Authenticating certificate packages with asymmetric keys

Abstract

Operations of a digital signature manager may include: detecting a set of one or more new certificate authority (CA) certificates in a certificate repository on a first virtual cloud network; transmitting a CA data set comprising a set of one or more new CA certificates to a key management service hosted on a second virtual cloud network; receiving, from the key management service, a digital signature of a CA dataset generated based on at least a global private key stored in a private key repository associated with the key management service on the second virtual cloud network; and storing the digital signature in a certificate repository in a data structure associating the digital signature with the CA data set.

Description

Technical Field

[0001] This disclosure relates to asymmetric cryptography. More specifically, this disclosure relates to digitally signing and verifying certificate packets, including certificate authority certificates, using asymmetric keys. Background Technology

[0002] A virtual cloud network comprises network entities that communicate with each other. Communication between network entities can be performed according to security protocols, whereby network entities authenticate each other by presenting digital certificates. When one network entity presents a valid digital certificate to another network entity, the other network entity can trust that it is communicating with that network entity (and not some unknown entity) based on the trust relationship with the CA that issued the digital certificate.

[0003] Digital certificates can be issued by a Certificate Authority (CA) to network entities. A digital certificate may include a digital signature generated using the private key of the CA that issued the digital certificate. The digital signature can be verified using a CA certificate that includes the public key corresponding to the private key. Various CA certificates that can be used to verify digital certificates issued to various network entities can be included in a certificate package. The certificate package can be distributed to network entities throughout the virtual cloud network. For example, the certificate package can be installed when initializing the virtual cloud network and / or when initializing various network entities on the virtual cloud network. Additionally, the certificate package can be updated or replaced from time to time, for example, to make new CA certificates available to network entities and / or to remove old CA certificates.

[0004] The content of this background section should not be construed as prior art simply because it appears in this section. Attached Figure Description

[0005] The accompanying figures illustrate embodiments by way of example and not limitation. It should be noted that the terms "a" or "an" embodiment used in this disclosure do not necessarily refer to the same embodiment, and mean at least one. In the figures:

[0006] Figures 1-4 This is a block diagram illustrating a pattern for implementing a cloud infrastructure as a service system according to one or more embodiments;

[0007] Figure 5 It is a hardware system according to one or more embodiments;

[0008] Figure 6A and Figure 6B The illustration shows features of an example system according to one or more embodiments;

[0009] Figure 7This is a flowchart illustrating an example certificate package distribution process for distributing a set of CA certificates to network entities associated with a virtual cloud network, according to one or more embodiments.

[0010] Figures 8A-8C This is a flowchart illustrating example operations related to verifying certificate packets using asymmetric keys according to one or more embodiments;

[0011] Figure 9 This is a flowchart illustrating example operations related to the provisioning of cloud resource instances associated with a virtual cloud network, according to one or more embodiments; and

[0012] Figure 10 This is a flowchart illustrating further example operations related to the provisioning of cloud resource instances associated with a virtual cloud network, according to one or more embodiments. Detailed Implementation

[0013] In the following description, numerous specific details are set forth for ease of explanation in order to provide a thorough understanding. One or more embodiments may be practiced without these specific details. Features described in one embodiment may be combined with features described in different embodiments. In some examples, well-known structures and devices are described in the form of block diagrams to avoid unnecessarily obscuring the invention.

[0014] 1. General Overview

[0015] 2. Cloud computing technology

[0016] 3. Computer System

[0017] 4. System Architecture Overview

[0018] 5. Authenticating network entities

[0019] 6. Sample Certificate Package Distribution Processing

[0020] 7. Verify Certificate Authority Dataset

[0021] 8. Provisioning cloud resource instances

[0022] 9. Retrieve and install certificate packages

[0023] 10. Miscellaneous; Extension

[0024] 1. General Overview

[0025] One or more embodiments use a global public key corresponding to a global private key used by a key management service hosted on a separate VCN to digitally sign a Certificate Authority (CA) dataset to verify a CA dataset associated with a Virtual Cloud Network (VCN). The CA dataset may include a collection of one or more CA certificates. When a new CA dataset is added to a certificate store on an ancillary VCN, a digital signature manager on the ancillary VCN transfers the CA dataset to a key management service hosted on a home VCN. The key management service digitally signs the CA dataset using a global private key and transfers the digital signature of the CA dataset to the digital signature manager. The digital signature manager stores the digital signature in a data structure in the certificate store that associates the digital signature with the CA dataset. The CA dataset can then be distributed to network entities (such as cloud resource instances) on the ancillary VCN, and the network entities can verify the CA dataset using the global public key corresponding to the global private key before installing one or more CA certificates from the CA dataset.

[0026] In one example, a CA dataset may be distributed to network entities in connection with the initial provision of the VCN and / or with the initial provision of one or more network entities associated with the VCN. Advantageously, a digital signature of the CA dataset using a global private key can serve as a source of trust for one or more CA certificates within the CA dataset. In one example, the digital signature of the CA dataset can provide an alternative to the "first-use trust" anti-security model. For example, a key management service on the home VCN can generally be considered a trusted network entity, and verification of the CA dataset using a global public key provides the guarantee that the CA dataset from which one or more CA certificates are being installed is identical to the CA dataset digitally signed by the key management service using a global private key.

[0027] One or more embodiments described in this specification and / or set forth in the claims may not be included in this "General Overview" section.

[0028] 2. Cloud computing technology

[0029] Infrastructure as a Service (IaaS) is an application of cloud computing technology. IaaS can be configured to provide virtualized computing resources over a public network (e.g., the Internet). In the IaaS model, cloud providers can host infrastructure components (e.g., servers, storage devices, network nodes (e.g., hardware), deployment software, platform virtualization (e.g., hypervisor layer), etc.). In some cases, IaaS providers can also offer various services to accompany these infrastructure components (example services include billing software, monitoring software, logging software, load balancing software, clustering software, etc.). Therefore, because these services may be policy-driven, IaaS users can implement policies to drive load balancing to maintain application availability and performance.

[0030] In some cases, IaaS customers can access resources and services over a wide area network (WAN) such as the Internet and can use the cloud provider's services to install the remaining elements of the application stack. For example, a user can log in to the IaaS platform to create virtual machines (VMs), install an operating system (OS) on each VM, deploy middleware such as databases, create buckets for workloads and backups, and even install enterprise software into the VM. The customer can then use the provider's services to perform various functions, including balancing network traffic, troubleshooting application issues, monitoring performance, and managing disaster recovery.

[0031] In some cases, cloud computing models will involve the involvement of cloud providers. Cloud providers can, but do not need to, be third-party providers specializing in (e.g., provisioning, renting, selling) IaaS services. Entities may also choose to deploy private clouds, thus becoming their own infrastructure service providers.

[0032] In some examples, IaaS deployment involves the processing of implementing a new application or a new version of an application on a prepared application server or other similar device. IaaS deployment may also include the processing of server preparation (e.g., installation libraries, daemons, etc.). Deployment processing is typically managed by the cloud provider and resides below the hypervisor layer (e.g., servers, storage devices, network hardware, and virtualization). Therefore, the customer may be responsible for processing (OS), middleware, and / or application deployment (e.g., on self-service virtual machines, etc., which can be started on demand).

[0033] In some examples, IaaS provisioning can refer to acquiring computers or virtual hosts for use, and even installing the necessary libraries or services on them. In most cases, deployment does not include provisioning, and provisioning may need to be performed first.

[0034] In some cases, there are challenges in IaaS provisioning. There are initial challenges in provisioning the initial set of infrastructure. After the initial provisioning is complete, there are additional challenges in evolving the existing infrastructure (e.g., adding new services, changing services, removing services, etc.). In some cases, these challenges can be addressed by enabling configurations that declaratively define the infrastructure. In other words, the infrastructure (e.g., which components are needed and how they interact) can be defined by one or more profiles. Therefore, the overall topology of the infrastructure (e.g., which resources depend on which resources and how they work together) can be described declaratively. In some cases, after the topology is defined, workflows for creating and / or managing the different components described in the profiles can be generated.

[0035] In some examples, the infrastructure can have many interconnected elements. For example, there may be one or more Virtual Private Clouds (VPCs) (e.g., potential on-demand pools of configurable and / or shared computing resources), also known as the core network. In some examples, there may also be one or more inbound / outbound traffic group rules, provisioned to define how inbound and / or outbound traffic will be configured for the network, and one or more Virtual Machines (VMs). Other infrastructure elements, such as load balancers, databases, etc., may also be provisioned. The infrastructure can evolve incrementally as more and / or additional infrastructure elements are desired.

[0036] In some cases, continuous deployment techniques can be employed to enable the deployment of infrastructure code across various virtual computing environments. Additionally, the described techniques enable infrastructure management within these environments. In some examples, service teams may write code that they intend to deploy to one or more, but often many, different production environments (e.g., across various geographical locations, sometimes spanning the entire world). In some embodiments, infrastructure and resources can be provisioned (manually and / or using provisioning tools) before deploying the code to be executed on the infrastructure. However, in some examples, the infrastructure on which the code will be deployed must first be set up. In some cases, provisioning can be done manually, resources can be provisioned using provisioning tools, and / or code can be deployed using deployment tools after the infrastructure has been provisioned.

[0037] Figure 1This is a block diagram illustrating an example pattern 100 of an IaaS architecture according to at least one embodiment. Service provider 102 may be communicatively coupled to secure host lease 104, which may include a virtual cloud network (VCN) 106 and a secure host subnet 108. In some examples, service provider 102 may use one or more client computing devices, which may be portable handheld devices (e.g., iPhone®, cellular phone, iPad®, computing tablet, personal digital assistant (PDA)) or wearable devices (e.g., Google Glass® head-mounted display), running software such as Microsoft Windows Mobile® and / or various mobile operating systems such as iOS, Windows Phone, Android, BlackBerry 8, PalmOS, and enabled for the Internet, email, short message service (SMS), Blackberry®, or other communication protocols. Alternatively, client computing devices may be general-purpose personal computers, including, for example, personal computers and / or laptops running various versions of Microsoft Windows®, Apple Macintosh®, and / or Linux operating systems. Client computing devices can be workstation computers running various commercial UNIX® or UNIX-like operating systems (including, but not limited to, various GNU / Linux operating systems, such as, for example, Google Chrome OS). Alternatively, or additionally, client computing devices can be any other electronic devices, such as thin client computers, internet-enabled gaming systems (e.g., Microsoft Xbox game consoles with or without Kinect® gesture input devices), and / or personal messaging devices, which are capable of communicating over a network that can access VCN 106 and / or the internet.

[0038] VCN 106 may include a local peering gateway (LPG) 110, which may be communicatively coupled to a secure shell (SSH) VCN 112 via LPG 110 included in SSH VCN 112. SSH VCN 112 may include an SSH subnet 114, and SSH VCN 112 may be communicatively coupled to a control plane VCN 116 via LPG 110 included in control plane VCN 116. Furthermore, SSH VCN 112 may be communicatively coupled to a data plane VCN 118 via LPG 110. Control plane VCN 116 and data plane VCN 118 may be contained within a service lease 119 that may be owned and / or operated by an IaaS provider.

[0039] The control plane VCN 116 may include a control plane demilitarized zone (DMZ) layer 120 that acts as a peripheral network (e.g., a portion of a corporate network between a corporate intranet and an external network). DMZ-based servers may have limited liability and help control vulnerabilities. Additionally, the DMZ layer 120 may include one or more load balancer (LB) subnets 122, a control plane application layer 124 that may include one or more application subnets 126, and a control plane data layer 128 that may include one or more database (DB) subnets 130 (e.g., one or more front-end DB subnets and / or one or more back-end DB subnets). One or more LB subnets 122 contained in the control plane DMZ layer 120 may be communicatively coupled to one or more application subnets 126 contained in the control plane application layer 124 and an Internet gateway 134 that may be contained in the control plane VCN 116. The application subnets 126 may be communicatively coupled to one or more DB subnets 130 contained in the control plane data layer 128, as well as a service gateway 136 and a Network Address Translation (NAT) gateway 138. The control plane VCN 116 may include the service gateway 136 and the NAT gateway 138.

[0040] The control plane VCN 116 may include a data plane mirror application layer 140, which may include one or more application subnets 126. The one or more application subnets 126 included in the data plane mirror application layer 140 may include a virtual network interface controller (VNIC) 142 capable of executing a compute instance 144. The compute instance 144 may communicatively couple the one or more application subnets 126 of the data plane mirror application layer 140 to the one or more application subnets 126 that may be included in the data plane application layer 146.

[0041] Data plane VCN 118 may include data plane application layer 146, data plane DMZ layer 148, and data plane data layer 150. Data plane DMZ layer 148 may include one or more LB subnets 122 communicatively coupled to one or more application subnets 126 of data plane application layer 146 and Internet gateway 134 of data plane VCN 118. One or more application subnets 126 may be communicatively coupled to service gateway 136 and NAT gateway 138 of data plane VCN 118. Data plane data layer 150 may also include one or more DB subnets 130 communicatively coupled to one or more application subnets 126 of data plane application layer 146.

[0042] The Internet gateway 134 of control plane VCN 116 and data plane VCN 118 can be communicatively coupled to metadata management service 152, which can be communicatively coupled to public Internet 154. Public Internet 154 can be communicatively coupled to NAT gateway 138 of control plane VCN 116 and data plane VCN 118. Service gateway 136 of control plane VCN 116 and data plane VCN 118 can be communicatively coupled to cloud service 156.

[0043] In some examples, the service gateway 136 of the control plane VCN 116 or data plane VCN 118 can make application programming interface (API) calls to the cloud service 156 without traversing the public internet 154. API calls from the service gateway 136 to the cloud service 156 can be unidirectional: the service gateway 136 can make API calls to the cloud service 156, and the cloud service 156 can send the requested data to the service gateway 136. However, the cloud service 156 may not initiate API calls to the service gateway 136.

[0044] In some examples, secure host lease 104 can be directly connected to service lease 119, which would otherwise be isolated. Secure host subnet 108 can communicate with SSH subnet 114 via LPG 110, which enables bidirectional communication between otherwise isolated systems. Connecting secure host subnet 108 to SSH subnet 114 grants secure host subnet 108 access to other entities within service lease 119.

[0045] Control plane VCN 116 may allow users of service lease 119 to configure or otherwise provision desired resources. The desired resources provisioned in control plane VCN 116 may be deployed or otherwise used in data plane VCN 118. In some examples, control plane VCN 116 may be isolated from data plane VCN 118, and the data plane mirror application layer 140 of control plane VCN 116 may communicate with the data plane application layer 146 of data plane VCN 118 via VNIC 142, which may be included in both the data plane mirror application layer 140 and the data plane application layer 146.

[0046] In some examples, users or clients of the system can make requests, such as create, read, update, or delete (CRUD) operations, via the public internet 154, which can transmit requests to the metadata management service 152. The metadata management service 152 can transmit the request to the control plane VCN 116 via internet gateway 134. The request can be received by one or more LB subnets 122 contained in the control plane DMZ layer 120. The LB subnets 122 can determine that the request is valid, and in response to this determination, they can transmit the request to one or more application subnets 126 contained in the control plane application layer 124. If the request is validated and requires a call to the public internet 154, the call to the public internet 154 can be transmitted to a NAT gateway 138 that can make calls to the public internet 154. The request may expect the stored metadata to be stored in one or more DB subnets 130.

[0047] In some examples, the data plane mirroring application layer 140 can facilitate direct communication between the control plane VCN 116 and the data plane VCN 118. For example, it may be desirable to apply configuration changes, updates, or other appropriate modifications to resources contained in the data plane VCN 118. Through VNIC 142, the control plane VCN 116 can communicate directly with the resources contained in the data plane VCN 118, and thus can perform configuration changes, updates, or other appropriate modifications.

[0048] In some embodiments, the control plane VCN 116 and data plane VCN 118 may be contained within service lease 119. In this case, the system's users or customers may not own or operate the control plane VCN 116 or data plane VCN 118. Alternatively, the IaaS provider may own or operate both the control plane VCN 116 and data plane VCN 118, both of which may be contained within service lease 119. This embodiment enables the isolation of networks that might prevent users or customers from interacting with resources from other users or customers. Moreover, this embodiment allows the system's users or customers to privately store databases without relying on the public Internet 154, which may not have the desired level of threat prevention for storage.

[0049] In other embodiments, one or more LB subnets 122 included in the control plane VCN 116 may be configured to receive signals from the service gateway 136. In this embodiment, the control plane VCN 116 and the data plane VCN 118 may be configured to be invoked by the IaaS provider's customers without invoking the public internet 154. The IaaS provider's customers may expect this embodiment because the database(s) used by the customer can be controlled by the IaaS provider and can be stored on a service lease 119 that is isolated from the public internet 154.

[0050] Figure 2 This is a block diagram illustrating another example pattern 200 of an IaaS architecture according to at least one embodiment. Service operator 202 (e.g., Figure 1 Service provider 102) can communicatively couple to secure host lease 204 (e.g., Figure 1 Secure hosting lease 104), the secure hosting lease may include a Virtual Cloud Network (VCN) 206 (e.g., Figure 1 VCN106) and Secure Host Subnet 208 (e.g., Figure 1 The secure host subnet 108). VCN 206 may include a local peering gateway (LPG) 210 (e.g., Figure 1 The LPG 110 can be communicatively coupled to the Secure Shell (SSH) VCN 212 (e.g., LPG 110 contained in the SSH VCN 212) via the LPG 110. Figure 1 SSH VCN 212 can include SSH subnet 214 (e.g., SSH VCN 212). Figure 1 SSH subnet 114), and SSH VCN 212 can be communicatively coupled to control plane VCN 216 via LPG 210 contained in control plane VCN 216 (e.g., Figure 1 Control plane VCN 216). Control plane VCN 216 may be included in service lease 219 (e.g., Figure 1 In the service lease 119), and the data plane VCN 218 (e.g., Figure 1 The data plane VCN 118 may be included in a customer lease 221 that may be owned or operated by a user or customer of the system.

[0051] Control plane VCN 216 may include control plane DMZ layer 220 (e.g., Figure 1 The control plane DMZ layer 120 may include one or more LB subnets 222 (e.g., Figure 1(One or more) LB subnets 122), may include (one or more) application subnets 226 (e.g., Figure 1 The control plane application layer 224 of (one or more) application subnets 126 (e.g., Figure 1 The control plane application layer 124) may include one or more database (DB) subnets 230 (e.g., similar to...). Figure 1 The control plane data layer 228 of (one or more) DB subnets 130) (e.g., Figure 1 The control plane data layer 128). One or more LB subnets 222 contained in the control plane DMZ layer 220 can be communicatively coupled to one or more application subnets 226 contained in the control plane application layer 224 and an Internet gateway 234 that can be contained in the control plane VCN 216 (e.g., Figure 1 Internet gateway 134), and application subnet(s) 226 can communicatively couple to DB subnet(s) 230 contained in control plane data layer 228 and service gateway 236 (e.g., Figure 1 Service gateway 136) and Network Address Translation (NAT) gateway 238 (e.g., Figure 1 (NAT gateway 138). The control plane VCN 216 may include the service gateway 236 and the NAT gateway 238.

[0052] The control plane VCN 216 may include a data plane mirror of the application layer 240, which may include one or more application subnets 226 (e.g., Figure 1 The data plane mirror application layer 240). One or more application subnets 226 contained in the data plane mirror application layer 240 may include computational instances 244 (e.g., similar to...). Figure 1 The virtual network interface controller (VNIC) 242 (e.g., the VNIC of 142) of the computing instance 144. The computing instance 244 may facilitate the mirroring of the application subnet(s) 226 of the application layer 240 in the data plane and may be included in the application layer 246 in the data plane (e.g., Figure 1 Communication between one or more application subnets 226 in the data plane application layer 146 via VNIC 242 contained in the data plane mirror application layer 240 and VNIC 242 contained in the data plane application layer 246.

[0053] The Internet gateway 234 included in the control plane VCN 216 can be communicatively coupled to the metadata management service 252 (e.g., Figure 1 Metadata management service 152), which can communicatively couple to the public Internet 254 (e.g., Figure 1The public internet 254 can communicatively couple to a NAT gateway 238 contained in a control plane VCN 216. The service gateway 236 contained in the control plane VCN 216 can communicatively couple to a cloud service 256 (e.g., ...). Figure 1 Cloud services (156).

[0054] In some examples, data plane VCN 218 may be included in customer lease 221. In this case, the IaaS provider may provide control plane VCN 216 for each customer, and the IaaS provider may set up a unique compute instance 244 for each customer, included in service lease 219. Each compute instance 244 may allow communication between control plane VCN 216 included in service lease 219 and data plane VCN 218 included in customer lease 221. Compute instance 244 may allow resources provisioned in control plane VCN 216 included in service lease 219 to be deployed or otherwise used in data plane VCN 218 included in customer lease 221.

[0055] In other examples, an IaaS provider's customer may have a database residing in customer lease 221. In this example, control plane VCN 216 may include a data plane mirror application layer 240, which may include one or more application subnets 226. Data plane mirror application layer 240 may reside in data plane VCN 218, but it may not reside in data plane VCN 218. That is, data plane mirror application layer 240 may have access to customer lease 221, but it may not reside in data plane VCN 218 or be owned or operated by an IaaS provider's customer. Data plane mirror application layer 240 may be configured to invoke data plane VCN 218, but it may not be configured to invoke any entity contained in control plane VCN 216. Customers may expect to deploy or otherwise use resources provisioned in the control plane VCN 216 in the data plane VCN 218, and the data plane mirror application layer 240 can facilitate the customer's expected deployment or other use of resources.

[0056] In some embodiments, an IaaS provider's customer can apply filters to data plane VCN 218. In this embodiment, the customer can determine what data plane VCN 218 can access, and the customer can restrict access from data plane VCN 218 to the public internet 254. The IaaS provider may not be able to apply filters or otherwise control data plane VCN 218's access to any external networks or databases. Applying filters and controls to data plane VCN 218 contained in customer lease 221 helps isolate data plane VCN 218 from other customers and the public internet 254.

[0057] In some embodiments, cloud service 256 can be invoked by service gateway 236 to access services that may not exist on public internet 254, control plane VCN 216, or data plane VCN 218. The connection between cloud service 256 and control plane VCN 216 or data plane VCN 218 may not be real-time or continuous. Cloud service 256 may reside on different networks owned or operated by an IaaS provider. Cloud service 256 can be configured to receive calls from service gateway 236 and can be configured not to receive calls from public internet 254. Some cloud services 256 may be isolated from other cloud services 256, and control plane VCN 216 may be isolated from cloud services 256 that may not be in the same region as control plane VCN 216. For example, control plane VCN 216 may be located in "Region 1," and cloud service "Deployment 1" may be located in both Region 1 and "Region 2." If the service gateway 236, contained in the control plane VCN 216 located in region 1, makes a call to deployment 1, then that call can be transmitted to deployment 1 in region 1. In this example, the control plane VCN 216 or deployment 1 in region 1 may not be communicatively coupled to deployment 1 in region 2 or may otherwise communicate with it.

[0058] Figure 3 This is a block diagram illustrating another example pattern 300 of an IaaS architecture according to at least one embodiment. Service operator 302 (e.g., Figure 1 Service provider 102) can communicatively couple to secure host lease 304 (e.g., Figure 1 Secure hosting lease 104), the secure hosting lease may include a Virtual Cloud Network (VCN) 306 (e.g., Figure 1 VCN106) and Secure Host Subnet 308 (e.g., Figure 1 The secure host subnet 108). VCN 306 may include LPG 310 (e.g., Figure 1The LPG 110 can be communicatively coupled to the SSH VCN 312 via the LPG 310 contained in the SSH VCN 312 (e.g., Figure 1 SSH VCN 112). SSH VCN 312 can include SSH subnet 314 (e.g., Figure 1 SSH subnet 114), and SSH VCN 312 can be communicatively coupled to control plane VCN 316 via LPG 310 included in control plane VCN 316 (e.g., Figure 1 The control plane VCN 116) and coupled to the data plane VCN 318 via the LPG 310 contained in the data plane VCN 318 (e.g., Figure 1 Data plane VCN 118). Control plane VCN 316 and data plane VCN 318 may be included in service lease 319 (e.g., Figure 1 In the service rental (119).

[0059] The control plane VCN 316 may include one or more load balancer (LB) subnets 322 (e.g., Figure 1 The control plane DMZ layer 320 of (one or more) LB subnets 122) (e.g., Figure 1 The control plane DMZ layer 120 may include one or more application subnets 326 (e.g., similar to...). Figure 1 The control plane application layer 324 of (one or more) application subnets 126 (e.g., Figure 1 The control plane application layer 124) may include a control plane data layer 328 (e.g., one or more) of DB subnets 330. Figure 1 The control plane data layer 128). One or more LB subnets 322 contained in the control plane DMZ layer 320 can be communicatively coupled to one or more application subnets 326 contained in the control plane application layer 324 and an Internet gateway 334 that can be contained in the control plane VCN 316 (e.g., Figure 1 Internet gateway 134), and application subnet(s) 326 can communicatively couple to DB subnet(s) 330 contained in control plane data layer 328 and service gateway 336 (e.g., Figure 1 The service gateway) and Network Address Translation (NAT) gateway 338 (e.g., Figure 1 (NAT gateway 138). The control plane VCN 316 may include the service gateway 336 and the NAT gateway 338.

[0060] Data plane VCN 318 may include data plane application layer 346 (e.g., Figure 1 Data plane application layer 146), data plane DMZ layer 348 (e.g., Figure 1 Data plane DMZ layer 148), and data plane data layer 350 (e.g., Figure 1 The data plane data layer 150. The data plane DMZ layer 348 may include one or more trusted application subnets 360 and one or more untrusted application subnets 362 communicatively coupled to the data plane application layer 346, and one or more LB subnets 322 of the Internet gateway 334 contained in the data plane VCN 318. The one or more trusted application subnets 360 may be communicatively coupled to the service gateway 336 contained in the data plane VCN 318, the NAT gateway 338 contained in the data plane VCN 318, and one or more DB subnets 330 contained in the data plane data layer 350. The one or more untrusted application subnets 362 may be communicatively coupled to the service gateway 336 contained in the data plane VCN 318 and the one or more DB subnets 330 contained in the data plane data layer 350. The data plane data layer 350 may include one or more DB subnets 330 communicatively coupled to the service gateway 336 contained in the data plane VCN 318.

[0061] One or more untrusted application subnets 362 may include one or more primary VNICs 364(1)-(N) that can be communicatively coupled to tenant virtual machines (VMs) 366(1)-(N). Each tenant VM 366(1)-(N) may be communicatively coupled to a corresponding application subnet 367(1)-(N) that may be contained in a corresponding container egress VCN 368(1)-(N), which may be contained in a corresponding customer lease 380(1)-(N). A corresponding secondary VNIC 372(1)-(N) may facilitate communication between one or more untrusted application subnets 362 contained in a data plane VCN 318 and the application subnets contained in the container egress VCN 368(1)-(N). Each container egress VCN 368(1)-(N) may include a NAT gateway 338 that can be communicatively coupled to the public Internet 354 (e.g., Figure 1 The public internet (154).

[0062] An Internet gateway 334, contained in the control plane VCN 316 and the data plane VCN 318, can be communicatively coupled to a metadata management service 352 (e.g., Figure 1Metadata management service 152), which can communicatively couple to the public Internet 354. Public Internet 354 can communicatively couple to NAT gateway 338 contained in control plane VCN 316 and data plane VCN 318. Service gateway 336 contained in control plane VCN 316 and data plane VCN 318 can communicatively couple to cloud service 356.

[0063] In some embodiments, the data plane VCN 318 may be integrated with the customer lease 380. Such integration may be useful or desired by the IaaS provider's customer in certain situations, such as when support may be expected during code execution. A customer may provide code that could be destructive, might communicate with other customer resources, or might otherwise cause undesirable effects. In response, the IaaS provider may determine whether to run the code provided by the customer.

[0064] In some examples, an IaaS provider's customer can grant temporary network access to the IaaS provider and request functionality attached to the data plane application layer 346. The code running this functionality can execute in VMs 366(1)-(N), and this code may not be configured to run anywhere else on the data plane VCN 318. Each VM 366(1)-(N) can be connected to a customer lease 380. The corresponding container 381(1)-(N) contained in VMs 366(1)-(N) can be configured to run the code. In this case, dual isolation can exist (e.g., container 381(1)-(N) runs the code, where container 381(1)-(N) may be contained in at least one VM 366(1)-(N) contained in untrusted application subnet 362), which can help prevent incorrect or otherwise unintended code from corrupting the IaaS provider's network or the networks of different customers. Containers 381(1)-(N) may be communicatively coupled to customer lease 380 and may be configured to transmit or receive data from customer lease 380. Containers 381(1)-(N) may not be configured to transmit or receive data from any other entity in the data plane VCN 318. After the running code is complete, the IaaS provider may terminate or otherwise dispose of containers 381(1)-(N).

[0065] In some embodiments, one or more trusted application subnets 360 may run code that may be owned or operated by an IaaS provider. In this embodiment, one or more trusted application subnets 360 may be communicatively coupled to one or more database subnets 330 and configured to perform CRUD operations in one or more database subnets 330. One or more untrusted application subnets 362 may be communicatively coupled to one or more database subnets 330, but in this embodiment, one or more untrusted application subnets may be configured to perform read operations in one or more database subnets 330. Containers 381(1)-(N) that may be contained in each customer's VM 366(1)-(N) and may run code from the customer may not be communicatively coupled to one or more database subnets 330.

[0066] In other embodiments, the control plane VCN 316 and the data plane VCN 318 may be coupled without direct communication. In this embodiment, there may be no direct communication between the control plane VCN 316 and the data plane VCN 318. However, communication can occur indirectly through at least one method. An LPG 310 may be established by an IaaS provider, which can facilitate communication between the control plane VCN 316 and the data plane VCN 318. In another example, either the control plane VCN 316 or the data plane VCN 318 may invoke the cloud service 356 via the service gateway 336. For example, an invocation of the cloud service 356 from the control plane VCN 316 may include a request for a service that can communicate with the data plane VCN 318.

[0067] Figure 4 This is a block diagram illustrating another example pattern 400 of an IaaS architecture according to at least one embodiment. Service operator 402 (e.g., Figure 1 Service provider 102) can communicatively couple to secure host lease 404 (e.g., Figure 1 Secure hosting lease 104), the secure hosting lease may include a Virtual Cloud Network (VCN) 406 (e.g., Figure 1 VCN106) and Secure Host Subnet 408 (e.g., Figure 1 The secure host subnet 108). VCN 406 may include LPG 410 (e.g., Figure 1 LPG 110), which can be contained in SSH VCN 412 (e.g., Figure 1 The LPG410 in SSH VCN 412 is communicatively coupled to SSH VCN 412. SSH VCN 412 may include SSH subnet 414 (e.g., Figure 1SSH subnet 114), and SSH VCN 412 can be communicatively coupled to control plane VCN 416 via LPG 410 contained in control plane VCN 416 (e.g., Figure 1 The control plane VCN 116) and coupled to the data plane VCN 418 via LPG410 contained in the data plane VCN 418 (e.g., Figure 1 Data plane VCN 418). Control plane VCN 416 and data plane VCN 418 may be included in service lease 419 (e.g., Figure 1 In the service rental (119).

[0068] The control plane VCN 416 may include one or more LB subnets 422 (e.g., Figure 1 The control plane DMZ layer 420 of (one or more) LB subnets 122) (e.g., Figure 1 The control plane DMZ layer 120 may include (one or more) application subnets 426 (e.g., Figure 1 The control plane application layer 424 of (one or more) application subnets 126 (e.g., Figure 1 The control plane application layer 124) may include (one or more) DB subnets 430 (e.g., Figure 3 The control plane data layer 428 of (one or more) DB subnets 330 (e.g., Figure 1 The control plane data layer 128). One or more LB subnets 422 contained in the control plane DMZ layer 420 can be communicatively coupled to one or more application subnets 426 contained in the control plane application layer 424 and an Internet gateway 434 that can be contained in the control plane VCN 416 (e.g., Figure 1 Internet gateway 134), and application subnet 426 (one or more) can communicatively couple to DB subnet 430 (one or more) contained in control plane data layer 428 and service gateway 436 (e.g., Figure 1 The service gateway) and Network Address Translation (NAT) gateway 438 (e.g., Figure 1 (NAT gateway 138). The control plane VCN 416 may include the service gateway 436 and the NAT gateway 438.

[0069] Data plane VCN 418 may include data plane application layer 446 (e.g., Figure 1 Data plane application layer 146), data plane DMZ layer 448 (e.g., Figure 1 Data plane DMZ layer 148), and data plane data layer 450 (e.g., Figure 1The data plane data layer 150). The data plane DMZ layer 448 may include one or more trusted application subnets 460 that can be communicatively coupled to the data plane application layer 446 (e.g., Figure 3 (one or more) trusted application subnets 360 and (one or more) untrusted application subnets 462 (e.g., Figure 3 The data plane includes one or more untrusted application subnets 362 and one or more LB subnets 422 of Internet gateway 434 contained in data plane VCN 418. One or more trusted application subnets 460 may communicatively couple to service gateway 436, NAT gateway 438, and DB subnets 430 contained in data plane VCN 418. One or more untrusted application subnets 462 may communicatively couple to service gateway 436 and DB subnets 430 contained in data plane VCN 418 and data plane data layer 450, respectively. Data plane data layer 450 may include one or more DB subnets 430 that may communicatively couple to service gateway 436 contained in data plane VCN 418.

[0070] One or more untrusted application subnets 462 may include a primary VNIC 464(1)-(N) communicatively coupled to tenant virtual machines (VMs) 466(1)-(N) residing within one or more untrusted application subnets 462. Each tenant VM 466(1)-(N) may run code in a corresponding container 467(1)-(N) and is communicatively coupled to an application subnet 426 that may be contained in a data plane application layer 446 that may be contained in a container egress VCN 468. A corresponding secondary VNIC 472(1)-(N) may facilitate communication between one or more untrusted application subnets 462 contained in a data plane VCN 418 and the application subnets contained in a container egress VCN 468. The container egress VCN may include a public internet 454 (e.g., Figure 1 The public internet (154) uses NAT gateway 438.

[0071] Internet gateway 434, contained in control plane VCN 416 and data plane VCN 418, can be communicatively coupled to metadata management service 452 (e.g., Figure 1Metadata management service 152), which can communicatively couple to the public internet 454. Public internet 454 can communicatively couple to NAT gateway 438 contained in control plane VCN 416 and data plane VCN 418. Service gateway 436 contained in control plane VCN 416 and data plane VCN 418 can communicatively couple to cloud service 456.

[0072] In some examples, Figure 4 The architecture shown in block diagram 400 can be considered as Figure 3 This is an exception to the pattern illustrated in the architecture diagram 300, and this pattern may be what the IaaS provider's customers would expect if the IaaS provider cannot communicate directly with the customer (e.g., in a disconnected region). The customer has real-time access to the corresponding container 467(1)-(N) contained in each customer's VM 466(1)-(N). Container 467(1)-(N) can be configured to invoke the corresponding auxiliary VNIC 472(1)-(N) contained in one or more application subnets 426 of the data plane application layer 446, which may be contained in the container egress VCN 468. The auxiliary VNIC 472(1)-(N) can transmit the invocation to a NAT gateway 438, which can transmit the invocation to the public internet 454. In this example, the container 467(1)-(N) that can be accessed by the customer in real-time can be isolated from the control plane VCN 416 and from other entities contained in the data plane VCN 418. Container 467(1)-(N) can also be isolated from resources from other customers.

[0073] In other examples, a client may use containers 467(1)-(N) to invoke cloud service 456. In this example, the client may run code within containers 467(1)-(N) requesting a service from cloud service 456. Containers 467(1)-(N) may transmit the request to auxiliary VNICs 472(1)-(N), which may then transmit the request to a NAT gateway, which may transmit the request to the public internet 454. The public internet 454 may then transmit the request via internet gateway 434 to one or more LB subnets 422 contained in control plane VCN 416. In response to determining that the request is valid, one or more LB subnets may transmit the request to one or more application subnets 426, which may then transmit the request to cloud service 456 via service gateway 436.

[0074] It should be recognized that the IaaS architectures 100, 200, 300, and 400 depicted in the figures may have other components besides those depicted. Furthermore, the embodiments shown in the figures are merely some examples of cloud infrastructure systems that can be incorporated into embodiments of this disclosure. In some other embodiments, the IaaS system may have more or fewer components than shown in the figures, may combine two or more components, or may have different arrangements or configurations of components.

[0075] In some embodiments, the IaaS system described herein may include a suite of database service products, middleware, and applications delivered to customers in a self-service, subscription-based, elastically scalable, reliable, highly available, and secure manner. An example of such an IaaS system is the Oracle Cloud Infrastructure (OCI) provided by this assignee.

[0076] In one or more embodiments, a computer network provides connectivity between a set of nodes. Nodes can be local and / or remote to each other. Nodes are connected via a set of links. Examples of links include coaxial cable, unshielded stranded cable, copper cable, fiber optic cable, and virtual links.

[0077] A subset of nodes implements a computer network. Examples of such nodes include switches, routers, firewalls, and Network Address Translation (NAT). Another subset of nodes uses a computer network. Such nodes (also called "hosts") can execute client processes and / or server processes. Client processes make requests for computing services, such as the execution of a specific application and / or the storage of a specific amount of data. Server processes respond by performing the requested service and / or returning the corresponding data.

[0078] A computer network can be a physical network, including physical nodes connected by physical links. A physical node is any digital device. A physical node can be a function-specific hardware device, such as a hardware switch, hardware router, hardware firewall, and hardware NAT. Additionally or alternatively, a physical node can be a general-purpose machine configured to perform various virtual machines and / or applications to perform corresponding functions. A physical link is the physical medium connecting two or more physical nodes. Examples of links include coaxial cable, unshielded twisted-pair cable, copper cable, and fiber optic cable.

[0079] Computer networks can be overlay networks. An overlay network is a logical network implemented on top of another network, such as a physical network. Each node in an overlay network corresponds to a corresponding node in the underlying network. Therefore, each node in an overlay network is associated with both an overlay address (used to address the overlay node) and an underlying address (used to address the underlying node that implements the overlay node). Overlay nodes can be digital devices and / or software processes (such as virtual machines, application instances, or threads). The links connecting overlay nodes are implemented as tunnels through the underlying network. Overlay nodes at either end of the tunnel treat the underlying multi-hop path between them as a single logical link. Tunneling is performed through encapsulation and decapsulation.

[0080] In this embodiment, the client can be local and / or remote on the computer network. The client can access the computer network via other computer networks, such as a private network or the Internet. The client can use a communication protocol, such as Hypertext Transfer Protocol (HTTP), to transmit requests to the computer network. Requests are transmitted through interfaces such as client interfaces (such as web browsers), program interfaces, or APIs (Application Programming Interfaces).

[0081] In this embodiment, a computer network provides connectivity between clients and network resources. Network resources include hardware and / or software configured to execute server processes. Examples of network resources include processors, data storage devices, virtual machines, containers, and / or software applications. Network resources are shared among multiple clients. Clients independently request computing services from the computer network. Network resources are dynamically allocated to requesting and / or clients on demand. The network resources allocated to each requesting and / or client can be scaled up or down based on, for example, (a) computing services requested by a specific client, (b) aggregated computing services requested by a specific tenant, and / or (c) the requested aggregated computing services of the computer network. Such a computer network may be referred to as a "cloud network."

[0082] In this embodiment, the service provider offers a cloud network to one or more end users. The cloud network can implement various service models, including but not limited to Software as a Service (SaaS), Platform as a Service (PaaS), and Infrastructure as a Service (IaaS). In SaaS, the service provider offers end users the ability to use applications running on the service provider's network resources. In PaaS, the service provider offers end users the ability to deploy custom applications onto network resources. Custom applications can be created using programming languages, libraries, services, and tools supported by the service provider. In IaaS, the service provider offers end users the ability to supply processing, storage, networking, and other basic computing resources provided by the network resources. Any application, including operating systems, can be deployed on the network resources.

[0083] In embodiments, computer networks can implement various deployment models, including but not limited to private clouds, public clouds, and hybrid clouds. In a private cloud, network resources are provisioned to a specific group of one or more entities (as used herein, an "entity" refers to a company, organization, person, or other entity) for exclusive use. Network resources can be local and / or remote at the location of the specific group of entities. In a public cloud, cloud resources are provisioned to multiple entities (also referred to as "tenants" or "customers") that are independent of each other. The computer network and its network resources are accessed by clients corresponding to different tenants. Such a computer network can be referred to as a "multi-tenant computer network." Several tenants can use the same specific network resources at different times and / or at the same time. Network resources can be local and / or remote at the tenant's location. In a hybrid cloud, the computer network includes both private and public clouds. The interface between the private and public clouds allows for the portability of data and applications. Data stored in the private cloud and data stored in the public cloud can be exchanged through the interface. Applications implemented in the private cloud and applications implemented in the public cloud may be dependent on each other. Calls from an application in the private cloud to an application in the public cloud (and vice versa) can be performed through the interface.

[0084] In this embodiment, the tenants of a multi-tenant computer network are independent of each other. For example, one tenant's business or operations may be separate from those of another tenant. Different tenants may have different network requirements for the computer network. Examples of network requirements include processing speed, data storage capacity, security requirements, performance requirements, throughput requirements, latency requirements, resilience requirements, quality of service (QoS) requirements, tenant isolation, and / or consistency. The same computer network may need to meet the different network requirements needed by different tenants.

[0085] In one or more embodiments, in a multi-tenant computer network, tenant isolation is implemented to ensure that applications and / or data from different tenants are not shared with each other. Various tenant isolation methods can be used.

[0086] In this embodiment, each tenant is associated with a tenant ID. Each network resource in a multi-tenant computer network is tagged with a tenant ID. A tenant is only allowed access to a specific network resource if the tenant and the specific network resource are associated with the same tenant ID.

[0087] In this embodiment, each tenant is associated with a tenant ID. Each application implemented by the computer network is tagged with a tenant ID. Additionally or alternatively, each data structure and / or dataset stored by the computer network is tagged with a tenant ID. A tenant is allowed access to a specific application, data structure, and / or dataset only if the tenant and the specific application, data structure, and / or dataset are associated with the same tenant ID.

[0088] As an example, each database implemented in a multi-tenant computer network can be identified by a tenant ID. Only the tenant associated with the corresponding tenant ID can access the data in a specific database. As another example, each entry in a database implemented in a multi-tenant computer network can be identified by a tenant ID. Only the tenant associated with the corresponding tenant ID can access the data in a specific entry. However, the database can be shared by multiple tenants.

[0089] In this embodiment, the subscription list indicates which tenants are authorized to access which applications. For each application, a list of tenant IDs of tenants authorized to access that application is stored. A tenant is only allowed to access a specific application if its tenant ID is included in the subscription list corresponding to that specific application.

[0090] In this embodiment, network resources (such as digital devices, virtual machines, application instances, and threads) corresponding to different tenants are isolated to tenant-specific overlay networks maintained by a multi-tenant computer network. As an example, data packets from any source device within a tenant overlay network may only be transmitted to other devices within the same tenant overlay network. Encapsulation tunnels are used to prevent any transmission from a source device on one tenant overlay network to devices in other tenant overlay networks. Specifically, data packets received from the source device are encapsulated within an outer data packet. The outer data packet is transmitted from a first encapsulation tunnel endpoint (communicating with the source device in the tenant overlay network) to a second encapsulation tunnel endpoint (communicating with the destination device in the tenant overlay network). The second encapsulation tunnel endpoint decapsulates the outer data packet to obtain the original data packet transmitted by the source device. The original data packet is then transmitted from the second encapsulation tunnel endpoint to the destination device within the same specific overlay network.

[0091] 3. Computer System

[0092] Figure 5 An example computer system 500 in which various embodiments can be implemented is illustrated. System 500 can be used to implement any of the computer systems described above. Figure 5 As shown, the computer system 500 includes a processing unit 504 that communicates with multiple peripheral subsystems via a bus subsystem 502. These peripheral subsystems may include a processing acceleration unit 506, an I / O subsystem 508, a storage subsystem 518, and a communication subsystem 524. The storage subsystem 518 includes a tangible computer-readable storage medium 522 and a system memory 510.

[0093] Bus subsystem 502 provides a mechanism for allowing various components and subsystems of computer system 500 to communicate with each other as intended. While bus subsystem 502 is schematically shown as a single bus, alternative embodiments of the bus subsystem may utilize multiple buses. Bus subsystem 502 can be any of several types of bus architectures, including memory buses or memory controllers, peripheral buses, and local buses using any of various bus architectures. For example, such architectures may include Industry Standard Architecture (ISA) buses, Micro Channel Architecture (MCA) buses, Enhanced ISA (EISA) buses, Video Electronics Standards Association (VESA) local buses, and Peripheral Component Interconnect (PCI) buses, which may be implemented as Mezzanine buses manufactured according to the IEEE P1386.1 standard.

[0094] A processing unit 504, which may be implemented as one or more integrated circuits (e.g., a conventional microprocessor or microcontroller), controls the operation of the computer system 500. One or more processors may be included in the processing unit 504. These processors may include single-core or multi-core processors. In some embodiments, the processing unit 504 may be implemented as one or more independent processing units 532 and / or 534, wherein each processing unit includes a single-core or multi-core processor. In other embodiments, the processing unit 504 may also be implemented as a quad-core processing unit formed by integrating two dual-core processors into a single chip.

[0095] In various embodiments, processing unit 504 can execute various programs in response to program code and can maintain multiple concurrently executing programs or processes. At any given time, some or all of the program code to be executed can reside in processing unit 504 and / or storage subsystem 518. With appropriate programming, processing unit 504 can provide the various functions described above. Computer system 500 may additionally include processing acceleration unit 506, which may include digital signal processor (DSP), dedicated processor, etc.

[0096] I / O subsystem 508 may include user interface input devices and user interface output devices. User interface input devices may include keyboards, pointing devices such as mice or trackballs, touchpads or touchscreens integrated into a display, scroll wheels, click wheels, dials, buttons, switches, keyboards, audio input devices with voice command recognition systems, microphones, and other types of input devices. User interface input devices may include, for example, motion sensing and / or gesture recognition devices, such as the Microsoft Kinect® motion sensor, which enables users to control and interact with input devices such as the Microsoft Xbox® 360 game controller via a natural user interface using gestures and voice commands. User interface input devices may also include eye posture recognition devices, such as the Google Glass® blink detector, which detects eye activity from the user (e.g., “blinking” when taking a photo and / or making menu selections) and translates the eye posture into input in an input device (e.g., Google Glass®). Additionally, user interface input devices may include voice recognition sensing devices that enable users to interact with a voice recognition system (e.g., the Siri® navigator) via voice commands.

[0097] User interface input devices may also include, but are not limited to, 3D mice, joysticks or pointing sticks, game panels and drawing tablets, as well as audio / video devices such as speakers, digital cameras, digital camcorders, portable media players, webcams, image scanners, fingerprint scanners, barcode readers, 3D scanners, 3D printers, laser rangefinders, and eye-tracking devices. Additionally, user interface input devices may include, for example, medical imaging input devices such as computed tomography (CT), magnetic resonance imaging (MRI), positron emission tomography (PET), and medical ultrasound equipment. User interface input devices may also include, for example, audio input devices such as MIDI keyboards, digital musical instruments, etc.

[0098] User interface output devices may include display subsystems, indicator lights, or non-visual displays such as audio output devices, etc. Display subsystems may be cathode ray tubes (CRTs), flat panel devices such as those using liquid crystal displays (LCDs) or plasma displays, projection devices, touchscreens, etc. Generally, the term "output device" is used to encompass all possible types of devices and mechanisms for outputting information from computer system 500 to a user or other computer. For example, user interface output devices may include, but are not limited to, various display devices that visually convey text, graphics, and audio / video information, such as monitors, printers, speakers, headphones, car navigation systems, plotters, voice output devices, and modems.

[0099] Computer system 500 may include a storage subsystem 518 that provides a tangible, non-transitory, computer-readable storage medium for storing software and data constructs that provide the functionality of the embodiments described in this disclosure. The software may include programs, code modules, instructions, scripts, etc., which provide the aforementioned functionality when executed by one or more cores or processors of processing unit 504. Storage subsystem 518 may also provide a repository for storing data used according to this disclosure.

[0100] like Figure 5 As depicted in the example, storage subsystem 518 may include various components, including system memory 510, computer-readable storage medium 522, and computer-readable storage medium reader 520. System memory 510 may store program instructions, such as application program 512, that can be loaded and executed by processing unit 504. System memory 510 may also store data used during the execution of instructions (such as program data 514) and / or data generated during the execution of program instructions. Various kinds of programs may be loaded into system memory 510, including but not limited to client applications, web browsers, middleware applications, relational database management systems (RDBMS), virtual machines, containers, etc.

[0101] System memory 510 may also store operating system 516. Examples of operating system 516 may include various versions of Microsoft Windows®, Apple Macintosh® and / or Linux operating systems, various commercial UNIX® or UNIX-like operating systems (including, but not limited to, various GNU / Linux operating systems, Google Chrome® OS, etc.) and / or mobile operating systems (such as iOS, Windows® Phone, Android® OS, BlackBerry® OS, and Palm® OS). In some implementations where computer system 500 executes one or more virtual machines, the virtual machine, along with its guest operating system (GOS), may be loaded into system memory 510 and executed by one or more processors or cores of processing unit 504.

[0102] System memory 510 may be configured differently depending on the type of computer system 500. For example, system memory 510 may be volatile memory (such as random access memory (RAM)) and / or non-volatile memory (such as read-only memory (ROM), flash memory, etc.). Different types of RAM configurations may be provided, including static random access memory (SRAM), dynamic random access memory (DRAM), etc. In some embodiments, system memory 510 may include a basic input / output system (BIOS) containing basic routines that facilitate the transfer of information between components within computer system 500, such as during startup.

[0103] Computer-readable storage medium 522 may represent remote, local, fixed and / or removable storage devices and storage media for temporarily and / or more permanently containing and storing computer-readable information (including instructions executable by the processing unit 504 of the computer system 500) for use by the computer system 500.

[0104] Computer-readable storage medium 522 may include any suitable medium known or used in the art, including storage and communication media, such as, but not limited to, volatile and non-volatile, removable and non-removable media implemented by any method or technology for storing and / or transmitting information. This may include tangible computer-readable storage media such as RAM, ROM, electrically erasable programmable ROM (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile disc (DVD) or other optical storage, magnetic tape cassette, magnetic tape, disk storage devices or other magnetic storage devices, or other tangible computer-readable media.

[0105] For example, computer-readable storage medium 522 may include a hard disk drive that reads or writes to a non-removable non-volatile magnetic medium, a disk drive that reads or writes to a removable non-volatile magnetic disk, and an optical disc drive that reads or writes to a removable non-volatile optical disc (such as a CD-ROM, DVD, and Blu-ray® disc or other optical media). Computer-readable storage medium 522 may include, but is not limited to, Zip® drives, flash memory cards, Universal Serial Bus (USB) flash memory drives, Secure Digital (SD) cards, DVD discs, digital video tapes, and so on. Computer-readable storage medium 522 may also include solid-state drives (SSDs) based on non-volatile memory (such as flash-based SSDs, enterprise flash drives, solid-state ROMs, etc.), volatile memory-based SSDs (such as solid-state RAM, dynamic RAM, static RAM), DRAM-based SSDs, magnetoresistive RAM (MRAM) SSDs, and hybrid SSDs using a combination of DRAM-based and flash memory-based SSDs. Disk drives and their associated computer-readable media can provide non-volatile storage for computer-readable instructions, data structures, program modules and other data for computer system 500.

[0106] Machine-readable instructions executable by one or more processors or cores of processing unit 504 may be stored on a non-transitory computer-readable storage medium. The non-transitory computer-readable storage medium may include physically tangible memory or storage devices, including volatile memory storage devices and / or non-volatile memory devices. Examples of non-transitory computer-readable storage media include magnetic storage media (e.g., disks or tapes), optical storage media (e.g., DVDs, CDs), various types of RAM, ROM, or flash memory, hard disk drives, floppy disk drives, removable memory drives (e.g., USB drives), or other types of storage devices.

[0107] The communication subsystem 524 provides an interface to other computer systems and networks. The communication subsystem 524 serves as an interface for receiving data from other systems and sending data from computer system 500 to other systems. For example, the communication subsystem 524 may enable computer system 500 to connect to one or more devices via the Internet. In some embodiments, the communication subsystem 524 may include radio frequency (RF) transceiver components (e.g., advanced data network technologies using cellular telephone technology, such as 3G, 4G, or EDGE (Enhanced Data Rates for Global Evolution), WiFi (IEEE 802.11 series standards), or other mobile communication technologies, or any combination thereof), GPS receiver components, and / or other components for accessing wireless voice and / or data networks. In some embodiments, as an addition to or alternative to the wireless interface, the communication subsystem 524 may provide a wired network connection (e.g., Ethernet).

[0108] In some embodiments, the communication subsystem 524 may also represent one or more users who can use the computer system 500 to receive input communications in the form of structured and / or unstructured data feeds 526, event streams 528, event updates 530, etc.

[0109] For example, the communication subsystem 524 can be configured to receive data feeds 526 in real time from users of social networks and / or other communication services, such as Twitter® feeds, Facebook® updates, web feeds such as Rich Site Summary (RSS) feeds, and / or real-time updates from one or more third-party information sources.

[0110] Additionally, the communication subsystem 524 can also be configured to receive data in the form of a continuous data stream, which may include an event stream 528 and / or event updates 530 that are essentially continuous or unbounded real-time events without a clearly defined termination. Examples of applications that generate continuous data may include, for example, sensor data applications, financial quotation machines, network performance measurement tools (e.g., network monitoring and traffic management applications), clickstream analysis tools, vehicle traffic monitoring, and so on.

[0111] The communication subsystem 524 can also be configured to output structured and / or unstructured data feeds 526, event streams 528, event updates 530, etc. to one or more databases, which can communicate with one or more streaming data source computers coupled to the computer system 500.

[0112] The computer system 500 can be one of the following types: handheld portable devices (e.g., iPhone® cellular phones, iPad® computing tablets, PDAs), wearable devices (e.g., Google Glass® head-mounted displays), PCs, workstations, mainframes, information stations, server racks, or any other data processing systems.

[0113] Due to the constantly changing nature of computers and networks, Figure 5 The description of the computer system 500 depicted is intended only as a concrete example. It has more than Figure 5 Many other configurations of the system described herein, with more or fewer components, are possible. For example, custom hardware may also be used and / or specific elements may be implemented using hardware, firmware, software (including applets), or a combination thereof. Additionally, connections to other computing devices, such as network input / output devices, may also be employed. Based on the disclosure and teachings provided herein, those skilled in the art will recognize other ways and / or methods for implementing the various embodiments.

[0114] 4. System Architecture Overview

[0115] Figure 6A and Figure 6B An example of a system 600 according to one or more embodiments is illustrated. Reference Figure 6A and Figure 6B The described system 600 can perform operations associated with authenticating CA datasets using asymmetric keys as described herein. System 600 can also perform operations associated with distributing certificate packages to network entities and / or provisioning cloud resource instances, as described separately herein.

[0116] like Figure 6A As illustrated, system 600 may include multiple virtual cloud networks 602, such as virtual cloud network 602a, virtual cloud network 602b, and virtual cloud network 602n. The multiple virtual cloud networks 602 may be separate networks within a cloud computing environment. For example, each separate virtual cloud network 602 may represent a logically isolated network within the cloud computing environment. Additionally, or alternatively, one or more virtual cloud networks among the separate virtual cloud networks 602 may be physically isolated from at least one virtual cloud network among other virtual cloud networks 602. In one example, the logically isolated multiple virtual cloud networks 602 may share underlying physical infrastructure components, such as servers, switches, or routers. The separate virtual cloud networks 602 (such as logically isolated virtual cloud networks 602) may operate as independent networks while sharing underlying physical infrastructure components. Each separate virtual cloud network 602 may include its own set of resources, IP address range, and / or security policies relative to other virtual cloud networks 602 in the cloud computing environment. Network entities on the separate virtual cloud networks 602 may communicate with each other to varying degrees, for example, according to applicable security protocols.

[0117] In one example, individual virtual cloud networks 602 can be distinguished from each other based on a set of non-overlapping IP addresses assigned to each individual virtual cloud network 602. Additionally, or alternatively, individual virtual cloud networks 602 can be distinguished from each other based on having separate cloud resources (such as separate sets of virtual machines, separate control planes, separate data planes, and / or separate databases). Additionally, or alternatively, individual virtual cloud networks 602 can be distinguished from each other based on having separate firewalls, security protocols, security groups, or network security lists.

[0118] Virtual cloud networks 602 may each include network interfaces 604 configured to allow communication between virtual cloud networks 602. For example, as Figure 6AAs shown, virtual cloud network 602a may include network interface 604a, and virtual cloud network 602b may include network interface 604b. Network interface 604 associated with virtual cloud network 602 may include one or more connectivity mechanisms. In one example, network interface 604 may include a proxy server. The proxy server may act as a gateway between virtual cloud networks 602. Additionally, or alternatively, network interface 604 may be configured to provide network peering. As used herein, the term "network peering" refers to a direct, private connection between separate networks that allows them to communicate as if they were part of the same network. As examples, network peering may include virtual peering (e.g., for communication within the same cloud region), VCN peering (e.g., for communication between separate virtual cloud networks within the same cloud provider's infrastructure), and / or VPN peering (e.g., for communication across different geographic locations or different cloud computing environments).

[0119] In one example, system 600 may include multiple regions 606, such as region 606a, region 606b, and region 606n. Each region 606 may include one or more virtual cloud networks 602. For example, region 606a may include virtual cloud network 602a, and region 606b may include virtual cloud network 602b and virtual cloud network 602n. In one example, system 600 may include multiple realms 608, such as realm 608a, realm 608b, and realm 608n. Each realm 608 may include one or more regions 606. For example, realm 608a may include region 606a, and realm 608b may include region 606b and region 606n. As used herein, the term "region" refers to a collection of one or more interconnected data centers on which virtual cloud networks are deployed. In one example, a region may correspond to a physical geographic region. In one example, a region may correspond to multiple physical geographic regions and / or a portion of physical geographic regions. As used herein, the term "realm" refers to a distinct deployment of IaaS system infrastructure. In one example, regions within the same domain can communicate with each other via network interface 604, such as through a network peer-to-peer connection. In another example, regions from different domains can communicate with each other via network interface 604, such as through a network peer-to-peer connection.

[0120] Further reference Figure 6AThe first virtual cloud network (such as virtual cloud network 602a) may include a key management service 610. The key management service 610 may be configured to digitally sign CA datasets transmitted to it from other virtual cloud networks 602 (such as virtual cloud networks 602b and / or virtual cloud networks 602n). After the CA datasets have been digitally signed, the key management service 610 may transmit the digital signatures of the CA datasets to another virtual cloud network 602 from which the CA datasets were transmitted.

[0121] In one example, the key management service 610 may be hosted on a virtual cloud network 602 within the home region 612. Alternatively, the virtual cloud network 602 on which the key management service 610 is hosted may be the home VCN 614. In one example, CA datasets may be transferred to the key management service 610 from one or more virtual cloud networks 602 associated with a secondary region 616. Alternatively, the virtual cloud network 602 from which the CA datasets are transferred to the key management service 610 may be a secondary VCN 618.

[0122] As used herein, the term "home zone" refers to zone 606 of a cloud computing environment from which virtual cloud infrastructure is deployed and / or managed. As used herein, the term "home VCN" refers to virtual cloud network 602 within the home zone. In one example, virtual cloud infrastructure can be deployed and / or managed from a home VCN. Zone 608, which includes home zone 612, may sometimes be referred to as home zone 620. Home zone 612 and / or home VCN 614 can be used as initial locations for deploying cloud computing resources and services, such as additional zone 606 and / or additional virtual cloud network 602. In one example, CA resources and / or services can be deployed and / or managed from home zone 612. CA resources and / or services may include issuing digital certificates and / or generating asymmetric key pairs, such as asymmetric key pairs associated with digital certificates and / or asymmetric key pairs associated with validating CA datasets. Key management service 610 may represent a portion of the CA resources and / or services deployed and / or managed within the home zone.

[0123] As used herein, the term "secondary region" refers to region 606 of a cloud computing environment that utilizes and / or relies on home region 612 and / or home VCN 614 to deploy and / or manage at least a portion of the virtual cloud infrastructure relating to one or more virtual cloud networks 602 within region 606. As used herein, the term "secondary VCN" refers to virtual cloud network 602 within secondary region 616. In one example, secondary VCN 618 may utilize and / or rely on home region 612 to deploy and / or manage at least a portion of the virtual cloud infrastructure. Region 608, which includes secondary region 616, may sometimes be referred to as secondary region 622.

[0124] Key management service 610 may include a private key store 624. Private key store 624 may include one or more global private keys. One or more global private keys may be generated by key management service 610. Each global private key may be associated with a corresponding global public key. For each global private key, the corresponding global public key may be stored in one or more public key stores 626 associated with virtual cloud network 602 (such as secondary VCN 618). For example, various network entities associated with secondary VCN 618 may include public key stores 626 containing one or more global public keys, each associated with a corresponding global private key in private key store 624. One or more global public keys may be transferred from home VCN 614 to secondary VCN 618 for storage in one or more public key stores 626. Additionally, or alternatively, one or more global public keys may be included in configuration files and / or operating system images (such as configuration files and / or operating system images for various network entities associated with secondary VCN 618) for use with secondary VCN 618.

[0125] In one example, the private key store 624 may include any type of storage unit and / or device for storing data (e.g., a file system, database, collection of tables, or any other storage mechanism). Additionally, the private key store 624 may include multiple different storage units and / or devices. These multiple different storage units and / or devices may or may not be of the same type or located at the same physical site. Furthermore, the private key store 624 may be implemented or executed on the same computing system as the key management service 610. Alternatively, the private key store 624 may be implemented or executed on a separate computing system from the key management service 610. The certificate store 630 may be coupled to the key management service 610 via a direct connection or via network communication.

[0126] In one example, public key store 626 may include any type of storage unit and / or device for storing data (e.g., file system, database, collection of tables, or any other storage mechanism). Additionally, public key store 626 may include multiple different storage units and / or devices. These multiple different storage units and / or devices may or may not be of the same type or located at the same physical site. Furthermore, public key store 626 may be implemented or executed on the same computing system as key management service 610. Alternatively, public key store 626 may be implemented or executed on a separate computing system from key management service 610. Certificate store 630 may be coupled to key management service 610 via a direct connection or via network communication.

[0127] A CA dataset may include one or more CA certificates. For example, a CA dataset may include a certificate package containing one or more CA certificates. Additionally, or alternatively, the CA dataset and / or certificate package may include other data associated with the CA certificates, such as cryptographic keys, certificate revocation lists, and / or configuration files. When a collection of one or more CA certificates is being deployed (e.g., by a secondary VCN 618), the secondary VCN 618 may transfer the CA dataset, including one or more CA certificates, to a key management service 610 before deploying the one or more CA certificates. The key management service 610 may digitally sign the CA dataset using a global private key and transfer the digital signature of the CA dataset to the secondary VCN 618. The CA dataset can then be verified using the global public key corresponding to the global public key used to digitally sign the CA dataset. In one example, various network entities associated with the secondary VCN 618 may verify the CA dataset before installing one or more CA certificates in the CA dataset. Additionally, or alternatively, the CA dataset may be verified before being distributed to network entities associated with the secondary VCN 618.

[0128] Further reference Figure 6A Virtual cloud network 602b (such as secondary VCN 618) may include a CA provisioning service 628 and a certificate store 630. CA provisioning service 628 may provide CA certificates for use in virtual cloud network 602b. In one example, CA provisioning service 628 may act as a CA for virtual cloud network 602b. CA provisioning service 628 may generate CA certificates and / or certificate packages. Additionally, or alternatively, CA provisioning service may obtain CA certificates and / or certificate packages from a CA (such as from a CA associated with home VCN 614). CA provisioning service 628 may store CA certificates and / or certificate packages in certificate store 630.

[0129] Certificate store 630 may include any type of storage unit and / or device for storing data (e.g., file system, database, collection of tables, or any other storage mechanism). Additionally, certificate store 630 may include multiple different storage units and / or devices. These multiple different storage units and / or devices may or may not be of the same type or located at the same physical site. Certificate store 630 may share one or more storage units with public key store 626b. Additionally, or alternatively, certificate store 630 may include one or more storage units different from one or more storage units of public key store 626b. Furthermore, certificate store 630 and / or public key store 626b may be implemented or executed on the same computing system as CA provisioning service 628, digital signature manager 632, and / or distribution service 636. Additionally, or alternatively, certificate store 630 and / or public key store 626b may be implemented or executed on a computing system separate from CA provisioning service 628, digital signature manager 632, and / or distribution service 636. Certificate repository 630 and / or public key repository 626b may be coupled to CA provisioning service 628, digital signature manager 632 and / or distribution service 636 via direct connection or via network communication.

[0130] In one example, such as Figure 6A As shown, a virtual cloud network 602b (such as a secondary VCN 618) may include a digital signature manager 632. The digital signature manager may determine that the certificate store 630 includes one or more CA certificates and / or one or more certificate packages that are not yet associated with a digital signature from the key management service 610. A CA certificate not yet associated with a digital signature from the key management service 610 may sometimes be referred to as a “new CA certificate.” A certificate package not yet associated with a digital signature from the key management service 610 may sometimes be referred to as a “new certificate package.” The digital signature manager 632 may detect one or more new CA certificates in the certificate store 630. One or more new CA certificates may be included in a certificate package stored in the certificate store 630. Additionally, or alternatively, one or more new CA certificates may be stored separately in the certificate store.

[0131] After detecting one or more new CA certificates and / or one or more new certificate packages in the certificate store 630, the digital signature manager 632 can transfer the CA dataset, including the one or more CA certificates and / or one or more new certificate packages, to the key management service 610. The key management service 610 can receive the CA dataset from the digital signature manager 632 and can digitally sign the CA dataset using a global private key. After digitally signing the CA dataset, the key management service 610 can transfer the digital signature of the CA dataset to the digital signature manager 632. The digital signature manager 632 can receive the digital signature of the CA dataset from the key management service 610 and can store the digital signature in a data structure in the certificate store 630 that associates the digital signature with the CA dataset.

[0132] In one example, key management service 610 may include signature service 634 configured to digitally sign CA datasets. Signature service 634 may digitally sign the CA dataset at least by applying a hash function to the CA dataset to generate a hash value that uniquely represents the CA dataset. The hash value can then be encrypted using a global private key to provide a digital signature as a cryptographic representation of the hash value encrypted with the global private key. In one example, the digital signature of the CA dataset may be appended to the CA dataset, and key management service 610 may transmit the CA dataset with the appended digital signature to digital signature manager 632. Alternatively, key management service 610 may transmit the digital signature of the CA dataset to digital signature manager 632 without including the CA dataset, for example, because digital signature manager may already have permission to access the CA dataset in certificate store 630.

[0133] In one example, the digital signature manager 632 may associate a digital signature received from the key management service 610 with a CA dataset in the certificate store 630 based on one or more identification tokens (such as an identifier number or timestamp associated with a CA dataset). Additionally, or alternatively, the digital signature manager 632 may use a global public key corresponding to the global private key used by the key management service 610 to digitally sign the CA dataset to verify the digital signature received from the key management service 610.

[0134] Digital signature manager 632 can verify a digital signature by calculating the hash value of the CA dataset using the same hash function used by key management service 610 when digitally signing the CA dataset. Digital signature manager 632 can then decrypt the digital signature using a global public key to obtain the decrypted hash value. Digital signature manager 632 can compare the decrypted hash value with the hash value of the CA dataset. When the decrypted hash value matches the hash value of the CA dataset, it means that the CA dataset digitally signed by key management service 610 is identical to the CA dataset for which digital signature manager 632 calculated the hash value. Therefore, digital signature manager 632 can determine that the digital signature on the CA dataset is valid, at least when the decrypted hash value matches the hash value of the CA dataset. Digital signature manager 632 can verify digital signatures received from key management service 610, for example, before storing the digital signature in the data structure that associates the digital signature with the CA dataset in certificate store 630. In one example, if the decrypted hash value does not match the hash value of the CA dataset, the digital signature manager 632 may reject the digital signature. If the decrypted hash value does not match the hash value of the CA dataset, the digital signature manager 632 may request a new digital signature.

[0135] Further reference Figure 6A Virtual cloud network 602b (such as auxiliary VCN 618) may include distribution service 636. Distribution service 636 may obtain CA datasets from certificate store 630 and transfer the CA datasets to various network entities 638 associated with virtual cloud network 602b. Distribution service 636 may transfer CA datasets that have been digitally signed by key management service 610 to network entities 638. In one example, distribution service 636 may identify CA datasets associated with digital signatures in certificate store 630, and distribution service 636 may transfer or push the CA datasets and their digital signatures to one or more network entities 638. Additionally, or alternatively, distribution service 636 may receive a request from network entity 638 to provide one or more new CA certificates and / or one or more new certificate packages to network entity 638. Distribution service 636 may, in response to the request, transfer the CA datasets and their digital signatures to network entity 638.

[0136] like Figure 6AAs shown, a virtual cloud network 602v (such as an auxiliary VCN 618) may include multiple network entities 638, such as network entity 638c and network entity 638n. Each network entity 638 may include a provisioning module 640 and a public key store 626. For example, network entity 638c may include a provisioning module 640c and a public key store 626c, and network entity 638n may include a provisioning module 640n and a public key store 626n. The public key store 626 of network entity 638 (such as the public key store 626c of network entity 638c) may include one or more global public keys. Each global public key in the public key store 626 of network entity 638 may correspond to a global private key used by the key management service 610 to digitally sign CA datasets.

[0137] In one example, one or more global public keys may be included in a configuration file and / or operating system image for network entity 638. Additionally, or alternatively, one or more global public keys may be transmitted to network entity 638, for example, by distribution service 636. For example, distribution service 636 may obtain one or more global public keys from public key store 626b. In one example, public key store 626b may be associated with virtual cloud network 602b. Additionally, or alternatively, public key store 626b may be associated with CA provisioning service 628, certificate store 630, and / or digital signature manager 632. Distribution service 636 may transmit one or more global public keys obtained from public key store 626b to one or more network entities, such as provisioning module 640 of the corresponding network entity 638. Provisioning module 640 may install one or more global public keys in public key store 626b of network entity 638. For example, distribution service 636 can transmit one or more global public keys to provisioning module 640c of network entity 638c, and provisioning module 640c can install one or more global public keys in public key store 626c.

[0138] The provisioning module 640 of network entity 638 can perform the initial provisioning of network entity 638. Additionally, or alternatively, the provisioning module 640 can perform periodic updates to network entity 638. The initial provisioning and / or periodic updates of network entity 638 may include obtaining a CA dataset and its digital signature from distribution service 636 and installing one or more CA certificates and / or a certificate package including one or more CA certificates in a storage medium associated with network entity 638. The provisioning module 640 may request a CA dataset from distribution service 636. The request for a CA dataset may be associated with the initial provisioning or periodic updates of network entity 638. Distribution service 636 may distribute the CA dataset to provisioning module 640 in response to a request from provisioning module 640. Additionally, or alternatively, the distribution service may (e.g., without receiving a request from provisioning module 640) push a CA dataset to provisioning module 640.

[0139] In one example, the supply module 640 can (e.g., before the CA dataset is installed in the storage medium) verify the CA dataset using a global public key corresponding to the global private key used by the key management service 610 to digitally sign the CA dataset.

[0140] The supply module 640 can verify the CA dataset by calculating its hash value using the same hash function used by the key management service 610 when digitally signing the CA dataset. The supply module 640 can then decrypt the digital signature using the global public key to obtain the decrypted hash value. The supply module 640 can compare the decrypted hash value with the hash value of the CA dataset. When the decrypted hash value matches the hash value of the CA dataset, it means that the CA dataset digitally signed by the key management service 610 is identical to the CA dataset for which the supply module 640 calculated its hash value. Therefore, the supply module 640 can determine that the CA dataset is valid at least when the decrypted hash value matches the hash value of the CA dataset. The supply module 640 can verify the CA dataset (e.g., before mounting it in the storage medium associated with the network entity 638). In one example, if there is a mismatch between the decrypted hash value and the hash value of the CA dataset, the supply module 640 can reject the CA dataset. If the decrypted hash value does not match the hash value of the CA dataset, the digital signature manager 632 can request a new digital signature.

[0141] Further reference Figure 6AIn one example, a virtual cloud network 602a (such as a home VCN 614) may include a credential service 642. Credential service 642 may provide credentials, such as certificates or tokens, to digital signature manager 632. Digital signature manager 632 may have authorization to request digital signature of a CA dataset based at least on the credential. Digital signature manager 632 may provide credentials to key management service 610 in connection with a request for digital signature of the CA dataset. Key management service 610 may verify the credentials before digitally signing the CA dataset. If the credentials are invalid, key management service 610 may refuse the request to digitally sign the CA dataset.

[0142] Now for reference Figure 6B The system 600 is further described with reference to the example virtual cloud network 650. The virtual cloud network 650 may include reference to... Figure 6A The virtual cloud network 602b is described, such as the auxiliary VCN 618. (e.g.) Figure 6B As shown, the virtual cloud network 650 may include a substrate network 652, an overlay network 654, and a network interface 656 providing communication between the substrate network 652 and the overlay network 654. The system may include multiple network entities 658 located throughout the virtual cloud network. The multiple network entities 658 may be connected to a reference... Figure 6A The description corresponds to multiple network entities 638. Network entity 658 may reside on the base network 652, the overlay network 654, or the network interface 656. Network entities 658 (such as nodes, hosts, agents, services, components, endpoints, or other elements) may be implemented in association with the virtual cloud network using hardware and / or software. The multiple network entities 658 may include one or more base entities 660, one or more interface entities 662, and / or one or more overlay entities 664.

[0143] As used herein, the term "base entity" refers to network entity 658 implemented in base network 652. As used herein, the term "base network" refers to physical network infrastructure. The base network generally provides the foundation for a virtual cloud network. Base network 652 may include physical network devices such as routers, switches, network links, and other networking components. Base network 652 generally provides the basic connectivity and transport capabilities necessary for data transmission within and between data centers.

[0144] One or more base entities 660 may include base hosts, routers, firewall appliances, load balancers, storage devices, and / or base services. Base hosts may include endpoints within the base network 652, such as bare-metal hosts, virtual machines, containers, or physical servers. Base services may include services that execute or are executable on the base entities, such as firmware services, network connectivity services, addressing services, name resolution services, security services, network monitoring services, load balancing services, and / or storage services. Firmware services may be associated with the functionality or management of network infrastructure components or services, such as network devices, boot or initialization processes, hardware control, feature enabling, updates, hardware abstraction, network configuration, and / or network management. In one example, base entity 660 may include a combination of hardware and software. In one example, one or more base entities 660 may include one or more base hosts and / or one or more base services. In one example, a base host may include a bare-metal host. In one example, a base service may include a firmware service. Base entities 660 may communicate with each other and / or with other network entities 658 using logical network addresses assigned within the overlay network.

[0145] As used herein, the term "network interface" refers to the communication interface between the base network and the overlay network, such as a network interface card (NIC), a smartNIC, etc. Network interface 656 may include one or more interface entities 662, such as nodes on network interface 656, or interface services that are performed or executable on network interface 656. Nodes on network interface 656 may include programmable hardware components, memory components, or gateway components. In one example, network interface 656 may include a network interface card, such as a smartNIC. Additionally, or alternatively, network interface 656 may include nodes or endpoints on a network interface card or smartNIC.

[0146] A gateway component can provide connectivity between the base network 652 and network interface 656, and / or connectivity between network interface 656 and overlay network 654. For example, the gateway component can enable communication between overlay entity 664 and base entity 660. Additionally, or alternatively, the gateway component can provide connectivity between overlay network 654 and external networks, such as the Internet or other networks outside the overlay network. For example, an overlay gateway can enable communication between overlay entity 664 and external endpoints.

[0147] As used herein, the term "overlay network" refers to a virtual network built on top of an underlying network using software-defined networking (SDN), virtualization, tunneling, and / or encapsulation technologies. Overlay networks generally operate independently of the underlying underlying network. Overlay networks can provide logical separation and isolation of traffic, enable virtual network provisioning, and / or allow the implementation of various network services and policies. Virtual machines, hosts, containers, or virtual network functions running on the underlying network can be connected via the overlay network.

[0148] As used herein, the term "overlay entity" refers to network entity 658 implemented on overlay network 654. Overlay network 654 may include multiple overlay entities 664. Multiple overlay entities 664 may include overlay hosts, overlay services, subnets, overlay controllers, and / or overlay clients. In one example, overlay network 654 may include multiple overlay entities 664, such as overlay entity 664c and overlay entity 664n. In one example, overlay entity 664 may include an overlay host. Additionally, or alternatively, overlay entity 664 may include an overlay service. Multiple overlay entities 664 may communicate with each other using logical network addresses assigned within overlay network 654.

[0149] Overlay hosts may include endpoints within the overlay network 654, such as virtual machines, containers, or physical servers. Overlay services may include services that execute or are executable on the overlay entity. Overlay services may include client-specific services, such as services installed by the client. Additionally, or alternatively, overlay services may include virtual network creation services, virtual network management services, virtual machine orchestration services, container orchestration services, network virtualization services, overlay security services, load balancing services, multi-tenancy services, and / or tenant isolation services.

[0150] Subnets may include virtual network segments with differentiated addressing schemes and / or differentiated network policies and / or service sets. Subnets may include a collection of overlay hosts. Multiple subnets may be used to partition a corresponding collection of overlay hosts. An overlay controller may oversee network policies within the overlay, network entities on the overlay network, and / or the management, control, provisioning, configuration, and / or monitoring of the overlay network. The overlay controller interacts with the underlying base network, for example, to coordinate the operation of overlay hosts and / or communication across virtual switches and tunnels. Overlay clients may include endpoints or devices that initiate communication within the overlay network. Overlay clients may be specific instances or roles within an overlay host. An overlay host may include a collection of overlay clients. Overlay clients may include consumers or users of services provided by the overlay host or IaaS. Overlay clients may act as consumers or clients of resources or services, requesting and consuming resources or services from the overlay host.

[0151] Further reference Figure 6BSystem 600 may include at least one distribution service 666 and at least one certificate store 668. At least one distribution service 666 may be compatible with reference to... Figure 6A The described distribution service 636 corresponds to this. Distribution service 666 can be configured to distribute certificate packages, including CA certificates, to at least some of the network entities in network entity 658. The certificate packages can be contained in a certificate store 668 accessible by distribution service 636. Certificate store 668 can be related to the reference... Figure 6A The described certificate store 630 corresponds to this. Distribution service 666 can retrieve certificate packets from certificate store 668 and transmit them to one or more network entities in network entity 658. In one example, distribution service 666 can be configured to cause multiple network entities to transition (e.g., concurrently transition) through a series of stages of certificate packet distribution processing used during certificate authentication by distributing a new set of one or more CA certificates to multiple network entities 658.

[0152] In one example, a first distribution service 666a may be implemented on a base network 652. The distribution service 666a implemented on the base network 652 may be communicatively coupled to one or more base entities 660 on the base network 652. Additionally, or alternatively, the distribution service 666a implemented on the base network 652 may be communicatively coupled to a network interface 656, such as to one or more interface entities 662 on the network interface 656. For example, the first distribution service 666a may obtain a certificate package from a certificate store 668 and distribute the certificate package to one or more base entities 660 on the base network 652 and / or one or more interface entities 662 on the network interface 656.

[0153] In one example, a second distribution service 666b may be implemented on network interface 656. The distribution service 666 implemented on network interface 656 may be communicatively coupled to overlay network 654 and / or base network 652. For example, the second distribution service 666b implemented on network interface 656 may be communicatively coupled to one or more overlay entities 664 on overlay network 654. The second distribution service 666b may distribute certificate packets to one or more overlay entities 664 on overlay network 654. In one example, the second distribution service 666b may obtain certificate packets from storage media associated with network interface 656, such as storage media associated with interface entity 612 on network interface 656. For example, the second distribution service 666b may distribute certificate packets that have already been installed in storage media associated with network interface 656 and / or interface entity 662. In one example, a first distribution service 666a may distribute a certificate package to an interface entity 662 on a network interface 656, and a second distribution service 666b may distribute the certificate package to one or more overlay entities 664 on an overlay network 654 after the certificate package has been installed in the storage medium associated with the interface entity 662.

[0154] like Figure 6B As shown, each network entity 658 may include a supply module 670 and a storage medium 672. The supply module 670 may be connected to a reference... Figure 6A The described supply module 640 corresponds to this. Storage medium 672 may include a reference... Figure 6A The described network entity 638 has a public key store 626. A provisioning module 670 associated with network entity 658 can receive certificate packets from distribution service 666 and install them in storage medium 672 associated with network entity 658. Distribution service 666 can distribute certificate packets to provisioning module 670 in connection with the initial provisioning of network entity 658 and / or in connection with periodic updates. Additionally, or alternatively, distribution service 666 can distribute certificate packets to provisioning module 670 according to the appropriate stage of the certificate packet distribution process.

[0155] In one example, the provisioning module 670 of overlay entity 664 can send a request for a certificate package to the distribution service 666 via a gateway 674 between the network interface 656 and the overlay entity 664. Alternatively, the distribution service 666 can (e.g., in response to a request from the provisioning module 670) send the certificate package to the overlay entity 664 via the gateway 674. In one example, the gateway 674 can be a metadata interface configured to exchange metadata between the network interface 656 and the overlay entity 664. In one example, the gateway 674 can be utilized between the network interface 656 and each of the overlay entities 664. Alternatively, the network interface 656 can include a set of gateways 674, each gateway 674 corresponding to a specific overlay entity 664.

[0156] In one or more embodiments, system 600 may include a ratio Figure 6A and Figure 6B The diagram shows more or fewer components. Figure 6A and Figure 6B The components shown in the diagram can be local or remote to each other. Figure 6A and Figure 6B The components illustrated in the diagram may include software and / or hardware components. Each component may be distributed across multiple applications and / or machines. Multiple components may be combined into one application and / or machine. Operations described with respect to one component may be performed alternatively by another component. Additional embodiments and / or examples related to system 600 are described in Part 2 above, entitled “Cloud Computing Technology”.

[0157] In an embodiment, system 600 may include various components implemented on one or more digital devices. The term "digital device" generally refers to any hardware device that includes a processor. A digital device may refer to a physical device that executes an application or virtual machine. Examples of digital devices include computers, tablets, laptops, desktops, netbooks, servers, web servers, network policy servers, proxy servers, general-purpose machines, function-specific hardware devices, hardware routers, hardware switches, hardware firewalls, hardware network address translators (NAT), hardware load balancers, mainframes, televisions, content receivers, set-top boxes, printers, mobile phones, smartphones, personal digital assistants (PDAs), wireless receivers and / or transmitters, base stations, communication management equipment, routers, switches, controllers, access points, and / or client devices.

[0158] 6. Authenticating network entities

[0159] Network entities can use CA certificates from a certificate package to authenticate other network entities associated with the virtual cloud network. For example, communication between network entities can be conducted according to a security protocol. This security protocol may include, for example, authenticating network entities based on entity certificates issued by a CA before establishing communication with them.

[0160] In one example, an entity certificate and the CA certificate corresponding to the CA that issued the entity certificate can represent at least a portion of a certificate chain. To authenticate a network entity, each signature-key pair in the certificate chain is verified. In one example, a top-level CA can issue an entity certificate; in this case, the certificate chain can include a signature-key pair—that is, the digital signature of the top-level CA in the entity certificate and the public key of the top-level CA. Such a top-level CA is sometimes referred to as a root CA. In another example, a certificate chain can include signature-key pairs corresponding to multiple CA certificates. For example, a root CA can issue intermediate CA certificates to intermediate CAs, and the intermediate CAs can issue entity certificates to network entities. In this case, the certificate chain includes two signature-key pairs—that is, (i) the digital signature of the intermediate CA in the entity certificate and the public key of the intermediate CA; and (ii) the digital signature of the root CA in the intermediate CA certificate and the public key of the root CA.

[0161] As used herein, the terms "Certificate Authority Certificate" or "CA Certificate" refer to a digital certificate issued by a Certificate Authority (CA) to establish its own identity and authenticity. A Certificate Authority Certificate can be a root CA certificate or an intermediate CA certificate. Certificate Authority Certificates can be used to sign and issue other digital certificates, including those for secure communication between network entities.

[0162] As used herein, the term "Certificate Authority" or "CA" refers to the entity responsible for issuing and managing digital certificates. A CA verifies the identity of a network entity and digitally signs its certificates to prove their authenticity.

[0163] As used herein, the term "root certificate authority certificate" or "root CA certificate" refers to the top-level CA certificate in a certificate chain or hierarchy. A root CA certificate can be self-issued and / or self-signed by the root CA. As used herein, the term "root CA" refers to the top-level CA in a CA hierarchy. A root CA can issue root CA certificates, intermediate CA certificates, or entity certificates.

[0164] As used herein, the term "intermediate certificate authority certificate" or "intermediate CA certificate" refers to an intermediate-level CA certificate in a certificate chain or hierarchy. An intermediate CA certificate can be issued by a root CA. An intermediate CA certificate sits between the entity certificate and the root CA certificate in a certificate chain or hierarchy. As used herein, the term "intermediate CA" refers to an intermediate-level CA in a CA hierarchy. An intermediate CA can issue entity certificates, for example, according to the permissions granted to the intermediate CA by the root CA.

[0165] As used herein, the term "entity certificate" refers to a digital certificate issued to an entity, such as a network entity associated with a virtual cloud network. Entity certificates can be used to verify the identity of an entity and enable secure communication between entities, such as between network entities within a virtual cloud network. Entity certificates can be issued by a CA (such as a root CA or an intermediate CA).

[0166] In one example, the entity certificate could be an instance master certificate. As used herein, the term "instance master certificate" refers to a digital certificate used for authentication and secure communication with an instance or VM associated with a virtual cloud network. In one example, instances and VMs can be dynamically created, extended, and terminated. Instance master certificates can be associated with an instance or VAM for its lifetime and can be automatically generated and managed by the virtual cloud network infrastructure. Instance master certificates can have limited access permissions to communicate with certain network entities based on the permissions assigned to the network entity that issued the instance master certificate.

[0167] As used herein, the term "digital certificate" refers to a digitally signed electronic document that binds a public key to the identity of an entity. Digital certificates may conform to the International Telecommunication Union standard X.509. A digital certificate may include the name of the issuer, the name of the certificate holder, the public key, the issuer (CA) information, and the expiration date. Digital certificates can be used in various security protocols, such as SSL / TLS, to establish the identity and authenticity of communicating parties and facilitate secure communication.

[0168] 6. Sample Certificate Package Distribution Processing

[0169] Now for reference Figure 7 This further describes the operations related to the sample certificate package distribution process. (See reference) Figure 7 The described operation 700 can be associated with distributing a new set of one or more CA certificates to multiple network entities for use in certificate authentication processing. CA certificates may include root CA certificates and / or intermediate CA certificates. CA certificates may be contained within a certificate package. Figure 7 One or more operations 700 shown can be modified, rearranged, or omitted together. Accordingly, Figure 7The specific order of operations 700 shown should not be construed as limiting the scope of one or more embodiments. Figure 7 The operation 700 shown, relating to certificate package distribution processing, may include a series of stages or a sequence of stages. In one example, as shown, operation 700 may include a series of stages or a sequence of stages, such as four (4) stages. In another example, the series of stages or the sequence of stages may include more or fewer than four (4) stages, for example, including Figure 7 All or some of the stages shown in the diagram.

[0170] In one example, operation 700 may include, at box 702, distributing a new certificate package containing a new set of one or more CA certificates to a set of network entities associated with the virtual cloud network. The new set of one or more CA certificates may include at least one new CA certificate. Additionally, or alternatively, the new set of CA certificates may be added to an existing certificate package.

[0171] At box 704, operation 700 may include determining whether the new certificate package has been successfully distributed. When the new certificate package has been successfully distributed, operation 700 may proceed to the next stage of the distribution process. The operations at boxes 702 and / or 704 may represent stage 1 of the certificate package distribution process.

[0172] In one example, operation 700 may include, at box 706, activating the CA certificate in the new certificate package. In one example, activating the CA certificate may include issuing one or more intermediate CA certificates corresponding to the CA certificate. The operation at box 706 may represent phase 2 of the certificate package distribution process.

[0173] In one example, operation 700 may include, at box 708, distributing a new entity certificate to the set of network entities. Additionally, or alternatively, operation 700 may include distributing a new intermediate CA certificate, for example, an intermediate CA certificate corresponding to the new entity certificate.

[0174] At box 710, operation 700 may include determining whether the new entity certificate has been successfully distributed. Additionally, or alternatively, the operation may include determining whether the new intermediate CA certificate has been successfully distributed. When the new entity certificate (and / or the new intermediate CA certificate) has been successfully distributed, operation 700 may proceed to the next stage of the distribution process. The operations at boxes 708 and 710 may represent stage 3 of the certificate package distribution process.

[0175] In one example, operation 700 may include, at box 712, removing an earlier CA certificate that was distributed before the new CA certificate. For example, the earlier CA certificate may include a CA certificate that is being superseded by the new CA certificate. Removing an earlier CA certificate for a specific network entity may include deleting the earlier CA certificate from the storage medium associated with that specific network entity. For example, operation 700 may include transmitting an instruction to that specific network entity to delete the earlier CA certificate from the storage medium. In response to receiving the instruction, the specific network entity may delete the earlier CA certificate from the storage medium.

[0176] Additionally, or alternatively, removing an earlier CA certificate for a network entity may include replacing a first new certificate package with a second new certificate package, wherein the first new certificate package includes both the new CA certificate and the earlier CA certificate, and the second new certificate package includes only the new CA certificate, thereby effectively removing the earlier CA certificate from the first new certificate package. The second new certificate package may be distributed to a specific network entity and installed in storage media associated with that specific network entity, and the first new certificate package may be removed from the storage media. The operation at box 712 may represent stage 4 of the certificate package distribution process.

[0177] 7. Verify Certificate Authority Dataset

[0178] Now for reference Figures 8A-8C Further description of operations related to verifying CA datasets using asymmetric keys 800. Reference Figures 8A-8C The described operation 800 can represent at least a portion of the processing used to distribute certificate packages to network entities and / or provision cloud resource instances, as described herein. References Figures 8A-8C One or more operations 800 described can be modified, combined, rearranged, or omitted together. Accordingly, refer to... Figures 8A-8C The specific order of operations 800 described should not be construed as limiting the scope of one or more embodiments.

[0179] A. Digital Signature Manager Operation

[0180] refer to Figure 8A This further describes the operations associated with the digital signature manager. For example... Figure 8A As shown, operation 800 may include, at block 802, detecting a set of one or more new CA certificates in a certificate store on the first virtual cloud network. In one example, detecting a set of one or more new CA certificates may include identifying one or more new CA certificates in the certificate store and determining that one or more new CA certificates are not associated with a current digital signature from a key management service.

[0181] At box 804, operation 800 may include transmitting a CA dataset, comprising a set of one or more new CA certificates, to a key management service hosted on a second virtual cloud network. In one example, the CA dataset may include a certificate package, and the certificate package may include a set of CA certificates. The set of CA certificates in the certificate package may include one or more new CA certificates. In one example, transmitting the CA dataset may include transmitting a request to the key management service to digitally sign the CA dataset. Additionally, or alternatively, operation 800 may include transmitting credentials to the key management service to authenticate the request to digitally sign the CA dataset.

[0182] At box 806, operation 800 may include receiving a digital signature of a CA dataset from a key management service. The digital signature of the CA dataset may be generated based at least on a global private key stored in a private key store associated with the key management service on a second virtual cloud network. At box 808, operation 800 may include storing the digital signature in a data structure in a certificate store that associates the digital signature with the CA dataset.

[0183] At box 810, operation 800 may include determining whether the certificate store contains another set of new CA certificates. For example, operation 800 may include periodically checking the certificate store to obtain another set of new CA certificates. Additionally, or alternatively, operation 800 may include receiving notification that the certificate store contains another set of new CA certificates. When the certificate store contains another set of new CA certificates, the operation may return to box 804. Additionally, or alternatively, when the certificate store does not contain another set of new CA certificates, operation 800 of the digital signature manager may end at box 812.

[0184] In one example, operation 800 may include (e.g., in relation to the deployment region and / or in relation to the deployment of the first virtual cloud network in that region) generating at least one new CA certificate. In one example, the at least one new CA certificate may include one or more root CA certificates for issuing intermediate CA certificates and / or entity certificates to network entities associated with the first virtual cloud network.

[0185] In one example, operation 800 may include transmitting a CA dataset and a digital signature of the CA dataset to at least one network entity. The CA dataset and the digital signature of the CA dataset may be transmitted to at least one network entity in response to a request from at least one network entity, for example, as referenced. Figure 8C As described.

[0186] B. Distribution service operation

[0187] refer to Figure 8B This further describes the operations associated with the distribution service. For example... Figure 8B As shown, operation 800 may include, at block 822, receiving a request from a network entity for a set of at least one new Certificate Authority (CA) certificates from a distribution service associated with the first virtual cloud network. In one example, the request for at least one new CA certificate may be associated with the initial provisioning of cloud resource instances on the first virtual cloud network. Additionally, or alternatively, the request for at least one new CA certificate may be one of a series of periodic requests for updated certificate packages.

[0188] At box 824, operation 800 may include, in response to receiving a request, transmitting to the network entity (a) a CA dataset comprising a set of at least one new CA certificate, and (b) a digital signature of the CA dataset. In one example, operation 800 may include locating the CA dataset and digital signature in a certificate store. For example, the current CA dataset may be located based on one or more identification markers, such as an identifier or timestamp associated with the CA dataset. At box 826, the operation may include determining whether another request has been received from the network entity. When another request is received from the network entity, the operation may return to box 824. Alternatively, the operation of distributing the service may end at box 828.

[0189] In one example, in response to receiving a request from a network entity at box 822, operation 800 may include determining whether the current CA dataset has been transmitted to the network entity. This determination may be based on a comparison of a timestamp corresponding to the digital signature of the CA dataset and a timestamp corresponding to a previous transmission of the CA dataset to the network entity. For example, operation 800 may include determining a first timestamp corresponding to the digital signature of the CA dataset, determining a second timestamp corresponding to a previous transmission of the CA dataset to the network entity, and determining whether the second timestamp is earlier than the first timestamp. Operation 800 may include determining that the current CA dataset has not yet been transmitted to the network entity when the second timestamp is earlier than the first timestamp. Additionally, or alternatively, operation 800 may include determining that the current CA dataset has not yet been transmitted to the network entity when the second timestamp is later than the first timestamp. In response to the second timestamp being earlier than the first timestamp, operation 800 may include transmitting the CA dataset and the digital signature of the CA dataset to the network entity.

[0190] In one example, the digital signature of the CA dataset can be generated by a key management service hosted on a second virtual cloud network. The key management service can generate the digital signature of the CA dataset using a global private key stored in a private key store associated with the key management service on the second virtual cloud network. The CA dataset can be verifiable using a global public key corresponding to the global private key (e.g., by a network entity). The global public key can be stored in a public key store associated with the network entity.

[0191] In one example, operation 800 may include verifying the CA dataset using a global public key corresponding to the global private key before transmitting the CA dataset and its digital signature to the network entity. The global public key used by the distribution service to verify the CA dataset may be stored in a public key store associated with the distribution service. The global public key used by the distribution service may be an exact copy of the global public key used by the network entity to verify the CA dataset.

[0192] C. Network entity operations

[0193] refer to Figure 8C This further describes the operations associated with network entities. For example... Figure 8C As shown, operation 800 may include, at block 832, transmitting a request to a distribution service associated with the first virtual cloud network for a set of one or more Certificate Authority (CA) certificates for use by network entities. At block 834, operation 800 may include receiving from the distribution service (a) a CA dataset comprising the set of one or more CA certificates, and (b) a digital signature of the CA dataset.

[0194] At box 836, the operation may include verifying the CA dataset using a global public key stored in a public key store on a first virtual cloud network. In one example, the global public key may be embedded in the operating system image of the network entity. The global public key used to verify the CA dataset may correspond to a global private key used by a key management service to generate a digital signature for the CA dataset. The key management service may be hosted on a second virtual cloud network, and the global private key may be stored in a private key store associated with the key management service on the second virtual cloud network. In one example, the key management service may be a third-party service. At box 838, if the CA dataset is valid, then operation 800 may proceed to box 840. Alternatively, at box 838, if the CA dataset is invalid, then operation 800 may return to box 832. At box 840, operation 800 may include installing a set of one or more CA certificates on a storage medium associated with the network entity. In one example, installing a set of one or more CA certificates may represent an operation for provisioning the network entity, for example, as referenced. Figure 9 and Figure 10 As described.

[0195] D. Further features of the example operation

[0196] Further reference Figures 8A-8C Regarding the first virtual cloud network described in Operation 800, it can be a secondary VCN, for example, as referenced. Figure 6A As described. In one example, the first virtual cloud network may be located within a first area of ​​a first domain. The first area may include a first set of one or more interconnected data centers on which the first virtual cloud network is deployed, and the first domain may include a first IaaS system infrastructure. Additionally, or alternatively, the second virtual cloud network may be a home VCN, for example, as referenced. Figure 6A As described, the second virtual cloud network may be located within a second area of ​​the second domain. The second area may include a second set of one or more interconnected data centers on which the second virtual cloud network is deployed. The second domain may include a second IaaS system infrastructure.

[0197] 8. Provisioning cloud resource instances

[0198] Now for reference Figure 9 This section further describes example operations for provisioning cloud resource instances associated with a virtual cloud network. Provisioning a cloud resource instance may include creating and configuring the cloud resource instance for use on the virtual cloud network. After provisioning, the cloud resource instance becomes available on the virtual cloud network. Following provisioning, various deployment operations can be performed, for example, by the cloud resource instance's customer or tenant. Figure 9 As shown, the provisioning process 900 may include multiple stages 902. Each stage 902 may include one or more operations for provisioning cloud resource instances. Stages 902 of the provisioning process 900 and / or the operations associated with a corresponding stage 902 may be modified, rearranged, or omitted. Accordingly, refer to... Figure 9 The specific order of phase 902 and / or associated operations described should not be construed as limiting the scope of one or more embodiments.

[0199] like Figure 9 As shown, provisioning process 900 may include at least one of the following: configuration file generation phase 904, local environment setup phase 906, network configuration phase 908, instance parameter configuration phase 910, or instance completion phase 912. Additionally, or alternatively, provisioning process 900 may include certificate package provisioning phase 914.

[0200] In one example, the configuration file generation phase 904 may include one or more operations associated with identifying data sources available to the provisioning module and / or instance provisioning agent and generating configuration files accordingly. Available data sources may include distribution services, certificate repositories, and / or storage media associated with network entities. Additionally, or alternatively, available data sources may include metadata sources, such as cloud provider metadata services and / or instance-specific metadata services.

[0201] In one example, the local environment setup phase 906 may include one or more operations associated with setting up the local environment for the cloud resource instance. For example, the local environment phase may include hostname configuration, setting up user accounts, and executing scripts or commands specified in a data source referenced in relation to provisioning process 900.

[0202] In one example, network configuration phase 908 may include one or more operations associated with configuring network interfaces and related settings, such as assigning IP addresses, configuring DNS settings, defining routes, and managing network bindings or bridging configurations. Additionally, or alternatively, network configuration phase 908 may include configuring security protocol settings, including creating a certificate package file directory, generating a pointer to the certificate package file directory, and / or obtaining one or more network entity certificates for the cloud resource instance.

[0203] In one example, instance parameter configuration phase 910 may include one or more operations associated with processing the configuration file generated in configuration file generation phase 904 and / or one or more operations associated with applying specified settings to the cloud resource instance. The specified settings may include package installation settings, user-specific settings, file modification settings, and / or service configuration settings.

[0204] In one example, instance completion phase 912 may include one or more operations associated with attached instance configuration scripts and / or system cleanup tasks.

[0205] In one example, certificate package provisioning phase 914 may include one or more operations associated with retrieving, verifying, and installing a collection of certificate packages including CA certificates. For example, certificate package provisioning phase 914 may include referencing... Figure 10 One or more operations described.

[0206] In one example, at least a portion of the provisioning process 900 may be performed by a provisioning module associated with a cloud resource instance. Additionally, or alternatively, a portion of the provisioning process 900 may be performed by one or more provisioning agents. One or more provisioning agents may represent a portion of the provisioning module. Additionally, or alternatively, a provisioning agent may represent a service executed on a virtual cloud network. The provisioning module may invoke one or more provisioning agents and prompt them to perform at least a portion of the provisioning process.

[0207] In one example, the provisioning process shown may include one or more operations performed by an instance provisioning agent and one or more operations performed by a certificate package provisioning agent. The instance provisioning agent and / or certificate package provisioning agent may represent part of a service or provisioning module performed on a virtual cloud network. In one example, the instance provisioning agent may perform at least one of the following: configuration file generation phase 904, local environment setup phase 906, network configuration phase 908, instance parameter configuration phase 910, or instance completion phase 912. The certificate package provisioning agent may perform one or more operations associated with certificate package provisioning phase 914.

[0208] In one example, certificate packet provisioning phase 914 may be triggered by certificate packet retrieval trigger 916 within provisioning process 900. Certificate packet retrieval trigger 916 may be an executable command associated with one or more operations of provisioning process 900. For example, as shown, certificate packet retrieval trigger may be associated with network configuration phase 908. In response to detecting certificate packet retrieval trigger 916, instance provisioning agent may prompt certificate packet provisioning agent to perform one or more operations associated with certificate packet provisioning phase 914. After one or more operations associated with certificate packet provisioning phase 914 have been completed, certificate packet provisioning agent may prompt instance provisioning agent to perform one or more operations associated with certificate packet provisioning phase 914. For example, certificate packet provisioning phase 914 may include certificate packet installed trigger 918. In response to detecting certificate packet installed trigger 918, certificate packet provisioning agent may send a notification to instance provisioning agent indicating that one or more operations associated with certificate packet provisioning phase 914 have been completed. In response to receiving a prompt from certificate packet provisioning agent, instance provisioning agent may perform one or more subsequent operations of provisioning process 900.

[0209] One or more stages of provisioning process 900 may be executed before the certificate package retrieval trigger 916 is detected. For example, the configuration file generation stage 904 and the local environment setup stage 906 may be executed before the certificate package retrieval trigger 916 is detected. Additionally, or alternatively, at least a portion of the network configuration stage may be executed before the certificate package retrieval trigger 916 is detected. One or more stages of provisioning process 900 may be executed after the certificate package installation trigger 918 (such as after the certificate package provisioning stage 914 is completed). For example, the instance parameter configuration stage 910 and the instance completion stage 912 may be executed after the certificate package installation trigger 918. Additionally, or alternatively, at least a portion of the network configuration stage 908 may be executed after the certificate package installation trigger 918.

[0210] In one example, provisioning process 900 may include initializing a security protocol for secure communication between a cloud resource instance and another network entity associated with the virtual cloud network. The security protocol may be initialized as part of network configuration phase 908. For example, the security protocol may be initialized to allow further operations associated with network configuration phase 908 and / or one or more other phases of provisioning process 900.

[0211] In one example, initializing the security protocol may include receiving an entity certificate from a network entity and authenticating the entity certificate using at least one CA certificate from the certificate package. In one example, after the security protocol has been initialized, one or more subsequent operations of provisioning process 900 may be performed, such as one or more operations of network configuration phase 908, instance parameter configuration phase 910, and / or instance completion phase 912. In one example, one or more subsequent operations of provisioning process 900 may include, after the security protocol has been initialized, receiving a first secure communication from a network entity according to the security protocol, or sending a second secure communication to a network entity according to the security protocol.

[0212] In one example, a cloud resource instance may lack access to at least one CA certificate before detecting the certificate package retrieval trigger 916 and / or before the completion of the certificate package provisioning phase 914. The cloud resource instance may gain access to the CA certificate after the completion of the certificate package provisioning phase 914. In one example, one or more subsequent operations of the provisioning process 900 performed after the certificate package provisioning phase 914 may include one or more operations utilizing secure communication established between the cloud resource instance and the network entity according to a security protocol.

[0213] In one example, at least one subsequent operation of provisioning process 900 may include sending a notification to a service broker executing on a cloud resource instance, the notification including the location of the certificate package in the storage medium. Additionally, or alternatively, the certificate package may be sent to the service broker. The service broker may include or be associated with an overlay service, a base service, or an interface service. The service broker may perform one or more provisioning operations associated with the provisioning of an overlay service, a base service, or an interface service. For example, the service broker may perform one or more operations associated with the provisioning process 900 described herein with respect to an overlay service, a base service, or an interface service.

[0214] 9. Retrieve and install certificate packages

[0215] Now for reference Figure 10 This further describes operations 1000 related to the provision of network entities associated with the virtual cloud network. (See reference 1000.) Figure 10 One or more operations 1000 described can be modified, rearranged, or omitted together. Accordingly, refer to... Figure 10 The specific order of operations 1000 described should not be construed as limiting the scope of one or more embodiments. In one example, reference... Figure 10 The described operation 1000 can represent a portion of the provisioning process for supplying cloud resource instances associated with a virtual cloud network. For example, refer to... Figure 10 The described operation 1000 may include operations associated with the certificate package supply phase of the supply process.

[0216] like Figure 10 As shown, operation 1000 may include, at block 1002, performing at least one provisioning operation for provisioning processing of cloud resource instances associated with the virtual cloud network. In one example, at least one provisioning operation may include at least one operation associated with the configuration file generation phase and / or at least one operation associated with the local environment setup phase, for example, as referenced Figure 9 As described. Additionally, or alternatively, at least one supply operation may include at least one operation associated with the network configuration phase, for example, as referenced. Figure 9 As described.

[0217] During provisioning, a certificate package retrieval may be triggered. At box 1004, operation 1000 may include detecting whether a certificate package retrieval has been triggered. The certificate package retrieval trigger may be an executable command associated with one or more operations of the provisioning process, for example, as referenced... Figure 9As described, executable commands can be incorporated into computer-executable instructions, such as those executed by an instance provisioning agent. In one example, the instance provisioning agent can detect that a certificate package retrieval has been triggered, for example, based on an executable command within the computer-executable instructions. In response to detecting a certificate package retrieval trigger, the instance provisioning agent can prompt the certificate package provisioning agent to perform one or more operations associated with the certificate package provisioning phase, such as, as described in the reference... Figure 9 As described, the certificate package provisioning agent performs one or more operations associated with the certificate package provisioning phase based on executable operations performed by the certificate package provisioning agent.

[0218] If a certificate package retrieval is not triggered, operation 1000 can return to box 1002 and perform additional supply processing operations. When a certificate package retrieval is triggered, operation 1000 can proceed to box 1006.

[0219] At box 1006, the operation may include sending a request for a certificate package for the cloud resource instance to a network interface linked to the cloud resource instance. For example, the request for the certificate package may be sent to a distribution service executing on the network interface. The request for the certificate package for the cloud resource instance may be sent by a certificate package provisioning agent, for example, as referenced... Figure 9 As described. The location of the network interface and / or distribution service can be determined based on the network directory address associated with the network interface and / or the distribution service executed on the network interface. The network directory address can be incorporated into, for example, computer-executable instructions executed by a certificate package supplied to an agent. A request for a certificate package can include configuration information about the cloud resource instance. The network interface can select a certificate package based on the configuration information. A request for a certificate package can include the network location for the network interface to send the certificate package, such as the file directory associated with the cloud resource instance where the certificate package can be installed and / or the network directory address of the cloud resource instance.

[0220] In response to receiving a request, the operation may include, at box 1008, receiving from the network interface (i) a CA dataset including a certificate package for a cloud resource instance and (ii) a digital signature of the CA dataset. The certificate package may include a collection of one or more CA certificates. The collection of one or more CA certificates may include one or more root CA certificates and / or one or more intermediate CA certificates.

[0221] At box 1010, the operation may include verifying the CA dataset using a global public key stored in a public key store on a first virtual cloud network. In one example, the global public key may be embedded in the operating system image of the cloud resource instance. The global public key used to verify the CA dataset may correspond to a global private key used by a key management service to generate a digital signature for the CA dataset. The key management service may be hosted on a second virtual cloud network, and the global private key may be stored in a private key store associated with the key management service on the second virtual cloud network. At box 1012, if the CA dataset is valid, then operation 800 may proceed to box 1014. Alternatively, at box 1012, if the CA dataset is invalid, then operation 800 may return to box 1006.

[0222] At box 1014, operation 1000 may include installing a certificate package on storage media associated with the cloud resource instance. Installing the certificate package may include making the certificate package available to the cloud resource instance for verifying network entities. For example, installing the certificate package may include creating a file and storing the certificate package in that file. Additionally, or alternatively, installing the certificate package may include creating a file directory for the certificate package and / or specifying a location where a process or application running on the cloud resource instance can find the certificate package. For example, the location of the certificate package may be specified in an operating system configuration file, a registry settings file, or an executable file. Installing the certificate package may represent an operation provisioned for processing. In one example, prior to installing the certificate package, operation 1000 may include one or more verification operations related to the certificate package. In one example, operation 1000 may include performing verification of the certificate package, determining that the certificate package passes verification, and installing the certificate package on storage media in response to determining that the certificate package passes verification.

[0223] In one example, verifying a certificate package may include performing a subject key identifier check on at least a subset of the CA certificates from the set of CA certificates in the certificate package. The verification operation may include determining that each CA certificate in the subset of CA certificates passes the subject key identifier check. In one example, a subject key identifier check may be performed on all CA certificates in the certificate package. For a particular CA certificate, the subject key identifier check may include: calculating a hash value of the public key corresponding to the particular CA certificate, determining the subject key identifier corresponding to the particular CA certificate, and comparing the hash value with the subject key identifier. The subject key identifier may be a digital signature on the CA certificate. The subject key identifier may correspond to a private key associated with the public key. The private key and public key may represent an asymmetric key pair. For example, the subject key identifier (such as a digital signature on a CA certificate) may have been generated using the private key. The subject key identifier may be decrypted using a hash function.

[0224] In one example, the subject key identifier check may further include determining a match between the hash value and the subject key identifier corresponding to a specific CA certificate. When a match exists between the hash value and the subject key identifier, the specific CA certificate can be determined to have passed the subject key identifier check. In one example, a match between the hash value and the subject key identifier can be determined by decrypting the subject key identifier using a hash function and comparing the resulting decryption with the hash value of the public key. When the public key matches the subject key identifier, the decryption of the subject key identifier matches the hash value of the public key. Verification may include determining that the specific CA certificate has passed the subject key identifier check based on this match.

[0225] In one example, operation 1000 may include determining that certificate package verification failed and generating an alert indicating the certificate package verification failure for display on a user interface device. Additionally, or alternatively, in response to determining that the certificate package verification has failed, operation 1000 may include sending a follow-up request for an updated certificate package for the cloud resource instance to a network interface (and / or to a distribution service performing on the network interface). In response to receiving the follow-up request at the network interface (and / or at the distribution service), operation 1000 may include the network interface sending the updated certificate package for the cloud resource instance. Additionally, or alternatively, operation 1000 may include receiving the updated certificate package for the cloud resource instance from the network interface. The updated certificate package may include an updated set of CA certificates. Operation 1000 may also include performing follow-up verification of the updated certificate package. For example, follow-up verification may include a signature key identifier check as described above. In response to determining that the updated certificate package passes the follow-up verification, operation 1000 may include installing the updated certificate package into a storage medium.

[0226] After installing the certificate package at box 1014, operation 1000 may include, at box 1016, further performing one or more additional provisioning operations for provisioning the cloud resource instance associated with the virtual cloud network. In one example, the one or more additional provisioning operations may include at least one operation associated with the network configuration phase, for example, as referenced Figure 9 As described. For example, one or more additional provisioning operations may include configuring one or more network configuration settings for a cloud resource instance. One or more network configuration settings may be configured as part of a network configuration phase. In one example, one or more additional provisioning operations of the provisioning process may be triggered by a certificate package-installed trigger, as described in the reference. Figure 9As described, a certificate package installed trigger can be an executable command incorporated into computer-executable instructions executed by a certificate package provisioning agent. In response to detecting a certificate package installed trigger, the certificate package provisioning agent can send a notification to the instance provisioning agent, indicating that one or more operations associated with the certificate package provisioning phase have been completed. In response to receiving the notification from the certificate package provisioning agent, the instance provisioning agent can perform one or more subsequent operations in the provisioning process.

[0227] In one example, at box 1016, operation 1000 may include a network configuration phase for performing provisioning processing. During or after the network configuration phase, operation 1000 may include performing at least one of the following: detecting a certificate package retrieval trigger, receiving a certificate package, and installing the certificate package into a storage medium. Additionally, or alternatively, operation 1000 may include generating a file directory in the storage medium, installing the certificate package into the file directory, and / or sending a message including a directory path to the file directory to a service agent executing on the cloud resource instance. Additionally, or alternatively, one or more additional provisioning operations at box 1016 may include at least one operation associated with the instance parameter configuration phase, and / or at least one operation associated with the instance completion phase, for example, as referenced... Figure 9 As described. One or more additional provisioning operations for provisioning processing may be performed by the instance provisioning agent at block 1016, for example, according to computer-executable instructions executed by the instance provisioning agent.

[0228] 8. Miscellaneous; Extension

[0229] The embodiments relate to a system having one or more devices, said one or more devices including a hardware processor and configured to perform any operation described herein and / or any of the following claims. The embodiments relate to a system including components for performing any operation described herein and / or any of the following claims. In the embodiments, a non-transitory computer-readable storage medium includes instructions that, when executed by one or more hardware processors, cause to perform any operation described herein and / or any of the following claims.

[0230] According to one or more embodiments, any combination of the features and functions described herein may be used. In the foregoing description, embodiments have been described with reference to numerous specific details that may vary depending on the implementation. Accordingly, this specification and the accompanying drawings should be viewed in an illustrative rather than restrictive sense. The unique and exclusive reference to the scope of the invention, and what the applicant intends to define as the scope of the invention, is the literal and equivalent scope of the set of claims issued in this application, and should be presented in the specific form of those claims, including any subsequent corrections.

[0231] All references cited in this article, including publications, patent applications and patents, are incorporated into this article by reference to the same extent as if each reference individually and specifically indicated to be incorporated by reference and elaborated in full in this article.

Claims

1. One or more non-transitory computer-readable media, including instructions that, when executed by one or more hardware processors, cause to perform operations including: Detect at least one new Certificate Authority (CA) certificate in the certificate store on the first virtual cloud network; Transmit a CA dataset, including the at least one new CA certificate, to a key management service hosted on a second virtual cloud network; Receive digital signatures of CA datasets from the key management service, wherein the digital signatures of the CA datasets are generated based at least on a global private key, which is stored in a private key store associated with the key management service on a second virtual cloud network; Digital signatures are stored in a certificate store, which includes data structures that associate digital signatures with a CA dataset.

2. The medium as described in claim 1, The first virtual cloud network is located within a first area of ​​a first domain, the first area comprising a first set of one or more interconnected data centers on which the first virtual cloud network is deployed, and the first domain comprising a first Infrastructure as a Service (IaaS) system infrastructure; and The second virtual cloud network is located within a second area of ​​the second domain, the second area includes a second set of one or more interconnected data centers on which the second virtual cloud network is deployed, and the second domain includes the second IaaS system infrastructure.

3. The medium of claim 2, wherein the operation further comprises: The at least one new CA certificate is generated in connection with the deployment of the first region and / or the first virtual cloud network.

4. The medium of claim 3, wherein the at least one new CA certificate includes a root CA certificate for issuing entity certificates and / or intermediate CA certificates to network entities associated with the first virtual cloud network.

5. The medium of claim 1, wherein the operation further comprises: Transmit the CA dataset and its digital signature to at least one network entity.

6. The medium of claim 1, wherein detecting the at least one new CA certificate comprises: Identify the at least one CA certificate; as well as It was determined that the at least one CA certificate was not associated with a current digital signature from the key management service.

7. The medium of claim 1, wherein the CA dataset includes a certificate package, and wherein the certificate package includes a set of CA certificates, the set of CA certificates including the at least one new CA certificate.

8. The medium of claim 1, wherein transmitting the CA dataset to the key management service comprises: Transmit a request to the key management service to digitally sign the CA dataset for the key management service.

9. The medium of claim 8, wherein transmitting the CA dataset to the key management service comprises: Transmit credentials to the key management service to authenticate the request for digital signature of the CA dataset against the key management service.

10. One or more non-transitory computer-readable media, comprising instructions that, when executed by one or more hardware processors, cause to perform operations including: Receive requests from network entities for at least one new Certificate Authority (CA) certificate at the distribution service associated with the first virtual cloud network; as well as In response to receiving a request, the network entity transmits (a) a CA dataset including the at least one new CA certificate, and (b) a digital signature of the CA dataset. The digital signatures for the CA dataset were generated using a global private key by a key management service hosted on a second virtual cloud network; The global private key is stored in a private key store associated with the key management service on the second virtual cloud network, and The CA dataset can be verified using a first global public key corresponding to the global private key, which is stored in a public key store associated with the network entity.

11. The medium of claim 10, wherein the operation further comprises: Before transmitting the CA dataset and its digital signature to network entities, the CA dataset is verified using a second global public key corresponding to the global private key, wherein the second global public key is stored in a second public key store associated with the distribution service.

12. The medium of claim 11, wherein verifying the CA dataset comprises: The first hash value is generated by applying a hash function to the CA dataset; A second hash value is generated by decrypting the digital signature of the CA dataset using a second global public key. Compare the first hash value with the second hash value; as well as Determine if the first hash value matches the second hash value.

13. The medium of claim 10, wherein the operation further comprises: In response to a received request, locate the CA dataset and digital signature in the certificate store.

14. The medium as described in claim 10, The request for the at least one new CA certificate is associated with the initial provisioning of a cloud resource instance on the first virtual cloud network; or The request for the at least one new CA certificate is one of a series of periodic requests for the updated certificate package.

15. The medium of claim 10, wherein the CA dataset includes a certificate package, and wherein the certificate package includes a set of CA certificates, the set of CA certificates including the at least one new CA certificate.

16. The medium of claim 10, wherein the operation further comprises: In response to receiving the request: Determine the first timestamp corresponding to the digital signature in the CA dataset; Determine a second timestamp corresponding to a previous transmission to a network entity, the previous transmission including a previous CA dataset containing one or more previous CA certificates; It is determined that the second timestamp is earlier than the first timestamp; as well as In response to determining that the second timestamp is earlier than the first timestamp, the CA dataset and its digital signature are transmitted to the network entity.

17. The medium as described in claim 10, The first virtual cloud network is located within a first area of ​​a first domain, the first area comprising a first set of one or more interconnected data centers on which the first virtual cloud network is deployed, and the first domain comprising a first Infrastructure as a Service (IaaS) system infrastructure; and The second virtual cloud network is located within a second area of ​​the second domain, the second area includes a second set of one or more interconnected data centers on which the second virtual cloud network is deployed, and the second domain includes the second IaaS system infrastructure.

18. The medium of claim 10, wherein the operation further comprises: Before receiving requests from network entities: Detect at least one new CA certificate in the certificate store on the first virtual cloud network; Transfer the CA dataset to the key management service; Receive digital signatures for CA datasets from the key management service; Digital signatures are stored in a certificate store, which includes data structures that associate digital signatures with CA datasets.

19. One or more non-transitory computer-readable media, including instructions that, when executed by one or more hardware processors, cause to perform operations including: Transmit a request for at least one Certificate Authority (CA) certificate for use by network entities to the distribution service associated with the first virtual cloud network; Receive from the distribution service (a) a CA dataset including at least one CA certificate, and (b) a digital signature of the CA dataset. The digital signatures for the CA dataset were generated using a global private key by a key management service hosted on a second virtual cloud network, and The global private key is stored in a private key repository associated with the key management service on the second virtual cloud network, and The CA dataset is verified using a global public key corresponding to the global private key, wherein the global public key is stored in a public key store on the first virtual cloud network; The at least one CA certificate is installed in the storage medium associated with the network entity.

20. The medium as described in claim 19, Installing at least one CA certificate in a storage medium represents an operation for provisioning processing of network entities.

21. The medium of claim 20, wherein the operation further comprises: Detect certificate package retrieval triggers during supply processing; as well as A request for the at least one CA certificate is transmitted in response to the detection of a certificate package retrieval trigger.

22. The medium of claim 21, wherein the operation further comprises: Additional operations for provisioning are performed after the installation of the at least one CA certificate.

23. The medium of claim 19, wherein the global public key is embedded in the operating system image of the network entity.

24. The medium of claim 19, wherein the key management service is a third-party service.

25. The medium as described in claim 19, The first virtual cloud network is located within a first area of ​​a first domain, the first area comprising a first set of one or more interconnected data centers on which the first virtual cloud network is deployed, and the first domain comprising a first Infrastructure as a Service (IaaS) system infrastructure; and The second virtual cloud network is located within a second area of ​​the second domain, the second area includes a second set of one or more interconnected data centers on which the second virtual cloud network is deployed, and the second domain includes the second IaaS system infrastructure.

26. One or more non-transitory computer-readable media, including instructions that, when executed by one or more hardware processors, cause to perform operations including: A network entity transmits a request for at least one Certificate Authority (CA) certificate to a distribution service, wherein the network entity and the distribution service are associated with a first virtual cloud network; Receive requests at the distribution service; In response to receiving a request, the distribution service transmits (a) a CA dataset including the at least one CA certificate and (b) a digital signature of the CA dataset to the network entity. The digital signatures for the CA dataset were generated using a global private key by a key management service hosted on a second virtual cloud network; Receive a CA dataset including the at least one CA certificate and a digital signature of the CA dataset at the network entity; Verify the CA dataset using the global public key corresponding to the global private key; Install the at least one CA certificate in the storage medium associated with the network entity; The global private key is stored in a private key store associated with the key management service on the second virtual cloud network, and The global public key is stored in a public key repository associated with the network entity on the first virtual cloud network.

27. The medium of claim 26, wherein the operation further comprises: In response to receiving the request, The verification of the CA dataset is performed using a second global public key corresponding to the global private key, wherein the second global public key is stored in a second public key store associated with the distribution service on the first virtual cloud network; Based on the verification, the CA dataset is determined to be valid. as well as After confirming the validity of the CA dataset, the CA dataset and its digital signature are transmitted to the network entity.

28. The medium of claim 26, wherein the operation further comprises: Detect certificate packet retrieval triggers during the provisioning process for network entities; as well as A request for the at least one CA certificate is transmitted in response to the detection of a certificate package retrieval trigger.

29. A computer program product comprising instructions that, when executed by one or more hardware processors, cause to perform the operations described in any one of claims 1-28.

30. A method comprising the operations described in any one of claims 1-28.

31. A system comprising at least one device, said at least one device including a hardware processor and configured to perform the operations described in any one of claims 1-28.

32. A system comprising components for performing the operations as described in any one of claims 1-28.

Images