Tag based permission system and method for virtualized environments

Patent metadata

Field	Value
Publication number	US-9971613-B2
Application number	US-201314046063-A
Country	US
Kind code	B2
Filing date	Oct 4, 2013
Priority date	Oct 4, 2013
Publication date	May 15, 2018
Grant date	May 15, 2018

Abstract

A virtualized computing system includes a plurality of inventory objects and an access control subsystem that manages permissions to perform actions on the inventory objects using corresponding access control labels of the inventory objects. Permissions are managed by detecting a change in an association of a tag with an inventory object, where the tag defines one or more users and one or more privileges. In response to the detecting, an access control label of the inventory object is updated based on the users and privileges that are defined by the tag.

First claim

I claim:

1. In a virtualized computing system having a plurality of inventory objects and an access control subsystem that manages permissions to perform actions on the inventory objects, a method of managing the permissions comprising:
generating a plurality of tags, wherein each tag of the plurality of tags defines an association between one or more users and one or more privileges, and is free from an association with the plurality of inventory objects, wherein a first tag of the plurality of tags comprises first associations between a one or more users and a one or more privileges;
generating one or more access control labels in response to detecting that the one or more inventory objects are tagged with the first tag, wherein:
a first access control label of the one or more access control labels specifies a first user, a first privilege of the first tag, and a first tagged inventory object;
a second access control label of the one or more access control labels specifies the first user, a second privilege of the first tag, and a second tagged inventory object; and
wherein the first privilege and the second privilege are different;
wherein the inventory object is one of a virtual machine, a host, a datastore, and a network;
wherein the tag is associated with the inventory object and with at least one other inventory object that is of a different type; and

permitting or denying operations to be performed on the inventory object based on the generated access control labels.

2. The method of claim 1 , wherein a separate access control label is generated for each combination of the users and privileges that are defined by the tag.

3. In a virtualized computing system having a plurality of inventory objects and an access control subsystem that manages permissions to perform actions on the inventory objects, a method of managing the permissions comprising:
generating a plurality of tags, wherein each tag of the plurality of tags defines an association between one or more users and one or more privileges, and is free from an association with the plurality of inventory objects, wherein a first tag of the plurality of tags comprises first associations between a one or more users and a first one or more privileges;
detecting a change in contents of the first tag, wherein the change in the contents corresponds to an association between the one or more users and a second one or more privileges, wherein the second one or more privileges differs from the first one or more privileges;
in response to said detecting, generating one or more access control labels for the second associations, each of the one or more access control label specifying a different association between a respective one of the first one or more users and a respective one of the second one or more privileges of the first tag and the inventory object;
wherein the inventory object is one of a virtual machine, a host, a datastore, and a network;
wherein the tag is associated with the inventory object and with at least one other inventory object that is of a different type; and
permitting or denying operations to be performed on the inventory object based on the generated access control labels.

4. The method of claim 3 , wherein the change in contents occurs as a result of a change in the users defined by the tag.

5. The method of claim 3 , wherein the change in contents occurs as a result of a change in the privileges defined by the tag.

6. The method of claim 3 , wherein a separate access control label is generated for each combination of the users and privileges that are defined by the tag.

7. A virtualized computing system comprising:
a host computer executing virtualization software configured to support the execution of virtual machines therein; and
a management server computer running therein an access control system configured to manage permissions to the host and the virtual machines, the management server configured to:
generate a plurality of tags, wherein each tag of the plurality of tags defines an association between one or more users and one or more privileges, and is free from an association with the plurality of inventory objects, wherein a first tag of the plurality of tags comprises first associations between a one or more users and a one or more privileges;
tag an inventory object with the tag;
generate one or more access control labels in response to detecting that the one or more inventory objects is tagged with the first tag, wherein:
a first access control label of the one or more access control labels specifies a first user, a first privilege of the first tag and a first tagged inventory object;
a second access control label of the one or more access control labels specifies the first user, a second privilege of the first tag and a second tagged inventory object; and
wherein the first privilege and the second privilege are different;
wherein the inventory object is one of a virtual machine, a host, a datastore, and a network;
wherein the tag is associated with the inventory object and with at least one other inventory object that is of a different type; and

permit or deny operations to be performed on the inventory object based on the generated access control labels.

8. The virtualized computing system of claim 7 , wherein a separate access control label is generated for each combination of the users and privileges that are defined by the tag.

Assignees

• Vmware Inc

Inventors

• Yang Jianping

Classifications

• G06F21/53

  by executing in a restricted environment, e.g. sandbox or secure virtual machine · CPC title

• G06F21/6218 Primary

  to a system of files or objects, e.g. local or distributed file system or database · CPC title

• G06F9/455 Primary

  Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines · CPC title

• G06F21/12

  Protecting executable software · CPC title

• H04L12/18

  for broadcast or conference {, e.g. multicast} · CPC title