurations > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,544,003 B1 - Document ID: US8544003B1 - Status: Granted - Kind: B1 - Application number: 12/636,414 - Filed: 2009-12-11 - Published: 2013-09-19 - Granted: 2013-09-24 - Earliest claimed: 2008-12-11 - Assignees: McAfee, Inc. - Applicants: Harvinder Singh Sawhney; Suman Saraf; Rosen Sharma - Inventors: Harvinder Singh Sawhney; Suman Saraf; Rosen Sharma - Web page: https://patentgrep.com/patent/US8544003B1 ## CPC - G06F 21/50: Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems - G06F 21/74: operating in dual or compartmented mode, i.e. at least one secure mode - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method in one example implementation includes receiving a plurality of command messages through a control channel and reconstructing the command messages to determine an intended command for one or more virtual machines on a server device. The command messages include one or more criteria and the intended command corresponds to an operation defined in a policy database. The method also includes determining whether the corresponding operation is permitted by comparing one or more policies associated with the operation to the one or more criteria. The method further includes sending the command messages to the server device if the operation is permitted. In more specific embodiments, the operation may include one of creating, cloning, deleting, starting, stopping, and modifying the one or more virtual machines. ## Claims ### Claim 1 A method, comprising: receiving a plurality of command messages through a control channel, wherein the plurality of command messages includes one or more criteria; reconstructing the plurality of command messages to determine an intended command for configuring one or more virtual machines on a server device, wherein the intended command corresponds to an operation defined in a policy database; determining whether the plurality of command messages are received from a control proxy, wherein the server device is disabled from performing operations associated with the plurality of configuration commands based, at least in part, on whether they are received from the control proxy; determining if the operation is permitted by comparing one or more policies associated with the operation to the one or more criteria; and sending the plurality of command messages to the server device if the operation is permitted. ### Claim 2 (depends on 1) The method of claim 1, wherein the operation includes one of creating, cloning, deleting, starting, stopping, and modifying the one or more virtual machines. ### Claim 3 (depends on 1) The method of claim 1, wherein the operation includes configuring a selected one of a group of hardware components of one of the virtual machines, the group of hardware components consisting of: a processor, a CD drive, a DVD drive, a floppy drive, a memory element, a SCSI device, a network adapter, a parallel port, and a serial port. ### Claim 4 (depends on 1) The method of claim 1, wherein the plurality of command messages use Simple Object Access Protocol (SOAP) messaging framework. ### Claim 5 (depends on 1) The method of claim 1, wherein the control proxy is adapted to receive only the plurality of command messages through the control channel. ### Claim 6 (depends on 1) The method of claim 1, further comprising, creating the policy database with the one or more policies and a plurality of operations for configuring the one or more virtual machines on the server device, wherein the one or more policies are mapped to selected operations of the plurality of operations. ### Claim 7 (depends on 1) The method of claim 1, further comprising: sending an error message to be displayed on the client device when the operation corresponding to the intended command is not permitted. ### Claim 8 (depends on 1) The method of claim 1, wherein the one or more criteria includes a user sending the message, a time of day the message is sent, and an address of the client device. ### Claim 9 (depends on 1) The method of claim 1, wherein one of the policies includes a predefined time of day the operation is permissible, and wherein one of the criteria includes the time of day the message is sent. ### Claim 10 A non-transitory media having logic stored therein to perform operations comprising: receiving a plurality of command messages through a control channel, wherein the plurality of command messages includes one or more criteria; reconstructing the plurality of command messages to determine an intended command for configuring one or more virtual machines on a server device, wherein the intended command corresponds to an operation defined in a policy database; determining whether the plurality of command messages are received from a control proxy, wherein the server device is disabled from performing operations associated with the plurality of configuration commands based, at least in part, on whether they are received from the control proxy; determining if the operation is permitted by comparing one or more policies associated with the operation to the one or more criteria; and sending the plurality of command messages to the server device if the operation is permitted. ### Claim 11 (depends on 10) The media of claim 10, wherein the operation includes one of creating, cloning, deleting, starting, stopping, and modifying the one or more virtual machines. ### Claim 12 (depends on 10) The media of claim 10, wherein the control proxy is adapted to receive only the plurality of command messages through the control channel. ### Claim 13 (depends on 10) The media of claim 10, the processor being operable to perform operations comprising: creating the policy database with the one or more policies and a plurality of operations for configuring the one or more virtual machines on the server device, wherein the one or more policies are mapped to selected operations of the plurality of operations. ### Claim 14 (depends on 10) The media of claim 10, the processor being operable to perform operations comprising: sending an error message to be displayed on the client device when the operation corresponding to the intended command is not permitted. ### Claim 15 (depends on 10) The media of claim 10, wherein one of the policies includes a predefined time of day the operation is permissible, and wherein one of the criteria includes the time of day the message is sent. ### Claim 16 A control proxy, comprising: a memory component configured to store a policy database; and a processor operable to execute instructions associated with a protocol message module and a policy module, including: receiving a plurality of command messages through a control channel, wherein the plurality of command messages includes one or more criteria; reconstructing the plurality of command messages to determine an intended command for configuring one or more virtual machines on a server device, wherein the intended command corresponds to an operation defined in a policy database; determining whether the plurality of command messages are received from a control proxy, wherein the server device is disabled from performing operations associated with the plurality of configuration commands based, at least in part, on whether they are received from the control proxy; determining if the operation is permitted by comparing one or more policies associated with the operation to the one or more criteria; and sending the plurality of command messages to the server device if the operation is permitted. ### Claim 17 (depends on 16) The control proxy of claim 16, wherein the operation includes one of creating, cloning, deleting, starting, stopping, and modifying the one or more virtual machines. ### Claim 18 (depends on 16) The control proxy of claim 16, wherein the control proxy is adapted to receive only the plurality of command messages through the control channel. ### Claim 19 (depends on 16) The control proxy of claim 16, wherein the processor is operable to execute instructions associated with an administration module comprising: creating the policy database with the one or more policies and a plurality of operations for configuring the one or more virtual machines on the server device, wherein the one or more policies are mapped to selected operations of the plurality of operations. ### Claim 20 (depends on 16) The control proxy of claim 16, wherein one of the policies includes a predefined time of day the operation is permissible, and wherein one of the criteria includes the time of day the message is sent.