Access management to instances on the cloud

Managing access to instances on a public cloud can include in responding to a request from a user to create a support account for a target instance on a public network. A process can include generating a key pair including a public key and a private key, creating, in the target instance, a support account, and associating the public key with the target instance. Access to the private key can be provided to facilitate a connection to the target instance through the support account. Temporary credentials can be generated and associated with the target instance. Upon expiration of the temporary credentials, the support account can be disabled by removing the support account from the target instance and disassociating the public key with the target instance.

RELATED APPLICATIONS

This application claims priority, under 35 U.S.C. Section 119, of China Patent Application 201810879335.3 filed on Aug. 3, 2018 and entitled “ACCESS MANAGEMENT TO INSTANCES ON THE CLOUD.”

TECHNICAL FIELD

Embodiments of the present invention relate generally to cloud instances. More particularly, embodiments of the invention relate to managing access to instances on the public cloud.

BACKGROUND

A cloud service can provide computing capacity over a network. Cloud computing generally includes virtual computing environments, known as instances. Instances can come in the form of a virtual machine or virtual server, each capable of having an operating system and additional applications.

A variety of instance types exist, some optimized to fit specific use cases, while some instance types are developed for general purpose. Instance types can have varying combinations of memory, CPU, and networking capabilities.

Organizations are increasingly deploying applications on virtual machines (VMs) to improve Information Technology (IT) efficiency and application availability. A key benefit of adopting virtual machines is that they can be hosted on a smaller number of physical servers (VM servers).

DETAILED DESCRIPTION

A public cloud can be described as computing services offered by third-party providers over the public Internet. These services can include virtual machines (VMs), applications or storage. The services can be provided in the form of virtual computing environments, or instances.

Key based authentication can be used to improve security on the public cloud. For example, connection to instances (e.g., logging in to an instance) can be performed through a key pair, including a public key and a private key. A public key can be stored by a manager, or on the instance (for example, in a key list). A private key can be stored by a user, to be kept in a secure place, not accessible to the public. Because the private key is required to access the instance, this allows for the management of multiple instances securely, because only users need a private key to access instances having a corresponding public key. The private key, therefore, is critical to security on the public cloud and should not be shared by the user with others.

Problems can occur in an instance, however, that may require professional services or tech support. For example, if an application on the instance stalls or is behaving questionably, a user may request the help of tech support. In some cases, maintenance may be required to be performed on an instance. Thus, there are situations where a user may want another user (for example, tech support) to log into the instance. One solution for this that does not require key sharing is remote controlling, where the tech support remotes into (and controls) the user's computer, where the user is logged into the instance. In this manner, the tech support or service professional can access the instance. Unfortunately, remoting is not always practical, convenient, or possible. For example, scheduling conflicts or operating system conflicts may prevent the ability for remoting.

In the case of key sharing, obvious security risks can arise. For example, tech support may breach the user's trust and perform unauthorized acts with the instance. Furthermore, key sharing may present liability issues on the side of the techsupport, who may be wrongly accused for future security breaches, once the private key has been shared with the technical support.

In one aspect, a system and method resolves the problems described herein through managing and restricting temporary access to instances on the public cloud. A method performed by a computing device can include: in response to a request from a user to create a support account for a target instance on a public network: generating a key pair including a public key and a private key; creating, in the target instance, a support account; associating the public key with the target instance; providing access to the private key, wherein the key pair can facilitate a connection to the target instance through the support account; and generating temporary credentials associated with the target instance. Upon expiration of the temporary credentials, the system and method can include removing the support account from the target instance and disassociating the public key with the target instance, resulting in termination of current connections and barring future connections to the target instance through the key pair.

In one embodiment, a public cloud system100is shown inFIG. 1. A manager150can connect to a network10, where the network is the public internet. Also connected to the network is an end user machine110operated by a user, a client/host120, and admin(s)116. The client/host120can include a virtual machine manager122(e.g., a hypervisor) that creates and manages resources (for example, computational resources and disk storage124) for a plurality of instances, including126127and128.

A user, through the user machine110can request the manager150to create a support account relating to a target instance128and grant permissions for the support account. Although a single host120is shown, the manager150can communicate with multiple hosts over the network10, and manage access to instances along the multiple hosts, as described herein. The manager150can include timers152, a credential manager154configured to generate, monitor, and remove/destroy credentials158, and a key generator156, as well as other typical computer features such as memory, one or more CPUs, network devices, and other software and hardware known in the art.

The key generator156can generate temporary key pairs. An example is shown inFIG. 1, where a key pair including a private key201and a public key202is generated. The public key is associated with instance128. The private key201is held by the end user machine, and the corresponding public key202is associated with instance128, for example, stored in a key list130. Key pairs can be based on known cryptographic algorithms.

Public key204of the second key pair can be similarly associated with the target instance128, and corresponding private key203can be held by a second user116, which can be a machine used by a second user such as an administrator or tech support. The each key pair can be associated with an account in a particular instance. For example, the key pair203and204can be associated with a support account. Thus, access and permissions of the holder of the private key203can be limited to access and permission rights associated with the support account.

The credential manager154can generate credentials relating to the request from the user and the corresponding support account. The credentials can include an identification of a target instance, a key pair, a credential expiration time, and permissions associated with the support account, or combinations thereof.

The credentials can have an expiration time can be implemented through one or more timers152. The timers can trigger actionable events upon an expiration, elapse of a time, or periodic elapses. Actions can include, for example, removing a support account and public key from an instance. It should be understood, however, that a timer, in this case, can take the form of a simple counter that increments or decrements and, upon counting to a predetermined number, is considered by the manager to have elapsed.

Thus, the credentials can link key pairs to target instances and support accounts, and contain information (for example, an expiration time) that allows the manager150to manage access to instances, as described in greater detail below.

As shown inFIG. 2, in one embodiment, an end user110sends a request via path252to create a support account in connection with a target instance to the manager150. The request can include permissions to be associated with the support account and/or an expiration time that determines the lifespan of the support account.

The manager150generates a key pair via path254and sends a request via path256to the host120to create a support account associated with the target instance at block258. The request to the host can include the permissions to be associated with the support account, based on the permissions from the user request. The request to the host256can include the public key generated in254. The host120can create258a support account with the target instance, and associate the public key with the target instance, for example, by storing the public key in an authorized key list associated with the target instance.

The manager150can receive a notification278from the host, confirming that the support account has been created. Alternatively, the manager can simply assume that the support account has been created successfully unless indicated otherwise (for example, through an error message).

The manager150can generate at block260temporary credentials relating to the support account and the target instance and provide via path262a private key of the key pair to a second user (for example, tech support). The private key can be provided for example, as a downloadable key from the public network, or it can be send to a user through email, ftp, or other known delivery methods. A method of providing the private key and/or the recipient of the private key can be specified by the user request152and/or it can be a memory setting in the manager150. The temporary credentials can have an expiration time based on an expiration time specified in the user request252. Alternatively, the expiration time can be a setting in memory, accessible to the manager150. Alternatively or additionally, the expiration time of the credentials can be based on a type of the instance or applications associated with the target instance. The determination can be made, for example, based on a look up table or similar technique that selects an expiration time based on the type of target instance, applications associated with the target instance, or other parameters relating to the target instance.

The second user116can connect264to the target instance by logging into the support account of the instance with the private key. The second user can be a tech support professional logging into the support account to perform support actions such as installing software, troubleshooting, or performing diagnostics and maintenance. The second user's actions can be limited based on the permissions and/or restrictions associated with the support account.

Upon expiration of the temporary credentials266, the manager can send a request268to remove/destroy the support account and disable the public key. The host120can remove or destroy the support account and disassociate the public key from the instance (for example, by removing the public key from authorized key list). When this happens, the all connections based on the public key and the support account will be terminated. Another way to describe this is that the underlying communication protocol (for example, secure socket shell protocol) will terminate the connection between to the instance and the holder of the private key (in this example, second user116) associated with the removed public key.

Beneficially, this provides access to instances with a separate set of permissions, capable of being terminated by the manager, without requiring the original user to share her original private key.

In one embodiment, generating the temporary credentials includes setting a timer and the expiration of the temporary credentials is triggered by an expiration of the timer.

Alternatively or additionally, the expiration of the temporary credentials can be forced by a pre-emptive request267to discontinue or end the support account. Such a request can be initiated by an end user110or a different user (for example, one with administrative privileges) and received by the manager.

Alternatively or additionally, the manager may trigger the expiration of the temporary credentials based on monitored actions of the instance. For example, if the manager detects that the behavior of the instance under the support account violates predetermined rules, the logic processing unit of the manager may pre-emptively remove the support account to prevent further violation of the rules.

In one embodiment, the manager can receive a system log276relating to the support account. For example, the system log can contain actions performed by the support account. The manager can store this log in memory272and/or provide access274to the system logs, for example, to the original user or to administrators. In this manner, the user/owner of the instance as well as administrators can audit the operations and behavior of users of the support account, for example, technical support.

FIG. 3is a flow diagram illustrating a process of managing access to instances on the public cloud is shown. Process300may be performed by processing logic which may include software, hardware, or a combination thereof. For example, process300may be performed by manager150. Referring toFIG. 3, at block302, processing logic receives a request from a user to create a support account for a target instance on a public network.

In response to such a request, at block304, processing logic generates a key pair including a public key and a private key. At block306, in the instance, a support account is created. At block308, the processing logic associates the public key with the target instance. At block310, processing logic provides access to the private key, wherein the private key can provide a connection to the target instance through the support account. At block312processing logic generates temporary credentials associated with the target instance. Processing logic monitors the expiration of the temporary credentials at block314. Monitoring, in this case can be active (e.g., through polling) and/or passive (e.g., event driven).

Upon expiration of the temporary credentials, at block316the processing logic removes the support account from the instance and disassociating the public key from the target instance. This can be done, for example, by removing the public key from the authorized key list associated with the target instance. Connections to the target instance are terminated, as a result.

It is to be understood that, although generally described as managing access to a target instance, the system and methods described herein are repeated in response to a plurality of requests from a plurality of users to manage access to a plurality of instances over a plurality of hosts.

Processing module/unit/logic1528, components and other features described herein can be implemented as discrete hardware components or integrated in the functionality of hardware components such as ASICS, FPGAs, DSPs or similar devices. In addition, processing module/unit/logic1528can be implemented as firmware or functional circuitry within hardware devices. Further, processing module/unit/logic1528can be implemented in any combination hardware devices and software components.