# US 9,436,832 B2 · System and method for virtual image security in a cloud environment > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,436,832 B2 - Document ID: US9436832B2 - Status: Granted - Kind: B2 - Application number: 14/337,771 - Filed: 2014-07-22 - Published: 2014-12-18 - Granted: 2016-09-06 - Earliest claimed: 2012-02-27 - Assignees: CA, Inc. - Applicants: Ca, Inc. - Inventors: Nir Barak; Eitan Hadar - Web page: https://patentgrep.com/patent/US9436832B2 ## CPC - H04L 63/101: {Access control lists [ACL]} - G06F 9/45558: {Hypervisor-specific management and integration aspects} - G06F 9/468: {Specific access rights for resources, e.g. using capability register} - G06F 21/60: Protecting data - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L 63/10: {for controlling access to devices or network resources} - H04W 4/60: Subscription-based services using application servers or record carriers, e.g. SIM application toolkits - G06F 2009/45587: {Isolation or security of virtual machine instances} - G06F 2009/45595: {Network integration; Enabling network access in virtual machine instances} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Systems and methods enabling secure virtual image access in a virtual or cloud computing environment. The systems and methods include assigning a status to indicator to guest virtual machines (virtual images) that provide applications and other services to cloud consumers in the cloud environment. A virtual appliance machine in the cloud environment maintains the status of the guest virtual machines and makes decisions based on the status as to whether to allow access to the guest virtual machines. These decisions are transmitted to local elements on the guest virtual machines, which enforce access control on a local level. In this manner, unauthorized virtual image access is prevented providing increased security and data integrity. ## Claims ### Claim 1 A method to provide secure access in a virtual computing environment, the method executed by a processor comprising hardware, the processor configured to perform a plurality of operations, the operations comprising: assigning, by a virtual access control machine of a virtual computing environment, a status to a guest virtual machine supporting a service, wherein the guest virtual machine is accessible to a user through a network; receiving, at the virtual access control machine, information from the guest virtual machine representative of an attempted use of the guest virtual machine; receiving, at the virtual access control machine, a request, by the guest virtual machine, for the status of the guest virtual machine; determining, at the virtual access control machine, an action to take based on the status; and sending, from the virtual access control machine, information to the guest virtual machine regarding the (i) status of the guest virtual machine in response to the request, or (ii) the action, or (iii) both (i) and (ii). ### Claim 2 (depends on 1) The method of claim 1, wherein assigning a status includes assigning, after the guest virtual machine is created and ready for use, a status indicating that the guest virtual machine is able to be accessed by an authorized user, and wherein the action includes allowing the attempted use of the guest virtual machine to an authorized user. ### Claim 3 (depends on 1) The method of claim 1, wherein assigning a status includes assigning a status indicating that the guest virtual machine is not to be used by anyone, and wherein the action includes preventing the attempted use of the guest virtual machine. ### Claim 4 (depends on 3) The method of claim 3, further comprising recording an indication of the prevented attempted use of the guest virtual machine. ### Claim 5 (depends on 3) The method of claim 3, wherein the action further comprises sending an alert regarding the unauthorized attempt to start the guest virtual machine. ### Claim 6 (depends on 1) The method of claim 1, wherein assigning a status includes assigning a status indicating that an alert is to be sent upon receipt of any attempted use of the guest virtual machine, and wherein the action includes sending the alert. ### Claim 7 (depends on 1) The method of claim 1, wherein assigning a status includes changing a status of the guest virtual machine from a status indicating that the guest virtual machine is able to be accessed by an authorized user to a status indicating that the guest virtual machine is not to be used by anyone, and wherein the action includes preventing the attempted use of the guest virtual machine. ### Claim 8 (depends on 1) The method of claim 1, further comprising providing a report regarding a plurality of guest virtual machines in the virtual machine environment, wherein the report includes information regarding one or more selected from: attempted use of any of the plurality of guest virtual machines, denied use attempts of any of the plurality of guest virtual machines, or any of the plurality of guest virtual machines that have not been used in a predetermined amount of time. ### Claim 9 A system to provide secure access in a virtual computing environment, the system comprising: a processor comprising hardware, the processor configured to: assign, by a virtual access control machine of a virtual computing environment, a status to a guest virtual machine supporting a service, wherein the guest virtual machine is accessible to a user through a network, receive, at the virtual access control machine, information from the guest virtual machine representative of an attempted use of the guest virtual machine, receive, at the virtual access control machine, a request, by the guest virtual machine, for the status of the guest virtual machine, determine, at the virtual access control machine, an action to take based on the status, and send, from the virtual access control machine, information to the guest virtual machine regarding the (i) status of the guest virtual machine in response to the request, or (ii) the action, or (iii) both (i) and (ii). ### Claim 10 (depends on 9) The system of claim 9, wherein the processor configured to assign a status is further configured to assign, after the guest virtual machine is created and ready for use, a status indicating that the guest virtual machine is able to be accessed by an authorized user, and wherein the action includes allowance of the attempted use of the guest virtual machine to an authorized user. ### Claim 11 (depends on 9) The system of claim 9, wherein the processor configured to assign a status is further configured to assign a status indicating that the guest virtual machine is not to be used by anyone and wherein the action includes prevention of the attempted use of the guest virtual machine. ### Claim 12 (depends on 11) The system of claim 11, wherein the processor is further configured to record an indication of the prevented attempted use of the guest virtual machine. ### Claim 13 (depends on 11) The system of claim 11, wherein the action further comprises sending of an alert regarding the unauthorized attempt to start the guest virtual machine. ### Claim 14 (depends on 9) The system of claim 9, wherein the processor configured to assign a status is further configured to assign a status indicating that an alert is to be sent upon receipt of any attempted use of the guest virtual machine, and wherein the action includes sending the alert. ### Claim 15 (depends on 9) The system of claim 9, wherein the processor configured to assign a status is further configured to change a status of the guest virtual machine from a status indicating that the guest virtual machine is able to be accessed by an authorized user to a status indicating that the guest virtual machine is not to be used by anyone, and wherein the action includes prevention of the attempted use of the guest virtual machine. ### Claim 16 (depends on 9) The system of claim 9, wherein the processor is further configured to provide a report regarding a plurality of guest virtual machines in the virtual machine environment, wherein the report includes information regarding one or more selected from: attempted use of any of the plurality of guest virtual machines, denied use attempts of any of the plurality of guest virtual machines, or any of the plurality of guest virtual machines that have not been used in a predetermined amount of time. ### Claim 17 A non-transitory computer-readable medium including computer-executable instructions thereon, the computer-executable instructions, when executed, causing a processor to: assign, by a virtual access control machine of a virtual computing environment, a status to a guest virtual machine supporting a service, wherein the guest virtual machine is accessible to a user through a network; receive, at the virtual access control machine, information from the guest virtual machine representative of an attempted use of the guest virtual machine; receive, at the virtual access control machine, a request, by the guest virtual machine, for the status of the guest virtual machine; determine, at the virtual access control machine, an action to take based on the status; and send, from the virtual access control machine, information to the guest virtual machine regarding the (i) status of the guest virtual machine in response to the request, or (ii) the action, or (iii) both (i) and (ii). ### Claim 18 (depends on 17) The computer-readable medium of claim 17, wherein the instructions to assign a status include instructions to assign a status indicating that the guest virtual machine is not to be used by anyone, and wherein the action includes preventing the attempted use of the guest virtual machine. ### Claim 19 (depends on 17) The computer-readable medium of claim 17, wherein the instructions to assign a status include instructions to assign a status indicating that an alert is to be sent upon receipt of any attempted use of the guest virtual machine, and wherein the action includes sending the alert. ### Claim 20 (depends on 17) The computer-readable medium of claim 17, wherein the instructions to assign a status include instructions to change a status of the guest virtual machine from a status indicating that the guest virtual machine is able to be accessed by an authorized user to a status indicating that the guest virtual machine is not to be used by anyone, and wherein the action includes preventing the attempted use of the guest virtual machine.