System and method to securely execute datacenter management operations remotely

Patent metadata

Field	Value
Publication number	US-11700262-B2
Application number	US-202117141734-A
Country	US
Kind code	B2
Filing date	Jan 5, 2021
Priority date	Apr 19, 2018
Publication date	Jul 11, 2023
Grant date	Jul 11, 2023

Abstract

Disclosed in various examples are methods, systems, and machine-readable media for exposing a Representational State Transfer (RESTful) interface to users whereby management commands on a datacenter may be issued remotely from the users' workstations for secure, remote management of the datacenter. An application task automation command (e.g., a POWERSHELL® command) is executed remotely by creating a proxy command (e.g., based on a POWERSHELL® cmdlet code) to cause the application task automation command to be executed when the proxy command is remotely invoked and deploying the proxy command to a remote computer, such as the user's workstation. The remote computer issues a request including a user identifier and any parameters for the application task automation command when the corresponding proxy command has been invoked by the remote computer. The datacenter determines whether the user is authorized to execute the application task automation command invoked by the proxy command, and upon authorization of the user, the datacenter computer runs the application task automation command with any parameters provided in the request to control configuration of, or data stored on, at least one computer in the datacenter.

First claim

What is claimed is:

1. A method for executing an application task automation command of a datacenter computer on a remote computer, comprising:
receiving, from the remote computer; a request comprising a user identifier and an exposed parameter for the application task automation command that is being invoked by a proxy command at the remote computer, the proxy command forming a wrapper around a configuration command that identifies and exposes the exposed parameter used by the configuration command;
determining, from the user identifier, whether the user is authorized to execute the application task automation command corresponding to the invoked proxy command; and
upon authorization of the user, running, at the datacenter computer, the application task automation command with the exposed parameter.

2. The method of claim 1 , further comprising:
creating the proxy command of the application task automation command by forming the wrapper around the configuration command, the exposed parameter being attached to the configuration command; and
deploying the proxy command and the exposed parameter to the remote computer.

3. The method of claim 2 , wherein creating the proxy command comprises:
accessing the cmdlet command line syntax corresponding to a cmdlet function.

4. The method of claim 2 , wherein deploying the proxy command and the exposed parameter to the remote computer further comprises:
forming a proxy command package comprising the proxy command and the exposed parameter;
encrypting the proxy command package; and
uploading the encrypted proxy command package to a shared server that the remote computer has access to.

5. The method of claim 1 , wherein the datacenter computer and the remote computer communicate the request via a Representational State Transfer (RESTful) interface.

6. The method of claim 1 , wherein the user identifier and the selected proxy command are encrypted before being communicated to the datacenter computer by the remote computer.

7. The method of claim 1 , wherein the request is signed using a token authenticating a user having the user identifier and wherein the request is evaluated by the datacenter computer to authorize the user before the datacenter computer is permitted to run the application task automation command corresponding to the proxy command invoked by the remote computer.

8. The method of claim 1 , wherein the application task automation command comprises a command-line shell and scripting language command for controlling configuration of data stored on the datacenter computer based on the exposed parameter.

9. The method of claim 1 , wherein the proxy command is encrypted and deployed on the remote computer via a remote server.

10. The method of claim 1 , wherein the proxy command is based on a cmdlet code of the command-line shell and scripting language.

11. A system for executing an application task automation command of a datacenter computer from a remote computer, comprising:
a processor; and
a memory including instructions that when executed by the processor cause the processor to perform operations comprising:
receiving, from the remote computer, a request comprising a user identifier and an exposed parameter for the application task automation command that is being invoked by a proxy command at the remote computer, the proxy command forming a wrapper around a configuration command that identifies and exposes the exposed parameter used by the configuration command;
determining, from the user identifier, whether the user is authorized to execute the application task automation command corresponding to the invoked proxy command; and
upon authorization of the user, running, at the datacenter computer, the application task automation command with the exposed parameter.

12. The system of claim 11 , wherein the operations further comprise:
creating the proxy command of the application task automation command by forming the wrapper around the configuration command, the exposed parameter being attached to the configuration command; and
deploying the proxy command and the exposed parameter to the remote computer.

13. The system of claim 12 , wherein creating the proxy command comprises:
accessing the cmdlet command line syntax corresponding to a cmdlet function.

14. The system of claim 12 , wherein deploying the proxy command and the exposed parameter to the remote computer further comprises:
forming a proxy command package comprising the proxy command and the exposed parameter;
encrypting the proxy command package; and
uploading the encrypted proxy command package to a shared server that, the remote computer has access to.

15. The system of claim 11 , wherein the datacenter computer and the remote computer communicate the request via a Representational State Transfer (RESTful) interface.

16. The system of claim 11 , wherein the user identifier and the selected proxy command are encrypted before being communicated to the datacenter computer by the remote computer.

17. The system of claim 11 , wherein the request is signed using a token authenticating a user having the user identifier and wherein the request is evaluated by the datacenter computer to authorize the user before the datacenter computer is permitted to run the application task automation command corresponding to the proxy command invoked by the remote computer.

18. The system of claim 11 , wherein the application task automation command comprises a command-line shell and scripting language command for controlling configuration of data stored on the datacenter computer based on the exposed parameter.

19. The system of claim 11 , wherein the proxy command is encrypted and deployed on the remote computer via a remote server, wherein the proxy command is based on a cmdlet code of the command-line shell and scripting language.

20. A non-transitory computer readable storage medium having instructions stored thereon that when executed by a user processor remote from a datacenter computer cause the user processor to implement a method for executing a datacenter application task automation command of the datacenter computer at the user processor; the method comprising:
receiving, from the remote computer, a request comprising a user identifier and an exposed parameter for the application task automation command that is being invoked by a proxy command at the remote computer, the proxy command forming a wrapper around a configuration command that identifies and exposes the exposed parameter used by the configuration command;
determining, from the user identifier, whether the user is authorized to execute the application task automation command corresponding to the invoked proxy command; and
upon authorization of the user, running, at the datacenter computer, the application task automation command with the exposed parameter.

Assignees

• Microsoft Technology Licensing Llc

Inventors

• Ahuja Vikas
• Hendrickson Joel T
• Zhang Xiaoting
• Zeng Yi

Classifications

• G06F9/45512

  Command shells · CPC title

• G06F9/547

  Remote procedure calls [RPC]; Web services · CPC title

• H04L63/102 Primary

  Entity profiles · CPC title

• H04L2463/082

  applying multi-factor authentication · CPC title

• H04L63/0428

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title