Authenticating a certificate bundle using an asymmetric key.

Abstract

The operation of the digital signature manager may include: discovering one or more new sets of Certificate Authority (CA) certificates in a certificate repository on a first virtual cloud network; transmitting a CA dataset containing one or more new sets of CA certificates to a key management service hosted on a second virtual cloud network; receiving from the key management service a digital signature of the CA dataset generated from at least a global private key stored on the second virtual cloud network in a private key repository associated with the key management service; and storing the digital signature in the certificate repository in a data structure that associates the digital signature with the CA dataset.

Description

Technical Field

[0001] Technical Field The present disclosure relates to an asymmetric encryption method. More specifically, the present disclosure relates to the use of asymmetric keys for digitally signing a certificate bundle including a certificate authority certificate and for verifying the same.

Background Art

[0002] Background A virtual cloud network includes network entities that communicate with each other. Communication between network entities can be carried out according to a security protocol, whereby the network entities authenticate each other by presenting digital certificates. When a network entity presents a valid digital certificate to another network entity, the other network entity can believe that it is communicating with that network entity, unlike some unknown entity, based on the trust relationship with the CA that issued the digital certificate.

[0003] Digital certificates can be issued to network entities by a CA. A digital certificate may include a digital signature generated using the private key of the CA that issued the digital certificate. The digital signature can be verified using the CA certificate of the CA that includes the public key corresponding to the private key. Various CA certificates that can be used to verify digital certificates issued to various network entities can be included in a certificate bundle. The certificate bundle can be distributed to network entities across the virtual cloud network. For example, the certificate bundle can be installed when initializing the virtual cloud network and / or when initializing various network entities on the virtual cloud network. Additionally, the certificate bundle can sometimes be updated or replaced, for example, to make a new CA certificate available to a network entity and / or to remove an old CA certificate.

[0004] The content of this background chapter should not be considered prior art simply because it exists within that chapter.

[0005] Embodiments are illustrated in the accompanying drawings as examples, not as limitations. It should be noted that references to “a certain” or “one” embodiment in this disclosure do not necessarily refer to the same embodiment, but rather mean at least one. [Brief explanation of the drawing]

[0006] [Figure 1] This block diagram illustrates patterns for implementing a cloud infrastructure-as-a-service system in one or more embodiments. [Figure 2] This block diagram illustrates patterns for implementing a cloud infrastructure-as-a-service system in one or more embodiments. [Figure 3] This block diagram illustrates patterns for implementing a cloud infrastructure-as-a-service system in one or more embodiments. [Figure 4] This block diagram illustrates patterns for implementing a cloud infrastructure-as-a-service system in one or more embodiments. [Figure 5] This figure shows a hardware system according to one or more embodiments. [Figure 6A] This is a diagram illustrating the features of an example system according to one or more embodiments. [Figure 6B] This is a diagram illustrating the features of an example system according to one or more embodiments. [Figure 7] This flowchart illustrates an example certificate bundle delivery process for delivering a set of CA certificates to a network entity associated with a virtual cloud network, according to one or more embodiments. [Figure 8A] This flowchart illustrates exemplary behavior regarding the verification of a certificate bundle using an asymmetric key, according to one or more embodiments. [Figure 8B] This flowchart illustrates exemplary behavior regarding the verification of a certificate bundle using an asymmetric key, according to one or more embodiments. [Figure 8C] This flowchart illustrates exemplary behavior regarding the verification of a certificate bundle using an asymmetric key, according to one or more embodiments. [Figure 9] This flowchart illustrates exemplary operations relating to provisioning cloud resource instances associated with a virtual cloud network, according to one or more embodiments. [Figure 10] This flowchart illustrates further example behaviors relating to provisioning cloud resource instances associated with a virtual cloud network, according to one or more embodiments. [Modes for carrying out the invention]

[0007] Detailed explanation In the following description, for illustrative purposes, numerous specific details are explicitly stated to provide a thorough understanding. One or more embodiments may be practiced without these specific details. Features described in one embodiment may be combined with features described in different embodiments. In some examples, well-known structures and devices are described with reference to block diagrams to avoid unnecessarily obscuring the invention.

[0008] 1.General overview 2. Cloud Computing Technology 3. Computer System 4. Architecture Overview 5. Authenticating network entities 6. Example Certificate Bundle Delivery Process 7. Verify the Certificate Authority dataset. 8. Provisioning cloud resource instances 9. Obtain and install the certificate bundle. 10. Miscellaneous notes, expansion 1.General overview One or more embodiments verify a Certificate Authority (CA) dataset associated with a virtual cloud network (VCN) using a global public key corresponding to a global private key used by a key management service hosted on a separate VCN to digitally sign the CA dataset. The CA dataset may contain one or more sets of CA certificates. When a new CA dataset is added to a certificate repository on an auxiliary VCN, a digital signature manager on the auxiliary VCN transmits the CA dataset to a key management service hosted on the home VCN. The key management service digitally signs the CA dataset using the global private key and transmits the digital signature of the CA dataset to a digital signature manager. The digital signature manager stores the digital signature in the certificate repository in a data structure that associates the digital signature with the CA dataset. The CA dataset may then be delivered to a network entity on the auxiliary VCN, such as a cloud resource instance, which may verify the CA dataset using the global public key corresponding to the global private key before installing one or more CA certificates within the CA dataset.

[0009] In one example, a CA dataset may be delivered to a network entity in connection with the initial provisioning of a VCN and / or in connection with the initial provisioning of one or more network entities associated with the VCN. Advantageously, the digital signature of the CA dataset using a global private key can serve as a source of trust for one or more CA certificates within the CA dataset. In one example, the digital signature of the CA dataset can provide an alternative to the "Trust On First Use" anti-security model. For example, a key management service on a home VCN may generally be considered a trusted network entity, and verification of the CA dataset using a global public key provides assurance that a CA dataset with one or more CA certificates installed is identical to a CA dataset digitally signed by the key management service using a global private key.

[0010] One or more embodiments described herein and / or enumerated in the claims may not be included in this General Summary chapter.

[0011] 2. Cloud Computing Technology Infrastructure as a Service (IaaS) is an application of cloud computing technology. IaaS can be configured to provide virtualized computing resources over a public network (e.g., the internet). In the IaaS model, the cloud computing provider may host infrastructure components (e.g., servers, storage devices, network nodes (e.g., hardware), deployment software, platform virtualization (e.g., hypervisor layer), or similar). In some cases, the IaaS provider may also supply various services associated with those infrastructure components (examples of such services include billing software, monitoring software, logging software, load balancing software, and clustering software). Therefore, since these services can be policy-driven, IaaS users may enforce policies to drive load balancing and maintain application availability and performance.

[0012] In some cases, IaaS customers may access resources and services over a wide area network (WAN), such as the internet, and install the rest of their application stack using the cloud provider's services. For example, a user may log into an IaaS platform, create virtual machines (VMs), install an operating system (OS) on each VM, deploy middleware such as databases, create storage buckets for workloads and backups, and even install enterprise software within those VMs. The customer can then use the provider's services to perform various functions, including balancing network traffic, troubleshooting application issues, monitoring performance, and managing disaster recovery.

[0013] In some cases, the cloud computing model involves the participation of a cloud provider. A cloud provider can be a third-party service specialized in providing (e.g., offering, lending, selling) IaaS, but it doesn't have to be such a third-party service. An entity may choose to deploy a private cloud and the entity itself may become the provider of infrastructure services.

[0014] In some examples, an IaaS deployment is a process of implementing a new application or a new version of an application onto a prepared application server or other similar device. An IaaS deployment may also include the process of preparing the server (e.g., installing libraries, daemons, etc.). The deployment process is often managed by a cloud provider under the hypervisor layer (e.g., servers, storage, network hardware, and virtualization). Thus, a customer may play the role of handling the (OS), middleware, and / or application deployment (e.g., self-service virtual machines (e.g., which can be spun up on demand) or the like).

[0015] In some examples, IaaS provisioning refers to obtaining a computer or virtual host for use and further installing the required libraries or services on them. In most cases, deployment does not include provisioning, and provisioning may need to be done first.

[0016] In some cases, there are challenges with IaaS provisioning. There are initial challenges in provisioning an initial set of infrastructure. After the initial provisioning is complete, there are additional challenges in evolving the existing infrastructure (e.g., adding new services, changing services, removing services, etc.). In some cases, these challenges can be addressed by enabling the infrastructure configuration to be declaratively specified. In other words, the infrastructure (e.g., which components are required and how they interact) can be specified by one or more configuration files. Thus, the overall topology of the infrastructure (e.g., which resources depend on which and how they each collaborate) can be declaratively described. In some cases, once the topology is specified, a workflow can be generated to create and / or manage the different components described in the configuration file.

[0017] In some examples, the infrastructure can have many interconnected elements. For example, there can be one or more virtual private clouds (VPCs), also known as a core network (e.g., perhaps a pool of configurable and / or shared computing resources on demand). In some examples, there can also be rules for how the inbound and / or outbound traffic of the network is set up, as well as one or more inbound / outbound traffic group rules that are provisioned to define one or more virtual machines (VMs). Other infrastructure elements, such as load balancers, databases, or the like, can also be provisioned. The more infrastructure elements that are desired and / or added, the more the infrastructure can evolve incrementally.

[0018] In some cases, sequential deployment techniques may be employed to enable the deployment of infrastructure code across various virtual computing environments. Additionally, the techniques described may enable infrastructure management within these environments. In some examples, a service team may write code that is to be deployed to one or more, but often many, different production environments (e.g., across various different geographical locations, sometimes even globally). In some embodiments, infrastructure and resources may be provisioned (manually and / or using provisioning tools) before the deployment of the code that will run on the infrastructure. However, in some examples, the infrastructure on which the code will be deployed must first be set up. In some cases, provisioning may be done manually, provisioning tools may be used to provision resources, and / or, once the infrastructure is provisioned, deployment tools may be used to deploy the code.

[0019] Figure 1 is a block diagram illustrating a pattern example of an IaaS architecture 100 according to at least one embodiment. A service operator 102 may be communicably coupled to a secure host tenancy 104 which may include a virtual cloud network (VCN) 106 and a secure host subnet 108. In some examples, the service operator 102 may use one or more client computing devices, which may be portable handheld devices (e.g., iPhone®, mobile phones, iPad®, computing tablets, personal digital assistants (PDAs)) or wearable devices (e.g., Google Glass® head-mounted displays), running software such as Microsoft Windows Mobile® and / or various mobile operating systems such as iOS®, Windows Phone, Android, BlackBerry 8, Palm OS, and similar, and with the Internet, email, short message service (SMS), Blackberry®, or other communication protocols enabled. Alternatively, a client computing device could be a general-purpose personal computer, including, for example, personal computers and / or laptop computers running various versions of Microsoft Windows®, Apple Macintosh®, and / or Linux® operating systems. A client computing device could also be a workstation computer running any of various commercially available UNIX® or UNIX-like operating systems, including, for example, various GNU / Linux® operating systems such as Google Chrome® OS.Alternatively, or in addition, the client computing device may be any other electronic device, such as a thin client computer, an internet-enabled gaming system (e.g., a Microsoft Xbox game console with or without a Kinect® gesture input device), and / or a personal messaging device, that can communicate through a network that can access the VCN106 and / or the Internet.

[0020] VCN106 may include a local peering gateway (LPG) 110 which can be communicatively coupled to Secure Shell (SSH) VCN112 via LPG110 included in SSH VCN112. SSH VCN112 may include an SSH subnet 114, and SSH VCN112 may be communicatively coupled to control plane VCN116 via LPG110 included in control plane VCN116. Furthermore, SSH VCN112 may be communicatively coupled to data plane VCN118 via LPG110. Control plane VCN116 and data plane VCN118 may be included in a service tenancy 119 which may be owned and / or operated by an IaaS provider.

[0021] The control plane VCN 116 may include a control plane demilitarized zone (DMZ) layer 120 that acts as a peripheral network (e.g., a portion of the corporate network between the corporate intranet and the external network). DMZ-based servers have limited responsibilities and may help deter breaches. Additionally, the DMZ layer 120 may include a control plane application layer 124 that may include one or more load balancer (LB) subnets 122, an application subnet 126, and a control plane data layer 128 that may include a database (DB) subnet 130 (e.g., a front-end DB subnet and / or a back-end DB subnet). The LB subnet 122 included in the control plane DMZ layer 120 may be communicably coupled to the application subnet 126 included in the control plane application layer 124 and the internet gateway 134 included in the control plane VCN 116, and the application subnet 126 may be communicably coupled to the DB subnet 130 included in the control plane data layer 128, a service gateway 136, and a network address translation (NAT) gateway 138. The control plane VCN116 may include a service gateway 136 and a NAT gateway 138.

[0022] The control plane VCN 116 may include a data plane mirror application tier 140 which may include an application subnet 126. The application subnet 126 included in the data plane mirror application tier 140 may include a virtual network interface controller (VNIC) 142 which may run a compute instance 144. The compute instance 144 may communicatively connect the application subnet 126 of the data plane mirror application tier 140 to the application subnet 126 which may be included in the data plane application tier 146.

[0023] The data plane VCN 118 may include a data plane application tier 146, a data plane DMZ tier 148, and a data plane data tier 150. The data plane DMZ tier 148 may include an LB subnet 122 that can be communicatively coupled to the application subnet 126 of the data plane application tier 146 and the internet gateway 134 of the data plane VCN 118. The application subnet 126 may be communicatively coupled to the service gateway 136 of the data plane VCN 118 and the NAT gateway 138 of the data plane VCN 118. The data plane data tier 150 may also include a DB subnet 130 that can be communicatively coupled to the application subnet 126 of the data plane application tier 146.

[0024] The Internet gateway 134 of the control plane VCN116 and the Internet gateway 134 of the data plane VCN118 can be communicatively coupled to a metadata management service 152 which can be communicatively coupled to the public internet 154. The public internet 154 can be communicatively coupled to the NAT gateway 138 of the control plane VCN116 and the NAT gateway 138 of the data plane VCN118. The service gateway 136 of the control plane VCN116 and the service gateway 136 of the data plane VCN118 can be communicatively coupled to a cloud service 156.

[0025] In some examples, the service gateway 136 of the control plane VCN116 and the service gateway 136 of the data plane VCN118 can make application programming interface (API) calls to the cloud service 156 without going through the public internet 154. API calls from the service gateway 136 to the cloud service 156 can be unidirectional. The service gateway 136 can make an API call to the cloud service 156, and the cloud service 156 can send the requested data to the service gateway 136. However, the cloud service 156 does not have to initiate an API call to the service gateway 136.

[0026] In some examples, the secure host tenancy 104 may be directly connected to the service tenancy 119, otherwise the service tenancy 119 may be isolated. The secure host subnet 108 may communicate with the SSH subnet 114 through the LPG 110, which may enable bidirectional communication through otherwise isolated systems. Connecting the secure host subnet 108 to the SSH subnet 114 may give the secure host subnet 108 access to other entities within the service tenancy 119.

[0027] The control plane VCN116 may allow users of service tenancy 119 to set up or otherwise provision desired resources. Desired resources provisioned in the control plane VCN116 may be deployed within the data plane VCN118 or used separately. In some examples, the control plane VCN116 may be isolated from the data plane VCN118, and the data plane mirror application layer 140 of the control plane VCN116 may communicate with the data plane application layer 146 of the data plane VCN118 via a VNIC 142 which may be included in the data plane mirror application layer 140 and the data plane application layer 146.

[0028] In some examples, a system user or customer may perform requests, such as create, read, update, or delete (CRUD) operations, through the public internet 154, which can communicate requests to the metadata management service 152. The metadata management service 152 may communicate requests to the control plane VCN 116 through the internet gateway 134. Requests may be received by an LB subnet 122 included in the control plane DMZ layer 120. The LB subnet 122 may determine that the request is valid, and in response to this determination, the LB subnet 122 may transmit the request to an application subnet 126 included in the control plane application layer 124. If the request is confirmed and requires a call to the public internet 154, the call to the public internet 154 may be transmitted to a NAT gateway 138, which can make calls to the public internet 154. Metadata that may be desired to be stored by the request may be stored in the DB subnet 130.

[0029] In some examples, the data plane mirror application layer 140 may facilitate direct communication between the control plane VCN 116 and the data plane VCN 118. For example, it may be desirable that changes, updates, or other preferred modifications to the configuration be applied to the resources contained in the data plane VCN 118. Through VNIC 142, the control plane VCN 116 can communicate directly with the resources contained in the data plane VCN 118, thereby enabling it to perform changes, updates, or other preferred modifications to the configuration.

[0030] In some embodiments, the control plane VCN116 and data plane VCN118 may be included in the service tenancy 119. In this case, the system user or customer may not own or operate either the control plane VCN116 or the data plane VCN118. Instead, the IaaS provider may own or operate the control plane VCN116 and the data plane VCN118, and both may be included in the service tenancy 119. This embodiment may enable network isolation that can prevent a user or customer from interacting with the resources of other users or other customers. This embodiment may also enable the system user or customer to store databases privately without having to rely on the public internet 154, which may not have the desired level of threat protection for storage.

[0031] In another embodiment, the LB subnet 122 included in the control plane VCN 116 may be configured to receive signals from the service gateway 136. In this embodiment, the control plane VCN 116 and the data plane VCN 118 may be configured to be invoked by the IaaS provider's customer without calling the public internet 154. The IaaS provider's customer may prefer this embodiment because the database used by the customer may be controlled by the IaaS provider and stored in a service tenancy 119 that can be isolated from the public internet 154.

[0032] Figure 2 is a block diagram illustrating another pattern example of the IaaS architecture 200 according to at least one embodiment. A service operator 202 (e.g., service operator 102 in Figure 1) may be communicatively coupled to a secure host tenancy 204 (e.g., secure host tenancy 104 in Figure 1), which may include a virtual cloud network (VCN) 206 (e.g., VCN106 in Figure 1) and a secure host subnet 208 (e.g., secure host subnet 108 in Figure 1). VCN206 may include a local peering gateway (LPG) 210 (e.g., LPG110 in Figure 1), which may be communicatively coupled to a secure shell (SSH) VCN212 (e.g., SSH VCN112 in Figure 1) via an LPG110 contained in an SSH VCN212. SSH VCN212 may include SSH subnet 214 (e.g., SSH subnet 114 in Figure 1), and SSH VCN212 may be communicably coupled to control plane VCN216 (e.g., control plane VCN116 in Figure 1) via LPG210 included in control plane VCN216. Control plane VCN216 may be included in service tenancy 219 (e.g., service tenancy 119 in Figure 1), and data plane VCN218 (e.g., data plane VCN118 in Figure 1) may be included in customer tenancy 221, which may be owned or operated by a user or customer of the system.

[0033] The control plane VCN216 may include a control plane DMZ tier 220 (e.g., control plane DMZ tier 120 in Figure 1) which may include an LB subnet 222 (e.g., LB subnet 122 in Figure 1), a control plane application tier 224 (e.g., control plane application tier 124 in Figure 1) which may include an application subnet 226 (e.g., application subnet 126 in Figure 1), and a control plane data tier 228 (e.g., control plane data tier 128 in Figure 1) which may include a database (DB) subnet 230 (e.g., similar to DB subnet 130 in Figure 1). The LB subnet 222 included in the control plane DMZ tier 220 may be communicatively coupled to the application subnet 226 included in the control plane application tier 224, and to an internet gateway 234 (e.g., internet gateway 134 in Figure 1) which may be included in the control plane VCN 216. The application subnet 226 may be communicatively coupled to the DB subnet 230 included in the control plane data tier 228, and to a service gateway 236 (e.g., service gateway 136 in Figure 1), and to a network address translation (NAT) gateway 238 (e.g., NAT gateway 138 in Figure 1). The control plane VCN 216 may include the service gateway 236 and the NAT gateway 238.

[0034] The control plane VCN216 may include a data plane mirror application tier 240 (e.g., data plane mirror application tier 140 in Figure 1) which may include an application subnet 226. The application subnet 226 included in the data plane mirror application tier 240 may include a virtual network interface controller (VNIC) 242 (e.g., VNIC 142) which may run a compute instance 244 (e.g., similar to compute instance 144 in Figure 1). The compute instance 244 may facilitate communication between the application subnet 226 of the data plane mirror application tier 240 and the application subnet 226 included in the data plane application tier 246 (e.g., data plane application tier 146 in Figure 1) via the VNIC 242 included in the data plane mirror application tier 240 and the VNIC 242 included in the data plane application tier 246.

[0035] The Internet gateway 234 included in the control plane VCN216 may be communicably coupled to a metadata management service 252 (e.g., metadata management service 152 in Figure 1), which may be communicably coupled to the public internet 254 (e.g., public internet 154 in Figure 1). The public internet 254 may be communicably coupled to a NAT gateway 238 included in the control plane VCN216. The service gateway 236 included in the control plane VCN216 may be communicably coupled to a cloud service 256 (e.g., cloud service 156 in Figure 1).

[0036] In some examples, the data plane VCN218 may be included in a customer tenancy 221. In this case, the IaaS provider may provide a control plane VCN216 for each customer, and the IaaS provider may set up a unique compute instance 244 included in a service tenancy 219 for each customer. Each compute instance 244 may enable communication between the control plane VCN216 included in the service tenancy 219 and the data plane VCN218 included in the customer tenancy 221. The compute instance 244 may enable resources provisioned within the control plane VCN216 included in the service tenancy 219 to be deployed within the data plane VCN218 included in the customer tenancy 221, or to be used separately.

[0037] In another example, an IaaS provider's customer may have a database residing within customer tenancy 221. In this example, the control plane VCN 216 may include a data plane mirror app tier 240, which may include an app subnet 226. The data plane mirror app tier 240 may reside within data plane VCN 218, but does not have to. That is, the data plane mirror app tier 240 may have access to customer tenancy 221, but does not have to reside within data plane VCN 218, or may be owned or operated by the IaaS provider's customer. The data plane mirror app tier 240 may be configured to make calls to data plane VCN 218, but does not have to be configured to make calls to any entity contained within control plane VCN 216. Customers may wish to deploy resources in the data plane VCN218, which is provisioned within the control plane VCN216, or to use them separately, and the data plane mirror application tier 240 can facilitate the customer's desired deployment or other use of resources.

[0038] In some embodiments, a customer of the IaaS provider may apply filters to the data plane VCN218. In this embodiment, the customer may determine what the data plane VCN218 can access, and may restrict access from the data plane VCN218 to the public internet 254. The IaaS provider may not be able to apply filters to the data plane VCN218 or separately control its access to any external network or database. Applying filters and customer control over the data plane VCN218 included in the customer tenancy 221 may help isolate the data plane VCN218 from other customers and from the public internet 254.

[0039] In some embodiments, a cloud service 256 may be invoked by a service gateway 236 to access services that may not reside on the public internet 254, on the control plane VCN 216, or on the data plane VCN 218. The connection between the cloud service 256 and the control plane VCN 216 or data plane VCN 218 may not be live or continuous. The cloud service 256 may reside on different networks owned or operated by the IaaS provider. The cloud service 256 may be configured to receive calls from the service gateway 236 and not to receive calls from the public internet 254. Some cloud services 256 may be isolated from other cloud services 256, and the control plane VCN 216 may be isolated from cloud services 256 that may not be in the same region as the control plane VCN 216. For example, the control plane VCN 216 may be located in "Region 1", and the cloud service "Deployment 1" may be located in Region 1 and "Region 2". If a call to Deployment 1 is made by a service gateway 236 included in the control plane VCN216 located in Region 1, the call can be transmitted to Deployment 1 in Region 1. In this example, the control plane VCN216, or Deployment 1 in Region 1, does not need to be communicatively coupled to Deployment 1 in Region 2, nor does it need to be in separate communication with it.

[0040] Figure 3 is a block diagram illustrating another pattern example of the IaaS architecture 300 according to at least one embodiment. A service operator 302 (e.g., service operator 102 in Figure 1) may be communicably coupled to a secure host tenancy 304 (e.g., secure host tenancy 104 in Figure 1), which may include a virtual cloud network (VCN) 306 (e.g., VCN106 in Figure 1) and a secure host subnet 308 (e.g., secure host subnet 108 in Figure 1). VCN 306 may include an LPG 310 (e.g., LPG110 in Figure 1), which may be communicably coupled to an SSH VCN 312 (e.g., SSH VCN112 in Figure 1) via an LPG 310 contained in the SSH VCN 312. SSH VCN312 may include SSH subnet 314 (e.g., SSH subnet 114 in Figure 1), and SSH VCN312 may be communicably coupled to control plane VCN316 (e.g., control plane VCN116 in Figure 1) via LPG310 included in control plane VCN316, and to data plane VCN318 (e.g., data plane VCN118 in Figure 1) via LPG310 included in data plane VCN318. Control plane VCN316 and data plane VCN318 may be included in service tenancy 319 (e.g., service tenancy 119 in Figure 1).

[0041] The control plane VCN316 may include a control plane DMZ tier 320 (e.g., control plane DMZ tier 120 in Figure 1) which may include a load balancer (LB) subnet 322 (e.g., LB subnet 122 in Figure 1), a control plane application tier 324 (e.g., control plane application tier 124 in Figure 1) which may include an application subnet 326 (e.g., similar to application subnet 126 in Figure 1), and a control plane data tier 328 (e.g., control plane data tier 128 in Figure 1) which may include a DB subnet 330. An LB subnet 322, which may be included in the control plane DMZ tier 320, may be communicatively coupled to an application subnet 326, which may be included in the control plane application tier 324, and an internet gateway 334 (e.g., internet gateway 134 in Figure 1), which may be included in the control plane VCN 316. The application subnet 326 may be communicatively coupled to a DB subnet 330, which may be included in the control plane data tier 328, and a service gateway 336 (e.g., the service gateway in Figure 1), and a network address translation (NAT) gateway 338 (e.g., NAT gateway 138 in Figure 1). The control plane VCN 316 may include the service gateway 336 and the NAT gateway 338.

[0042] The data plane VCN318 may include a data plane application tier 346 (e.g., data plane application tier 146 in Figure 1), a data plane DMZ tier 348 (e.g., data plane DMZ tier 148 in Figure 1), and a data plane data tier 350 (e.g., data plane data tier 150 in Figure 1). The data plane DMZ tier 348 may include a trusted application subnet 360 and an untrusted application subnet 362 of the data plane application tier 346, as well as an LB subnet 322 that can be communicatively coupled to an internet gateway 334 included in the data plane VCN318. The trusted application subnet 360 may be communicatively coupled to a service gateway 336 included in the data plane VCN318, a NAT gateway 338 included in the data plane VCN318, and a DB subnet 330 included in the data plane data tier 350. The untrusted application subnet 362 may be communicatively coupled to a service gateway 336 included in the data plane VCN318 and a DB subnet 330 included in the data plane data tier 350. The data plane data tier 350 may include a DB subnet 330 that can be communicatively coupled to a service gateway 336 included in the data plane VCN 318.

[0043] An untrusted application subnet 362 may include one or more primary VNICs 364(1)-(N) that can be communicatively coupled to tenant virtual machines (VMs) 366(1)-(N). Each tenant VM 366(1)-(N) may be communicatively coupled to each application subnet 367(1)-(N) that may be included in each container egress VCN 368(1)-(N) that may be included in each customer tenancy 380(1)-(N). Each secondary VNIC 372(1)-(N) may facilitate communication between the untrusted application subnet 362 included in the data plane VCN 318 and the application subnets included in the container egress VCN 368(1)-(N). Each container egress VCN 368(1)-(N) may include a NAT gateway 338 that can be communicatively coupled to the public internet 354 (e.g., public internet 154 in Figure 1).

[0044] The Internet gateway 334 included in the control plane VCN316 and the Internet gateway 334 included in the data plane VCN318 can be communicatively coupled to a metadata management service 352 (e.g., metadata management service 152 in Figure 1), which can be communicatively coupled to the public internet 354. The public internet 354 can be communicatively coupled to the NAT gateway 338 included in the control plane VCN316 and the NAT gateway 338 included in the data plane VCN318. The service gateway 336 included in the control plane VCN316 and the service gateway 336 included in the data plane VCN318 can be communicatively coupled to a cloud service 356.

[0045] In some embodiments, the data plane VCN318 may be integrated with a customer tenancy 380. This integration may be useful or desirable for the IaaS provider's customer in some cases, such as when support is desired when executing code. The customer may provide code to be executed that may be destructive, communicate with other customer resources, or otherwise cause undesirable effects. In response, the IaaS provider may decide whether to execute the code provided to the IaaS provider by the customer.

[0046] In some examples, an IaaS provider's customer may grant temporary network access to the IaaS provider and request functionality to be added to the data plane application tier 346. The code to perform the functionality may run within VM366(1)-(N), and the code may be configured to run elsewhere on the data plane VCN318. Each VM366(1)-(N) may be connected to one customer tenancy 380. Each container 381(1)-(N) contained within VM366(1)-(N) may be configured to run the code. In this case, there may be a double isolation that can help prevent incorrect or otherwise undesirable code from damaging the IaaS provider's network or the network of a different customer (for example, container 381(1)-(N) may run the code, and container 381(1)-(N) may be contained in at least one VM366(1)-(N) that is in an untrusted application subnet 362). Containers 381(1)-(N) may be communicatively coupled to customer tenancy 380 and configured to send and receive data from customer tenancy 380. Containers 381(1)-(N) do not need to be configured to send and receive data from any other entities in the data plane VCN318. Upon completion of code execution, the IaaS provider may kill or otherwise discard containers 381(1)-(N).

[0047] In some embodiments, a trusted application subnet 360 may execute code owned or operated by the IaaS provider. In this embodiment, the trusted application subnet 360 may be communicatively coupled to a DB subnet 330 and may be configured to perform CRUD operations within the DB subnet 330. An untrusted application subnet 362 may be communicatively coupled to the DB subnet 330, but in this embodiment, the untrusted application subnet may be configured to perform read operations within the DB subnet 330. Containers 381(1)-(N) that may be contained in each customer's VM366(1)-(N) and that may execute code from the customer do not have to be communicatively coupled to the DB subnet 330.

[0048] In other embodiments, the control plane VCN316 and the data plane VCN318 do not have to be directly communicatively coupled. In this embodiment, direct communication between the control plane VCN316 and the data plane VCN318 is not required. However, communication may occur indirectly through at least one method. The LPG310 may be established by an IaaS provider that can facilitate communication between the control plane VCN316 and the data plane VCN318. In another example, the control plane VCN316 or the data plane VCN318 may make a call to the cloud service 356 via the service gateway 336. For example, a call from the control plane VCN316 to the cloud service 356 may include a request for a service that can communicate with the data plane VCN318.

[0049] Figure 4 is a block diagram illustrating another pattern example of the IaaS architecture 400 according to at least one embodiment. A service operator 402 (e.g., service operator 102 in Figure 1) may be communicatively coupled to a secure host tenancy 404 (e.g., secure host tenancy 104 in Figure 1), which may include a virtual cloud network (VCN) 406 (e.g., VCN106 in Figure 1) and a secure host subnet 408 (e.g., secure host subnet 108 in Figure 1). VCN 406 may include an LPG 410 (e.g., LPG110 in Figure 1), which may be communicatively coupled to an SSH VCN 412 (e.g., SSH VCN112 in Figure 1) via an LPG 410 contained in the SSH VCN 412. SSH VCN412 may include SSH subnet 414 (e.g., SSH subnet 114 in Figure 1), and SSH VCN412 may be communicably coupled to control plane VCN416 (e.g., control plane VCN116 in Figure 1) via LPG410 included in control plane VCN416, and to data plane VCN418 (e.g., data plane VCN118 in Figure 1) via LPG410 included in data plane VCN418. Control plane VCN416 and data plane VCN418 may be included in service tenancy 419 (e.g., service tenancy 119 in Figure 1).

[0050] The control plane VCN416 may include a control plane DMZ tier 420 (e.g., control plane DMZ tier 120 in Figure 1) which may include an LB subnet 422 (e.g., LB subnet 122 in Figure 1), a control plane application tier 424 (e.g., control plane application tier 124 in Figure 1) which may include an application subnet 426 (e.g., application subnet 126 in Figure 1), and a control plane data tier 428 (e.g., control plane data tier 128 in Figure 1) which may include a DB subnet 430 (e.g., DB subnet 330 in Figure 3). An LB subnet 422, which may be included in the control plane DMZ tier 420, may be communicatively coupled to an application subnet 426, which may be included in the control plane application tier 424, and an internet gateway 434 (e.g., internet gateway 134 in Figure 1), which may be included in the control plane VCN 416. The application subnet 426 may be communicatively coupled to a DB subnet 430, which may be included in the control plane data tier 428, and a service gateway 436 (e.g., the service gateway in Figure 1), and a network address translation (NAT) gateway 438 (e.g., NAT gateway 138 in Figure 1). The control plane VCN 416 may include the service gateway 436 and the NAT gateway 438.

[0051] The data plane VCN 418 may include a data plane application tier 446 (e.g., data plane application tier 146 in Figure 1), a data plane DMZ tier 448 (e.g., data plane DMZ tier 148 in Figure 1), and a data plane data tier 450 (e.g., data plane data tier 150 in Figure 1). The data plane DMZ tier 448 may include a trusted application subnet 460 (e.g., trusted application subnet 360 in Figure 3) and an untrusted application subnet 462 (e.g., untrusted application subnet 362 in Figure 3) of the data plane application tier 446, as well as an LB subnet 422 which can be communicatively coupled to an internet gateway 434 included in the data plane VCN 418. The trusted application subnet 460 may be communicatively coupled to a service gateway 436 included in the data plane VCN 418, a NAT gateway 438 included in the data plane VCN 418, and a DB subnet 430 included in the data plane data tier 450. An untrusted application subnet 462 may be communicatively coupled to a service gateway 436 included in the data plane VCN 418 and a DB subnet 430 included in the data plane data tier 450. The data plane data tier 450 may include a DB subnet 430 that can be communicatively coupled to a service gateway 436 included in the data plane VCN 418.

[0052] An untrusted application subnet 462 may include primary VNICs 464(1)-(N) that can be communicatively coupled to tenant virtual machines (VMs) 466(1)-(N) residing within the untrusted application subnet 462. Each tenant VM 466(1)-(N) may execute code within its respective container 467(1)-(N) and be communicatively coupled to an application subnet 426 that may be included in a dataplane application tier 446 that may be included in a container egress VCN 468. Each secondary VNIC 472(1)-(N) may facilitate communication between the untrusted application subnet 462 included in the dataplane VCN 418 and the application subnet included in the container egress VCN 468. The container egress VCN may include a NAT gateway 438 that can be communicatively coupled to the public internet 454 (e.g., public internet 154 in Figure 1).

[0053] The Internet gateway 434 included in the control plane VCN416 and the Internet gateway 434 included in the data plane VCN418 can be communicatively coupled to a metadata management service 452 (e.g., metadata management service 152 in Figure 1), which can be communicatively coupled to the public internet 454. The public internet 454 can be communicatively coupled to the NAT gateway 438 included in the control plane VCN416 and the NAT gateway 438 included in the data plane VCN418. The service gateway 436 included in the control plane VCN416 and the service gateway 436 included in the data plane VCN418 can be communicatively coupled to a cloud service 456.

[0054] In some examples, the pattern illustrated by the architecture of block diagram 400 in Figure 4 may be considered an exception to the pattern illustrated by the architecture of block diagram 300 in Figure 3, and may be desirable for the IaaS provider's customers when the IaaS provider cannot communicate directly with the customers (e.g., in a disconnected region). Each container 467(1)-(N) contained within VM466(1)-(N) for each customer may be accessed by the customer in real time. Each container 467(1)-(N) may be configured to make calls to each secondary VNIC 472(1)-(N) contained within application subnet 426 of data plane application tier 446, which may be contained within container egress VCN468. The secondary VNIC 472(1)-(N) may carry calls to a NAT gateway 438, which may carry calls to the public internet 454. In this example, containers 467(1)-(N), which can be accessed by customers in real time, may be isolated from the control plane VCN416 and from other entities included in the data plane VCN418. Containers 467(1)-(N) may also be isolated from resources from other customers.

[0055] In another example, a customer may use containers 467(1)-(N) to invoke cloud service 456. In this example, the customer may execute code within containers 467(1)-(N) requesting a service from cloud service 456. Containers 467(1)-(N) may forward this request to secondary VNICs 472(1)-(N), which may forward the request to a NAT gateway, which may forward the request to the public internet 454. The public internet 454 may forward the request to LB subnet 422, which is included in control plane VCN 416, via internet gateway 434. In response to determining that the request is valid, the LB subnet may forward the request to application subnet 426, which may forward the request to cloud service 456 via service gateway 436.

[0056] It should be understood that the IaaS architectures 100, 200, 300, and 400 depicted in the figures may have other components besides those depicted. Furthermore, the embodiments shown in the figures are only some examples of cloud infrastructure systems that may incorporate embodiments of this disclosure. In some other embodiments, the IaaS system may have more or fewer components than shown in the figures, or may have two or more components combined, or may have components in different configurations or arrangements.

[0057] In one embodiment, the IaaS system described herein may include a set of applications, middleware, and database service offerings delivered to customers in a self-service, subscription-based, elastically scalable, reliable, highly available, and secure manner. An example of such an IaaS system is Oracle Cloud Infrastructure (OCI) provided by the assignee.

[0058] In one or more embodiments, a computer network provides connectivity between sets of nodes. Nodes may be local to each other or remote from each other. Nodes are connected by a set of links. Examples of links include coaxial cables, unshielded twisted cables, copper cables, optical fibers, and virtual links.

[0059] A subnet of nodes implements a computer network. Examples of such nodes include switches, routers, firewalls, and network address translation devices (NATs). Another subset of nodes uses a computer network. Such nodes (also called "hosts") may run client processes and / or server processes. A client process makes requests for computing services (such as running a specific application and / or storing a specific amount of data). A server process responds by performing the requested service and / or returning the corresponding data.

[0060] A computer network can be a physical network that includes physical nodes connected by physical links. A physical node is any digital device. A physical node can be a hardware device with a specific function, such as a hardware switch, hardware router, hardware firewall, and hardware NAT. Additionally or alternatively, a physical node can be a general-purpose machine configured to run various virtual machines and / or applications that perform their respective functions. A physical link is a physical medium that connects two or more physical nodes. Examples of links include coaxial cables, unshielded twisted cables, copper cables, and optical fibers.

[0061] A computer network can be an overlay network. An overlay network is a logical network implemented on top of another network (such as a physical network). Each node in the overlay network corresponds to each node in the underlying network. Therefore, each node in the overlay network is associated with both an overlay address (for addressing the overlay node) and an underlay address (for addressing the underlay node that implements the overlay node). Overlay nodes can be digital devices and / or software processes (such as virtual machines, application instances, or threads). Links connecting overlay nodes are implemented as tunnels through the underlying network. Overlay nodes at both ends of the tunnel treat the underlying multi-hop path between them as a single logical link. Tunneling is performed through encapsulation and decapsulation.

[0062] In embodiments, a client may be local to and / or remote from a computer network. A client may access the computer network through a private network or another computer network such as the Internet. A client may communicate requests to the computer network using a communication protocol such as Hypertext Transfer Protocol (HTTP). Requests are communicated through an interface such as a client interface (e.g., a web browser), a program interface, or an application programming interface (API).

[0063] In embodiments, a computer network provides connectivity between clients and network resources. Network resources include hardware and / or software configured to run server processes. Examples of network resources include processors, data storage, virtual machines, containers, and / or software applications. Network resources are shared among multiple clients. Clients request computing services from the computer network independently of each other. Network resources are dynamically allocated to requests and / or clients on demand. The network resources allocated to each request and / or client may be scaled up or down based, for example, (a) computing services requested by a particular client, (b) aggregated computing services requested by a particular tenant, and / or (c) the computer network's requested aggregated computing services. Such a computer network may be referred to as a “cloud network”.

[0064] In embodiments, a service provider provides a cloud network to one or more end users. Various service models, including but not limited to Software-as-a-Service (SaaS), Platform-as-a-Service (PaaS), and Infrastructure-as-a-Service (IaaS), can be implemented by the cloud network. In SaaS, the service provider provides end users with the ability to use the service provider's applications running on network resources. In PaaS, the service provider provides end users with the ability to deploy custom applications on network resources. Custom applications may be created using programming languages, libraries, services, and tools supported by the service provider. In IaaS, the service provider provides end users with the ability to provision processing, storage, networking, and other basic computing resources provided by the network resources. Any application, including an operating system, can be deployed on network resources.

[0065] In embodiments, various deployment models can be implemented by computer networks, including but not limited to private clouds, public clouds, and hybrid clouds. In a private cloud, network resources are provisioned for exclusive use by a specific group of one or more entities (the term “entity” as used herein means a company, organization, individual, or other entity). Network resources may be local to and / or remote from the location of the specific group of entities. In a public cloud, cloud resources are provisioned for multiple entities (also referred to as “tenants” or “customers”) that are independent of each other. The computer network and its network resources are accessed by clients corresponding to different tenants. Such a computer network may be referred to as a “multitenant computer network.” Several tenants may use the same particular network resources at different times and / or at the same time. Network resources may be local to and / or remote from the location of the tenants. In a hybrid cloud, the computer network comprises a private cloud and a public cloud. The interface between the private cloud and the public cloud enables data and application portability. Data stored in a private cloud and data stored in a public cloud can be exchanged through an interface. Applications implemented in a private cloud and applications implemented in a public cloud may have dependencies on each other. Calls from applications in a private cloud to applications in a public cloud (and vice versa) can be performed through an interface.

[0066] In embodiments, tenants in a multi-tenant computer network are independent of each other. For example, the business or operations of one tenant may be separate from the business or operations of another tenant. Different tenants may have different network requirements for the computer network. Examples of network requirements include processing speed, data storage volume, security requirements, performance requirements, throughput requirements, latency requirements, resilience requirements, Quality of Service (QoS) requirements, tenant isolation, and / or consistency. The same computer network may need to implement different network requirements demanded by different tenants.

[0067] In one or more embodiments, in a multi-tenant computer network, tenant isolation is implemented to ensure that applications and / or data of different tenants are not shared with one another. Various tenant isolation techniques can be used.

[0068] In this embodiment, each tenant is associated with a tenant ID. Each network resource in a multi-tenant computer network is tagged with the tenant ID. A tenant is granted access to a specific network resource only if that tenant and that specific network resource are associated with the same tenant ID.

[0069] In this embodiment, each tenant is associated with a tenant ID. Each application implemented by the computer network is tagged with the tenant ID. Additionally or alternatively, each data structure and / or dataset stored by the computer network is tagged with the tenant ID. A tenant is granted access to a particular application, data structure, and / or dataset only if that tenant and its particular application, data structure, and / or dataset are associated with the same tenant ID.

[0070] For example, each database implemented by a multi-tenant computer network may be tagged with a tenant ID. Only tenants associated with the corresponding tenant ID can access the data in a particular database. As another example, each entry in a database implemented by a multi-tenant computer network may be tagged with a tenant ID. Only tenants associated with the corresponding tenant ID can access the data in a particular entry. However, the database may be shared by multiple tenants.

[0071] In this embodiment, the subscription list indicates which tenants have permission to access which applications. For each application, a list of tenant IDs of tenants granted permission to access the application is stored. A tenant is permitted access to a particular application only if their tenant ID is included in the subscription list corresponding to that particular application.

[0072] In this embodiment, network resources corresponding to different tenants (such as digital devices, virtual machines, application instances, and threads) are separated into tenant-specific overlay networks managed by a multi-tenant computer network. For example, packets from any source device within a tenant overlay network can only be transmitted to other devices within the same tenant overlay network. Encapsulation tunnels are used to prevent any transmission from a source device on one tenant overlay network to devices in other tenant overlay networks. Specifically, packets received from a source device are encapsulated within an outer packet. The outer packet is transmitted from a first encapsulation tunnel endpoint (communicating with a source device within the tenant overlay network) to a second encapsulation tunnel endpoint (communicating with a destination device within the tenant overlay network). The second encapsulation tunnel endpoint decapsulates the outer packet to obtain the original packet transmitted by the source device. The original packet is then transmitted from the second encapsulation tunnel endpoint to a destination device within the same specific overlay network.

[0073] 3. Computer System Figure 5 illustrates an example computer system 500 in which various embodiments may be implemented. System 500 may be used to implement any of the computer systems described above. As shown in Figure 5, computer system 500 includes a processing unit 504 that communicates with several peripheral subsystems via a bus subsystem 502. These peripheral subsystems may include a processing accelerator 506, an I / O subsystem 508, a storage subsystem 518, and a communication subsystem 524. The storage subsystem 518 includes a tangible computer-readable storage medium 522 and system memory 510.

[0074] The bus subsystem 502 provides a mechanism for various components and subsystems of the computer system 500 to communicate with each other as intended. While the bus subsystem 502 is schematically shown as a single bus, alternative embodiments of the bus subsystem may utilize multiple buses. The bus subsystem 502 may be one of several types of bus structures, including a memory bus or memory controller, a peripheral bus, and a local bus using one of various bus architectures. For example, such architectures may include the Industry Standard Architecture (ISA) bus, the Microchannel Architecture (MCA) bus, the Enhanced ISA (EISA) bus, the VESA (Video Electronics Standards Association) local bus, and the Peripheral Component Interconnect (PCI) bus, which may be implemented as a mezzanine bus manufactured in accordance with the IEEE P1386.1 standard.

[0075] The processing unit 504, which can be implemented as one or more integrated circuits (e.g., conventional microprocessors or microcontrollers), controls the operation of the computer system 500. One or more processors may be included in the processing unit 504. These processors may include single-core or multi-core processors. In one embodiment, the processing unit 504 may be implemented as one or more independent processing units 532 and / or 534, each processing unit containing a single or multi-core processor. In another embodiment, the processing unit 504 may also be implemented as a quad-core processing unit formed by integrating two dual-core processors onto a single chip.

[0076] In various embodiments, the processing unit 504 may execute various programs in response to program code and may maintain multiple concurrently running programs or processes. At any given time, some or all of the program code to be executed may reside in the processing unit 504 and / or the storage subsystem 518. Through suitable programming, the processing unit 504 may provide the various functions described above. The computer system 500 may additionally include a processing accelerator 506 which may include a digital signal processor (DSP), a dedicated processor, and / or similar.

[0077] The I / O subsystem 508 may include user interface input devices and user interface output devices. User interface input devices may include pointing devices such as keyboards, mice or trackballs, touchpads or touchscreens integrated into displays, scroll wheels, click wheels, dials, buttons, switches, keypads, audio input devices with voice instruction recognition systems, microphones, and other types of input devices. User interface input devices may also include motion detection and / or gesture recognition devices such as Microsoft Kinect® motion sensors, which enable users to control and interact with input devices such as Microsoft Xbox® 360 game controllers through a natural user interface using gestures and voice instructions. User interface input devices may also include eye gesture recognition devices such as Google Glass® blink detectors, which detect eye activity from the user (e.g., blinking while taking a picture and / or selecting from a menu) and translate those eye gestures as input to an input device (e.g., Google Glass®). Additionally, the user interface input device may include a voice recognition detection device that allows the user to interact with a voice recognition system (e.g., Siri® Navigator) through voice commands.

[0078] User interface input devices may include, without limitation, three-dimensional (3D) mice, joysticks or pointing sticks, and graphic tablets, as well as audio / visual devices such as speakers, digital cameras, digital camcorders, portable media players, webcams, image scanners, fingerprint scanners, barcode readers, 3D scanners, 3D printers, laser rangefinders, and eye-tracking devices. Additionally, user interface input devices may include medical imaging input devices such as computed tomography, magnetic resonance imaging, positional emission tomography, and medical ultrasound devices. User interface input devices may also include audio input devices such as MIDI keyboards, digital musical instruments, and similar devices.

[0079] User interface output devices may include non-visual displays such as display subsystems, indicator lights, or audio output devices. Display subsystems may include flat panel devices such as those using cathode ray tubes (CRTs), liquid crystal displays (LCDs), or plasma displays, projection devices, touchscreens, and similar devices. In general, the use of the term “output device” is intended to include all possible types of devices and mechanisms for outputting information from the computer system 500 to a user or another computer. For example, user interface output devices may include, without limitation, a variety of display devices that visually convey text, graphics, and audio / video information, such as monitors, printers, speakers, headphones, car navigation systems, plotters, audio output devices, and modems.

[0080] The computer system 500 may include a storage subsystem 518 that provides a tangible, non-temporary, computer-readable storage medium for storing software and data structures that provide the functionality of the embodiments described herein. The software may include programs, code modules, instructions, scripts, etc., which, when executed by one or more cores or processors of the processing unit 504, provide the functionality described above. The storage subsystem 518 may also provide a repository for storing data used in accordance with this disclosure.

[0081] As illustrated in the example in Figure 5, the storage subsystem 518 may include various components, including system memory 510, a computer-readable storage medium 522, and a computer-readable storage medium reader 520. The system memory 510 may store program instructions, such as application programs 512, which are readable and executable by the processing unit 504. The system memory 510 may also store data, such as program data 514, used during the execution of instructions, and / or data generated during the execution of program instructions. Various different types of programs, including but not limited to client applications, web browsers, intermediate tier applications, relational database management systems (RDBMS), virtual machines, and containers, may be loaded into the system memory 510.

[0082] System memory 510 may also store an operating system 516. Examples of operating systems 516 may include various versions of Microsoft Windows®, Apple Macintosh®, and / or Linux® operating systems, various commercially available UNIX® or UNIX-like operating systems (including, without limitation, various GNU / Linux® operating systems, Google Chrome® OS, and similar ones), and / or mobile operating systems such as iOS, Windows® Phone, Android® OS, BlackBerry® OS, and Palm® OS. In one implementation where the computer system 500 runs one or more virtual machines, the virtual machines, along with their guest operating systems (GOS), may be loaded into system memory 510 and run by one or more processors or cores of the processing unit 504.

[0083] The system memory 510 may be provided in different configurations depending on the type of computer system 500. For example, the system memory 510 may be volatile memory (such as random access memory (RAM)) and / or non-volatile memory (such as read-only memory (ROM) or flash memory). Different types of RAM configurations may be provided, including static random access memory (SRAM), dynamic random access memory (DRAM), and others. In some implementations, the system memory 510 may include a basic input / output system (BIOS) that contains basic routines to help transfer information between elements within the computer system 500, such as during startup.

[0084] The computer-readable storage medium 522 may represent a remote, local, fixed, and / or removable storage device, in addition to a storage medium for temporarily and / or more permanently containing and storing computer-readable information for use by the computer system 500, including instructions executable by the processing unit 504 of the computer system 500.

[0085] Computer-readable storage medium 522 may include, but is not limited to, any suitable medium known or used in the art, including storage and communication media, such as volatile and non-volatile removable and non-removable media, which are implemented in any method or technique for storing and / or transmitting information. This may include tangible computer-readable storage media, such as RAM, ROM, electrically erasable programmable ROM (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile disk (DVD), or other optical storage, magnetic cassette, magnetic tape, magnetic disk storage or other magnetic storage devices, or other tangible computer-readable media.

[0086] For example, computer-readable storage media 522 may include hard disk drives that read from or write to non-removable non-volatile magnetic media, magnetic disk drives that read from or write to removable non-volatile magnetic disks, and optical disk drives that read from or write to removable non-volatile optical disks, such as CD-ROMs, DVDs, and Blu-ray® discs, or other optical media. Computer-readable storage media 522 may also include, but are not limited to, Zip® drives, flash memory cards, Universal Serial Bus (USB) flash drives, Secure Digital (SD) cards, DVD discs, digital videotapes, and similar devices. Computer-readable storage media 522 may also include solid-state drives (SSDs) based on non-volatile memory, such as flash memory-based SSDs, enterprise flash drives, solid-state ROMs, and similar devices; SSDs based on volatile memory, such as solid-state RAM, dynamic RAM, static RAM, DRAM-based SSDs, and magnetoresistive RAM (MRAM) SSDs; and hybrid SSDs that use a combination of DRAM and flash memory-based SSDs. Disk drives and their associated computer-readable media can provide non-volatile storage for computer-readable instructions, data structures, program modules, and other data for the computer system 500.

[0087] Machine-readable instructions executable by one or more processors or cores of the processing unit 504 may be stored in a non-temporary computer-readable storage medium. The non-temporary computer-readable storage medium may include physically tangible memory or storage devices, including volatile memory storage devices and / or non-volatile storage devices. Examples of non-temporary computer-readable storage media include magnetic storage media (e.g., disks or tapes), optical storage media (e.g., DVDs, CDs), various types of RAM, ROM, or flash memory, hard drives, floppy drives, removable memory drives (e.g., USB drives), or other types of storage devices.

[0088] The communication subsystem 524 provides interfaces to other computer systems and networks. The communication subsystem 524 acts as an interface for receiving data from other systems and for transmitting data from computer system 500 to other systems. For example, the communication subsystem 524 may enable computer system 500 to connect to one or more devices via the Internet. In some embodiments, the communication subsystem 524 may include radio frequency (RF) transceiver components for accessing wireless voice and / or data networks (e.g., cellular technology, advanced data network technologies such as 3G, 4G, or EDGE (Enhanced Data Rates for Global Evolution), WiFi (IEEE 802.11 family standards, or other mobile communication technologies, or any combination thereof), global positioning system (GPS) receiver components, and / or other components. In some embodiments, the communication subsystem 524 may provide, in addition to or instead of wireless interfaces, wired network connectivity (e.g., Ethernet®).

[0089] In some embodiments, the communication subsystem 524 may also receive input communications on behalf of one or more users who may have access to the computer system 500, in the form of structured and / or unstructured data feeds 526, event streams 528, event updates 530, and the like.

[0090] For example, the communications subsystem 524 may be configured to receive data feeds 526 in real time from users of social networks and / or other communications services, such as web feeds like Twitter® feeds, Facebook® updates, Rich Site Summary (RSS) feeds, and / or real-time updates from one or more third-party sources.

[0091] Additionally, the communication subsystem 524 may also be configured to receive data in the form of a continuous data stream, which may include an event stream 528 and / or event updates 530 of real-time events that are essentially continuous or unlimited with no explicit end. Examples of applications that generate continuous data may include, for example, sensor data applications, financial tickers, network performance measurement tools (e.g., network monitoring and traffic management applications), clickstream analysis tools, automotive traffic monitoring, and similar.

[0092] The communication subsystem 524 may also be configured to output structured and / or unstructured data feeds 526, event streams 528, event updates 530, and similar to one or more databases that may be in communication with one or more streaming data source computers coupled to the computer system 500.

[0093] Computer system 500 may be one of various types, including handheld portable devices (e.g., iPhone® mobile phones, iPad® computing tablets, PDAs), wearable devices (e.g., Google Glass® head-mounted displays), PCs, workstations, mainframes, kiosks, server racks, or any other data processing systems.

[0094] Due to the constantly changing nature of computers and networks, the description of the computer system 500 depicted in Figure 5 is intended only as a specific example. Many other configurations are possible, having more or fewer components than the system depicted in Figure 5. For example, customized hardware may also be used, and / or certain elements may be implemented in hardware, firmware, software (including applets), or a combination thereof. Furthermore, connections to other computing devices, such as network input / output devices, may be used. Based on the disclosures and teachings provided herein, those skilled in the art will understand other ways and / or methods for carrying out various embodiments.

[0095] 4. Architecture Overview Figures 6A and 6B illustrate one example of System 600 in one or more embodiments. System 600 as described with reference to Figures 6A and 6B may perform operations associated with validating a CA dataset using asymmetric keys as described herein. System 600 may also perform operations associated with delivering certificate bundles to network entities and / or provisioning cloud resource instances, as respectively described herein.

[0096] As illustrated in Figure 6A, System 600 may include multiple virtual cloud networks 602, such as virtual cloud network 602a, virtual cloud network 602b, and virtual cloud network 602n. These multiple virtual cloud networks 602 may be distinct networks within a cloud computing environment. For example, each distinct virtual cloud network 602 may represent a logically isolated network within the cloud computing environment. Additionally or alternatively, one or more of the distinct virtual cloud networks 602 may be physically isolated from at least one of the other virtual cloud networks 602. In one example, multiple logically isolated virtual cloud networks 602 may share underlying physical infrastructure components, such as servers, switches, or routers. Distinct virtual cloud networks 602, such as those logically isolated from each other, may operate as independent networks while sharing underlying physical infrastructure components. Each separate virtual cloud network 602 may contain its own set of resources, IP address ranges, and / or security policies relative to other virtual cloud networks 602 in the cloud computing environment. Network entities on separate virtual cloud networks 602 may communicate with each other to varying degrees, for example, according to applicable security protocols.

[0097] In one example, separate virtual cloud networks 602 may be distinguished from each other based on the range of non-overlapping IP addresses assigned to each separate virtual cloud network 602. Additionally or alternatively, separate virtual cloud networks 602 may be distinguished from each other based on having separate cloud resources, such as a separate set of virtual machines, a separate control plane, a separate data plane, and / or a separate database. Additionally or alternatively, separate virtual cloud networks 602 may be distinguished from each other based on having separate firewalls, security protocols, security groups, or set security lists.

[0098] Each virtual cloud network 602 may include a network interface 604 configured to enable communication between virtual cloud networks 602. For example, as shown in Figure 6A, virtual cloud network 602a may include network interface 604a, and virtual cloud network 602b may include network interface 604b. A network interface 604 associated with a virtual cloud network 602 may include one or more connectivity mechanisms. In one example, network interface 604 may include a proxy server. The proxy server may act as a gateway between virtual cloud networks 602. Additionally or alternatively, network interface 604 may be configured to provide network peering. As used herein, the term “network peering” refers to a direct, private connection between separate networks that enables them to communicate as if they were part of the same network. For example, network peering may include virtual peering (e.g., for communication within the same cloud domain), VCN peering (e.g., for communication between separate virtual cloud networks within the same cloud provider's infrastructure), and / or VPN peering (e.g., for communication across different geographical locations or different cloud computing environments).

[0099] In one example, system 600 may include multiple realms 606, such as realm 606a, realm 606b, and realm 606n. Each realm 606 may include one or more virtual cloud networks 602. For example, realm 606a may include virtual cloud network 602a, and realm 606b may include virtual cloud networks 602b and 602n. In one example, system 600 may include multiple realms 608, such as realm 608a, realm 608b, and realm 608n. Each realm 608 may include one or more realms 606. For example, realm 608a may include realm 606a, and realm 608b may include realms 606b and 606n. As used herein, the term “realm” refers to a set of one or more interconnected data centers where virtual cloud networks are deployed. In one example, a realm may correspond to a physical geographical area. In one example, a realm may correspond to multiple physical geographic areas and / or parts of physical geographic areas. As used herein, the term “realm” refers to different deployments of the IaaS system infrastructure. In one example, realms within a realm may communicate with each other using network interface 604, for example, using network peering. In one example, realms from different realms may communicate with each other using network interface 604, for example, using network peering.

[0100] Referring further to Figure 6A, a first virtual cloud network, such as virtual cloud network 602a, may include a key management service 610. The key management service 610 may be configured to digitally sign CA datasets transmitted to the key management service 610 from other virtual cloud networks 602, such as virtual cloud network 602b and / or virtual cloud network 602n. After digitally signing the CA dataset, the key management service 610 may transmit the digital signature of the CA dataset to the other virtual cloud network 602 that transmitted the CA dataset.

[0101] In one example, the key management service 610 may be hosted on a virtual cloud network 602 within the home area 612. Additionally or alternatively, the virtual cloud network 602 on which the key management service 610 is hosted may be the home VCN 614. In one example, the CA dataset may be transmitted to the key management service 610 from one or more virtual cloud networks 602 associated with the auxiliary area 616. Additionally or alternatively, the virtual cloud network 602 on which the CA dataset is transmitted to the key management service 610 may be the auxiliary VCN 618.

[0102] As used herein, the term “home realm” refers to realm 606 of the cloud computing environment from which virtual cloud infrastructure may be deployed and / or managed. As used herein, the term “home VCN” refers to virtual cloud network 602 within the home realm. In one example, virtual cloud infrastructure may be deployed and / or managed from the home VCN. Realm 608, which includes home realm 612, may sometimes be referred to as home realm 620. Home realm 612 and / or home VCN 614 may serve as initial locations for deploying cloud computing resources and services, such as additional realms 606 and / or additional virtual cloud networks 602. In one example, CA resources and / or services may be deployed and / or managed from home realm 612. CA resources and / or services may include issuing digital certificates and / or generating asymmetric key pairs, such as asymmetric key pairs associated with digital certificates and / or asymmetric key pairs associated with validating CA datasets. The key management service 610 may represent a portion of the CA resources and / or services deployed and / or managed within the home domain.

[0103] As used herein, the term “auxiliary realm” refers to realm 606 of a cloud computing environment that utilizes and / or relies on home realm 612 and / or home VCN 614 for the deployment and / or management of at least a portion of the virtual cloud infrastructure with respect to one or more virtual cloud networks 602 within realm 606. As used herein, the term “auxiliary VCN” refers to a virtual cloud network 602 within auxiliary realm 616. In one example, auxiliary VCN 618 may utilize and / or relies on home realm 612 for the deployment and / or management of at least a portion of the virtual cloud infrastructure. Realm 608, which includes auxiliary realm 616, may sometimes be referred to as auxiliary realm 622.

[0104] The key management service 610 may include a private key repository 624. The private key repository 624 may contain one or more global private keys. One or more global private keys may be generated by the key management service 610. Each global private key may be associated with a corresponding global public key. For each global private key, the corresponding global public key may be stored in one or more public key repositories 626 associated with a virtual cloud network 602, such as an auxiliary VCN 618. For example, various network entities associated with the auxiliary VCN 618 may include a public key repository 626 containing one or more global public keys, each associated with a corresponding global private key in the private key repository 624. One or more global public keys may be transmitted from the home VCN 614 to the auxiliary VCN 618 for storage in one or more public key repositories 626. Additionally, or alternatively, one or more global public keys may be included within the configuration files and / or operating system images for the auxiliary VCN618, such as within the configuration files and / or operating system images for the auxiliary VCN618 and for various network entities associated with the auxiliary VCN618.

[0105] In one example, the private key repository 624 may include any type of storage device and / or storage device for storing data (e.g., a file system, a database, a set of tables, or any other storage mechanism). Furthermore, the private key data repository 624 may include multiple different storage devices and / or devices. These multiple different storage devices and / or devices may or may not be of the same type, or may or may not be located in the same physical location. Furthermore, the private key repository 624 may be implemented or run on the same computing system as the key management service 610. Additionally or alternatively, the private key repository 624 may be implemented or run on a different computing system than the key management service 610. The certificate repository 630 may be communicably coupled to the key management service 610 via a direct connection or via a network.

[0106] In one example, the public key repository 626 may include any type of storage device and / or storage device for storing data (e.g., a file system, a database, a set of tables, or any other storage mechanism). Furthermore, the public key data repository 626 may include multiple different storage devices and / or devices. These multiple different storage devices and / or devices may or may not be of the same type, or may or may not be located in the same physical location. Furthermore, the public key repository 626 may be implemented or run on the same computing system as the key management service 610. Additionally or alternatively, the public key repository 626 may be implemented or run on a different computing system than the key management service 610. The certificate repository 630 may be communicably coupled to the key management service 610 via a direct connection or via a network.

[0107] A CA dataset may contain one or more CA certificates. For example, a CA dataset may contain a certificate bundle containing one or more CA certificates. Additionally or alternatively, a CA dataset and / or certificate bundle may contain other data associated with the CA certificates, such as cryptographic keys, certificate revocation lists, and / or configuration files. When a set of one or more CA certificates is deployed, for example by auxiliary VCN618, before the deployment of one or more CA certificates, auxiliary VCN618 may transmit the CA dataset containing one or more CA certificates to key management service 610. Key management service 610 may digitally sign the CA dataset using a global private key and transmit the digital signature of the CA dataset to auxiliary VCN618. The CA dataset may then be validated using the global public key corresponding to the global public key used to digitally sign the CA dataset. In one example, various network entities associated with auxiliary VCN618 may validate the CA dataset before installing one or more CA certificates within it. Additionally or alternatively, the CA dataset may be validated before being delivered to network entities associated with auxiliary VCN618.

[0108] Referring further to Figure 6A, a virtual cloud network 602b, such as an auxiliary VCN 618, may include a CA provisioning service 628 and a certificate repository 630. The CA provisioning service 628 may provide CA certificates for use within the virtual cloud network 602b. In one example, the CA provisioning service 628 may act as the CA for the virtual cloud network 602b. The CA provisioning service 628 may generate CA certificates and / or certificate bundles. Additionally or alternatively, the CA provisioning service may obtain CA certificates and / or certificate bundles from a CA, such as from a CA associated with the home VCN 614. The CA provisioning service 628 may store the CA certificates and / or certificate bundles in the certificate repository 630.

[0109] The certificate repository 630 may include any type of storage device and / or storage device for storing data (e.g., a file system, a database, a set of tables, or any other storage mechanism). Furthermore, the certificate repository 630 may include multiple different storage devices and / or devices. These multiple different storage devices and / or devices may or may not be of the same type, or may or may not be located in the same physical location. The certificate repository 630 may share one or more storage devices with the public key repository 626b. Additionally or alternatively, the certificate repository 630 may include one or more storage devices that are different from one or more storage devices of the public key repository 626b. Furthermore, the certificate repository 630 and / or the public key repository 626b may be implemented or run on the same computing system as the CA provisioning service 628, the digital signature manager 632, and / or the distribution service 636. Additionally, or alternatively, the certificate repository 630 and / or public key repository 626b may be implemented or run on a separate computing system from the CA provisioning service 628, the digital signature manager 632, and / or the distribution service 636. The certificate repository 630 and / or public key repository 626b may be communicably coupled to the CA provisioning service 628, the digital signature manager 632, and / or the distribution service 636 via a direct connection or via a network connection.

[0110] In one example, as shown in Figure 6A, a virtual cloud network 602b, such as an auxiliary VCN 618, may include a digital signature manager 632. The digital signature manager may determine that a certificate repository 630 contains one or more CA certificates and / or one or more certificate bundles that have not yet been associated with a digital signature from a key management service 610. A CA certificate that has not yet been associated with a digital signature from a key management service 610 may sometimes be referred to as a “new CA certificate.” A certificate bundle that has not yet been associated with a digital signature from a key management service 610 may sometimes be referred to as a “new certificate bundle.” The digital signature manager 632 may discover one or more new CA certificates in the certificate repository 630. One or more new CA certificates may be included in a certificate bundle stored in the certificate repository 630. Additionally or alternatively, one or more new CA certificates may be stored individually in the certificate repository.

[0111] After detecting one or more new CA certificates and / or one or more new certificate bundles within the certificate repository 630, the digital signature manager 632 may transmit the CA dataset containing one or more CA certificates and / or one or more new certificate bundles to the key management service 610. The key management service 610 may receive the CA dataset from the digital signature manager 632 and may digitally sign the CA dataset using the global private key. After digitally signing the CA dataset, the key management service 610 may transmit the digital signature of the CA dataset to the digital signature manager 632. The digital signature manager 632 may receive the digital signature of the CA dataset from the key management service 610 and may store the digital signature in the certificate repository 630 in a data structure that associates the digital signature with the CA dataset.

[0112] In one example, the key management service 610 may include a signing service 634 configured to digitally sign the CA dataset. The signing service 634 may digitally sign the CA dataset by, at least, applying a hash function to the CA dataset to generate a hash value that uniquely represents the CA dataset. The hash value may then be encrypted using the global secret key to provide a digital signature, which is a cryptographic representation of the hash value encrypted using the global secret key. In one example, the digital signature of the CA dataset may be attached to the CA dataset, and the key management service 610 may transmit the CA dataset with the attached digital signature to the digital signature manager 632. Alternatively, the key management service 610 may transmit the digital signature of the CA dataset to the digital signature manager 632 without including the CA dataset, for example, because the digital signature manager may already have access to the CA dataset in the certificate repository 630.

[0113] In one example, the digital signature manager 632 may associate a digital signature received from the key management service 610 with a CA dataset in the certificate repository 630 based on one or more identification instructions, such as an identification number or timestamp associated with the CA dataset. Additionally, or alternatively, the digital signature manager 632 may verify the digital signature received from the key management service 610 using a global public key corresponding to the global private key used by the key management service 610 to digitally sign the CA dataset.

[0114] The digital signature manager 632 can verify the digital signature by, at least, calculating the hash value of the CA dataset using the same hash function used by the key management service 610 when digitally signing the CA dataset. The digital signature manager 632 can then decrypt the digital signature using the global public key to obtain the decrypted hash value. The digital signature manager 632 can compare the decrypted hash value with the hash value of the CA dataset. When the decrypted hash value matches the hash value of the CA dataset, this means that the CA dataset digitally signed by the key management service 610 is identical to the CA dataset from which the digital signature manager 632 calculated the hash value. Therefore, the digital signature manager 632 can determine that the digital signature of the CA dataset is valid if, at least, the decrypted hash value matches the hash value of the CA dataset. The digital signature manager 632 can, for example, verify the digital signature received from the key management service 610 before storing the digital signature in the data structure of the certificate repository 630 that associates the digital signature with the CA dataset. In one example, the digital signature manager 632 may reject the digital signature if there is a mismatch between the decrypted hash value and the hash value of the CA dataset. The digital signature manager 632 may request a new digital signature if there is a mismatch between the decrypted hash value and the hash value of the CA dataset.

[0115] Referring further to Figure 6A, a virtual cloud network 602b, such as an auxiliary VCN 618, may include a distribution service 636. The distribution service 636 may obtain a CA dataset from a certificate repository 630 and transmit that CA dataset to various network entities 638 associated with the virtual cloud network 602b. The distribution service 636 may transmit a CA dataset digitally signed by a key management service 610 to the network entities 638. In one example, the distribution service 636 may identify a CA dataset in the certificate repository 630 associated with a digital signature, and the distribution service 636 may transmit or push the CA dataset and its digital signature to one or more network entities 638. Additionally or alternatively, the distribution service 636 may receive requests from network entities 638 to provide the distribution service 636 with one or more new CA certificates and / or one or more new certificate bundles. The distribution service 636 may, in response to the request, transmit the CA dataset and the digital signature of the CA dataset to the network entity 638.

[0116] As shown in Figure 6A, a virtual cloud network 602v, such as an auxiliary VCN 618, may include multiple network entities 638, such as network entity 638c and network entity 638n. Each network entity 638 may include a provisioning module 640 and a public key repository 626. For example, network entity 638c may include a provisioning module 640c and a public key repository 626c, and network entity 638n may include a provisioning module 640n and a public key repository 626n. The public key repository 626 of a network entity 638, such as the public key repository 626c of network entity 638c, may include one or more global public keys. Each global public key in the public key repository 626 of a network entity 638 may correspond to a global private key used by the key management service 610 to digitally sign the CA dataset.

[0117] In one example, one or more global public keys may be included in a configuration file and / or in an operating system image for network entity 638. Additionally or alternatively, one or more global public keys may be transmitted to network entity 638 by, for example, a distribution service 636. For example, distribution service 636 may obtain one or more global public keys from public key repository 626b. In one example, public key repository 626b may be associated with virtual cloud network 602b. Additionally or alternatively, public key repository 626b may be associated with CA provisioning service 628, certificate repository 630, and / or digital signature manager 632. Distribution service 636 may transmit one or more global public keys obtained from public key repository 626b to one or more network entities, for example, to the provisioning module 640 of each network entity 638. Provisioning module 640 may install one or more global public keys in the public key repository 626 of network entity 638. For example, delivery service 636 may transmit one or more global public keys to provisioning module 640c of network entity 638c, and provisioning module 640c may install one or more global public keys in the public key repository 626c.

[0118] The provisioning module 640 of network entity 638 may perform initial provisioning of network entity 638. Additionally or alternatively, the provisioning module 640 may perform periodic updates to network entity 638. Initial provisioning and / or periodic updates of network entity 638 may include obtaining the CA dataset and digital signatures of the CA dataset from the distribution service 636, and installing one or more CA certificates and / or a certificate bundle containing one or more CA certificates on a storage medium associated with network entity 638. The provisioning module 640 may request the CA dataset from the distribution service 636. A request for the CA dataset may be associated with the initial provisioning or periodic updates to network entity 638. In response to a request from the provisioning module 640, the distribution service 636 may deliver the CA dataset to the provisioning module 640. Additionally or alternatively, the distribution service may, for example, push the CA dataset to the provisioning module 640 without receiving a request from the provisioning module 640.

[0119] In one example, the provisioning module 640 may verify the CA dataset, for example, before installing the CA dataset onto a storage medium, using a global public key corresponding to the global private key used by the key management service 610 to digitally sign the CA dataset.

[0120] Provisioning module 640 may verify the CA dataset by, at least, calculating the hash value of the CA dataset using the same hash function used by the key management service 610 when digitally signing the CA dataset. Provisioning module 640 may then decrypt the digital signature using the global public key to obtain the decrypted hash value. Provisioning module 640 may compare the decrypted hash value with the hash value of the CA dataset. When the decrypted hash value matches the hash value of the CA dataset, this means that the CA dataset digitally signed by the key management service 610 is identical to the CA dataset from which provisioning module 640 calculated the hash value. Therefore, provisioning module 640 may determine that the CA dataset is valid if, at least, the decrypted hash value matches the hash value of the CA dataset. Provisioning module 640 may verify the CA dataset, for example, before installing it on a storage medium associated with network entity 638. In one example, provisioning module 640 may reject the CA dataset if the decrypted hash value does not match the hash value of the matching CA dataset. The digital signature manager 632 may request a new digital signature if there is a mismatch between the decrypted hash value and the hash value of the CA dataset.

[0121] Referring further to Figure 6A, in one example, a virtual cloud network 602a, such as home VCN 614, may include a credential service 642. The credential service 642 may provide credentials, such as a certificate or token, to the digital signature manager 632. The digital signature manager 632 may have the authority to request that the digital signature manager 632 digitally sign the CA dataset based on at least the credentials. The digital signature manager 632 may provide credentials to the key management service 610 in connection with a request to the key management service 610 to digitally sign the CA dataset. The key management service 610 may verify the credentials before digitally signing the CA dataset. If the credentials are invalid, the key management service 610 may reject the request to digitally sign the CA dataset.

[0122] Referring hereto to Figure 6B, System 600 is further described with reference to an example virtual cloud network 650. The virtual cloud network 650 may include a virtual cloud network 602b, such as an auxiliary VCN 618, as described with reference to Figure 6A. As shown in Figure 6B, the virtual cloud network 650 may include a base network 652, an overlay network 654, and a network interface 656 that provides communication between the base network 652 and the overlay network 654. The system may include multiple network entities 658 located throughout the virtual cloud network. The multiple network entities 658 may correspond to multiple network entities 638 as described with reference to Figure 6A. The network entities 658 may reside on the base network 652, the overlay network 654, or the network interface 656. The network entities 658 may be implemented in hardware and / or software associated with the virtual cloud network, such as nodes, hosts, agents, services, components, endpoints, or other elements. Multiple network entities 658 may include one or more board entities 660, one or more interface entities 662, and / or one or more overlay entities 664.

[0123] As used herein, the term “underlying entity” refers to a network entity 658 implemented within an underlying network 652. As used herein, the term “underlying network” refers to the physical network infrastructure. An underlying network generally provides the foundation for a virtual cloud network. An underlying network 652 may include physical network devices such as routers, switches, network links, and other networking components. An underlying network 652 may generally provide the basic connectivity and forwarding capabilities necessary for data transmission within and between data centers.

[0124] One or more board entities 660 may include board hosts, routers, firewall devices, load balancers, storage devices, and / or board services. Board hosts may include endpoints within the board network 652, such as bare metal hosts, virtual machines, containers, or physical servers. Board services may include services that run or can run on board entities, such as firmware services, network connectivity services, addressing services, name resolution services, security services, network monitoring services, load balancing services, and / or storage services. Firmware services may be associated with the functionality or management of network infrastructure components or services, such as network devices, startup or initialization processes, hardware control, feature enablement, updates, hardware abstractions, network configuration, and / or network management. In one example, board entity 660 may include a combination of hardware and software. In one example, one or more board entities 660 may include one or more board hosts and / or one or more board services. In one example, a board host may include a bare metal host. In one example, a board service may include a firmware service. The substrate entities 660 can communicate with each other and / or other network entities 658 using logical network addresses assigned within the overlay network.

[0125] As used herein, the term “network interface” refers to a communication interface between the onboard network and the overlay network, such as a network interface card, smartNIC, or similar. Network interface 656 may include one or more interface entities 662, such as nodes on network interface 656, or interface services that run on or can run on network interface 656. Nodes on network interface 656 may include programmable hardware components, memory components, or gateway components. In one example, network interface 656 may include a network interface card, such as a smartNIC. Additionally or alternatively, network interface 656 may include nodes or endpoints on a network interface card or smartNIC.

[0126] The gateway component may provide connectivity between the substrate network 652 and the network interface 656, and / or between the network interface 656 and the overlay network 654. For example, the gateway component may enable communication between the overlay entity 664 and the substrate entity 660. Additionally or alternatively, the gateway component may provide connectivity between the overlay network 654 and an external network, such as the internet or another network outside the overlay network. For example, the overlay gateway may enable communication between the overlay entity 664 and an external endpoint.

[0127] As used herein, the term “overlay network” refers to a virtual network built on top of an underlying network using software-defined networking (SDN), virtualization, tunneling, and / or encapsulation technologies. Overlay networks generally operate independently of the underlying underlying network. Overlay networks provide logical isolation and segregation of traffic, enable virtual network provisioning, and / or enable the implementation of various network services and policies. Virtual machines, hosts, containers, or virtual network functions running on the underlying network may be connected via the overlay network.

[0128] As used herein, the term “overlay entity” refers to a network entity 658 implemented on an overlay network 654. An overlay network 654 may contain multiple overlay entities 664. Multiple overlay entities 664 may include overlay hosts, overlay services, subnets, overlay controllers, and / or overlay clients. In one example, an overlay network 654 may contain multiple overlay entities 664, such as overlay entities 664c and overlay entities 664n. In one example, an overlay entity 664 may include an overlay host. Additionally, or alternatively, an overlay entity 664 may include an overlay service. Multiple overlay entities 664 may communicate with each other using logical network addresses assigned within the overlay network 654.

[0129] An overlay host may include endpoints within the overlay network 654, such as virtual machines, containers, or physical servers. An overlay service may include services that run or can run on an overlay entity. An overlay service may include client-specific services, such as services installed by the client. Additionally or alternatively, an overlay service may include virtual network creation services, virtual network management services, virtual machine orchestration services, container orchestration services, network virtualization services, overlay security services, load balancing services, multi-tenancy services, and / or tenant isolation services.

[0130] A subnet may contain a virtual network segment having a distinct addressing scheme and / or a distinct set of network policies and / or services. A subnet may contain a set of overlay hosts. Multiple subnets may be used to demarcate each set of overlay hosts. An overlay controller may oversee the management, control, provisioning, configuration, and / or monitoring of the overlay network, network entities on the overlay network, and / or network policies within the overlay. The overlay controller interacts with the underlying infrastructure network, for example, to coordinate the operation of overlay hosts and / or communication across virtual switches and tunnels. An overlay client may contain an endpoint or device that initiates communication within the overlay network. An overlay client may be a specific instance or role within an overlay host. An overlay host may contain a set of overlay clients. An overlay client may contain consumers or users of services provided by an overlay host or IaaS. An overlay client may request and consume resources or services from an overlay host and act as a consumer or client of those resources or services.

[0131] Referring further to Figure 6B, the system 600 may include at least one distribution service 666 and at least one certificate repository 668. At least one distribution service 666 may correspond to distribution service 636 as described with reference to Figure 6A. Distribution service 666 may be configured to distribute certificate bundles containing CA certificates to at least some of the network entities 658. The certificate bundles may be housed in a certificate repository 668 accessible by distribution service 636. Certificate repository 668 may correspond to certificate repository 630 as described with reference to Figure 6A. Distribution service 666 may retrieve the certificate bundles from certificate repository 668 and transmit the certificate bundles to one or more of the network entities 658. In one example, distribution service 666 may be configured to transition through multiple network entities, for example, simultaneously, through a series of phases of a certificate bundle distribution process for distributing a new set of one or more CA certificates to multiple network entities 658 for use in a certificate authentication process.

[0132] In one example, the first distribution service 666a may be implemented on the board network 652. The distribution service 666 implemented on the board network 652 may be communicatively coupled to one or more board entities 660 on the board network 652. Additionally or alternatively, the distribution service 666 implemented on the board network 652 may be communicatively coupled to the network interface 656 and, for example, one or more interface entities 662 on the network interface 656. For example, the first distribution service 666a may obtain a certificate bundle from the certificate repository 668 and distribute the certificate bundle to one or more board entities 660 on the board network 652 and / or one or more interface entities 662 on the network interface 656.

[0133] In one example, the second distribution service 666b may be implemented on the network interface 656. The distribution service 666 implemented on the network interface 656 may be communicatively coupled to the overlay network 654 and / or the underlying network 652. For example, the second distribution service 666b implemented on the network interface 656 may be communicatively coupled to one or more overlay entities 664 on the overlay network 654. The second distribution service 666b may distribute a certificate bundle to one or more overlay entities 664 on the overlay network 654. In one example, the second distribution service 666b may obtain a certificate bundle from a storage medium associated with the network interface 656, for example, from a storage medium associated with interface entity 612 on the network interface 656. For example, the second distribution service 666b may distribute a certificate bundle installed on a storage medium associated with the network interface 656 and / or interface entity 662. In one example, a first distribution service 666a may distribute the certificate bundle to an interface entity 662 on a network interface 656, and a second distribution service 666b may distribute the certificate bundle to one or more overlay entities 664 on an overlay network 654 after the certificate bundle has been installed on a storage medium associated with the interface entity 662.

[0134] As shown in Figure 6B, each network entity 658 may include a provisioning module 670 and a storage medium 672. The provisioning module 670 may correspond to the provisioning module 640 described with reference to Figure 6A. The storage medium 672 may include the public key repository 626 of network entity 638 described with reference to Figure 6A. The provisioning module 670 associated with network entity 658 may receive a certificate bundle from the distribution service 666 and install the certificate bundle into the storage medium 672 associated with network entity 658. The distribution service 666 may deliver the certificate bundle to the provisioning module 670 in connection with the initial provisioning of network entity 658 and / or in connection with periodic updates. Additionally or alternatively, the distribution service 666 may deliver the certificate bundle to the provisioning module 670 according to each phase of the certificate bundle delivery process.

[0135] In one example, the provisioning module 670 of overlay entity 664 may send a request for a certificate bundle to the delivery service 666 using a gateway 674 between network interface 656 and overlay entity 664. Additionally or alternatively, the delivery service 666 may, for example, send the certificate bundle to overlay entity 664 using gateway 674 in response to a request from provisioning module 670. In one example, gateway 674 may be a metadata interface configured to exchange metadata between network interface 656 and overlay entity 664. In one example, gateway 674 may be available between network interface 656 and each of the overlay entities 664. Additionally or alternatively, network interface 656 may include a set of gateways 674, each gateway 674 corresponding to its respective overlay entity 664.

[0136] In one or more embodiments, System 600 may include more or fewer components than those illustrated in Figures 6A and 6B. The components illustrated in Figures 6A and 6B may be local to each other or remote from each other. The components illustrated in Figures 6A and 6B may include software and / or hardware components. Each component may be distributed across multiple applications and / or machines. Multiple components may be combined into a single application and / or machine. An operation described with respect to one component may instead be performed by another component. Additional embodiments and / or examples relating to System 600 are described above in Chapter 2, titled “Cloud Computing Techniques”.

[0137] In embodiments, the system 600 may include various components implemented on one or more digital devices. The term “digital device” generally refers to any hardware device including a processor. A digital device may refer to a physical device running an application or virtual machine. Examples of digital devices include computers, tablets, laptops, desktops, netbooks, servers, web servers, network policy servers, proxy servers, general-purpose machines, hardware devices for specific functions, hardware routers, hardware switches, hardware firewalls, hardware network address translation devices (NATs), hardware load balancers, mainframes, televisions, content receivers, set-top boxes, printers, mobile handsets, smartphones, personal digital assistants (PDAs), wireless receivers and / or transmitters, base stations, communication management devices, routers, switches, controllers, access points, and / or client devices.

[0138] 6. Authenticating network entities A network entity may utilize a CA certificate within a certificate bundle to authenticate other network entities associated with the virtual cloud network. For example, communication between network entities may be conducted according to a security protocol. This security protocol may include, for example, authenticating the network entity based on an entity certificate issued to the network entity by the CA before establishing communication with the network entity.

[0139] In one example, an entity certificate and the CA certificate corresponding to the CA that issued the entity certificate may represent at least a portion of the certificate chain. Each signature-key pair in the certificate chain is verified to authenticate a network entity. In one example, a higher-level CA may issue an entity certificate, in which case the certificate chain may contain one signature-key pair, namely the digital signature of the higher-level CA and the public key of the higher-level CA in the entity certificate. Such a higher-level CA may sometimes be referred to as the root CA. In another example, the certificate chain may contain signature-key pairs corresponding to multiple CA certificates. For example, the root CA may issue an intermediate CA certificate to an intermediate CA, and the intermediate CA may issue an entity certificate to a network entity. In this case, the certificate chain contains two signature-key pairs, namely (i) the digital signature of the intermediate CA and the public key of the intermediate CA in the entity certificate, and (ii) the digital signature of the root CA and the public key of the root CA in the intermediate CA certificate.

[0140] As used herein, the term “Certificate Authority Certificate” or “CA Certificate” refers to a digital certificate issued by a CA to establish its own identity and authenticity. A Certificate Authority Certificate may be a root CA certificate or an intermediate CA certificate. A Certificate Authority Certificate may be used to sign and issue other digital certificates, including those used for secure communication between network entities.

[0141] As used herein, the term “certification authority” or “CA” refers to an entity responsible for issuing and managing digital certificates. CAs verify the identity of network entities and digitally sign their certificates to establish their authenticity.

[0142] As used herein, the term “root certificate authority certificate” or “root CA certificate” refers to a higher-level CA certificate in a certificate chain or hierarchy. A root CA certificate may be self-issued and / or self-signed by a root CA. As used herein, the term “root CA” refers to a higher-level CA in a CA hierarchy. A root CA may issue root CA certificates, intermediate CA certificates, or entity certificates.

[0143] As used herein, the term “intermediate certificate authority certificate” or “intermediate CA certificate” refers to an intermediate-level CA certificate in a certificate chain or hierarchy. An intermediate CA certificate may be issued by a root CA. An intermediate CA certificate is located between the root CA certificate and the entity certificate in a certificate chain or hierarchy. As used herein, the term “intermediate CA” refers to an intermediate-level CA in a CA hierarchy. An intermediate CA may issue entity certificates, for example, in accordance with the authority granted to the intermediate CA by the root CA.

[0144] As used herein, the term “entity certificate” refers to a digital certificate issued to an entity, such as a network entity associated with a virtual cloud network. Entity certificates may be used to verify the identity of an entity and to enable secure communication between entities, such as between network entities within a virtual cloud network. Entity certificates may be issued by a CA, such as a root CA or an intermediate CA.

[0145] In one example, an entity certificate may be an instance principal certificate. As used herein, the term “instance principal certificate” refers to a digital certificate used to authenticate and guarantee communications for an instance or VM associated with a virtual cloud network. In one example, instances and VMs may be dynamically created, scaled, and terminated. An instance principal certificate may be associated with an instance or VM throughout its lifecycle and may be automatically generated and managed by the virtual cloud network infrastructure. An instance principal certificate may have limited access to communicate with a particular network entity based on the authorization assigned to the network entity to which the instance principal certificate is issued.

[0146] As used herein, the term “digital certificate” refers to a digitally signed electronic document that links a public key to the identity of an entity. A digital certificate may conform to the International Telecommunication Union standard X.509. A digital certificate may include the name of the issuer, the name of the certificate holder, the public key, issuer (CA) information, and the expiration date. Digital certificates may be used in various security protocols, such as SSL / TLS, to establish the identity and authenticity of communication parties and to facilitate secure communication. 6. Example Certificate Bundle Delivery Process Referring now to Figure 7, the operations relating to an example certificate bundle distribution process are further described. An operation 700 described with reference to Figure 7 may be associated with distributing a new set of one or more CA certificates to multiple network entities for use in a certificate authentication process. The CA certificates may include a root CA certificate and / or intermediate CA certificates. The CA certificates may be contained within a certificate bundle. One or more operations 700 illustrated in Figure 7 may be modified, rearranged, or omitted collectively. Therefore, a particular sequence of operations 700 illustrated in Figure 7 should not be construed as limiting the scope of one or more embodiments. As shown in Figure 7, an operation 700 relating to a certificate bundle distribution process may include a set of phases or a sequence of phases. In one example, as shown, an operation 700 may include a set of phases or a sequence of phases, such as four phases. In another example, the set of phases or a sequence of phases may include more or fewer phases, including, for example, all or some of the phases shown in Figure 7.

[0147] In one example, operation 700 may, in block 702, include delivering a new certificate bundle containing one or more new CA certificates to a set of network entities associated with a virtual cloud network. The new set of one or more CA certificates may contain at least one new CA certificate. Additionally or alternatively, a set of new CA certificates may be added to an existing certificate bundle.

[0148] In block 704, action 700 may include determining whether the new certificate bundle was successfully delivered. If the new certificate bundle was successfully delivered, action 700 may proceed to the next phase in the delivery process. The actions in blocks 702 and / or 704 may represent phase 1 of the certificate bundle delivery process.

[0149] In one example, action 700 may include activating the CA certificate in the new certificate bundle in block 706. In one example, activating the CA certificate may include the CA corresponding to the CA certificate issuing one or more intermediate CA certificates. The action in block 706 may represent phase 2 of the certificate bundle delivery process.

[0150] In one example, operation 700 may include, in block 708, distributing a new entity certificate to a set of network entities. Additionally or alternatively, operation 700 may include, for example, distributing a new intermediate CA certificate corresponding to the new entity certificate.

[0151] In block 710, action 700 may include determining whether the new entity certificate was successfully delivered. Additionally or alternatively, the action may include determining whether the new intermediate CA certificate was successfully delivered. When the new entity certificate (and / or new intermediate CA certificate) was successfully delivered, action 700 may proceed to the next phase in the delivery process. The actions in blocks 708 and 710 may represent phase 3 of the certificate bundle delivery process.

[0152] In one example, operation 700 may include removing a previous CA certificate that was delivered before the new CA certificate in block 712. For example, the previous CA certificate may include a CA certificate that is replaced by the new CA certificate. Removing a previous CA certificate relating to a particular network entity may include deleting the previous CA certificate from a storage medium associated with that particular network entity. For example, operation 700 may include transmitting a command to a particular network entity to delete the previous CA certificate from the storage medium. In response to receiving the command, the particular network entity may delete the previous CA certificate from the storage medium.

[0153] Additionally, or alternatively, removing a previous CA certificate relating to a network entity may involve replacing a first new certificate bundle with a second new certificate bundle, the first new certificate bundle containing the new CA certificate and the previous CA certificate, and the second new certificate bundle containing only the new CA certificate, thereby effectively removing the previous CA certificate from the first new certificate bundle. The second new certificate bundle may be delivered to a specific network entity and installed on a storage medium associated with that specific network entity, while the first new certificate bundle may be removed from the storage medium. The actions in block 712 may represent phase 4 of the certificate bundle delivery process.

[0154] 7. Verify the Certificate Authority dataset. Referring hereto to Figures 8A–8C, the operation 800 relating to verifying the CA dataset using an asymmetric key will be further described. The operation 800 described with reference to Figures 8A–8C may represent at least a portion of the process for delivering the certificate bundle to network entities and / or provisioning cloud resource instances, as each of these is described herein. One or more of the operation 800 described with reference to Figures 8A–8C may be collectively modified, combined, rearranged, or omitted. Therefore, a particular sequence of operation 800 described with reference to Figures 8A–8C should not be construed as limiting the scope of one or more embodiments.

[0155] A. Digital Signature Manager Operation Referring to Figure 8A, the operations associated with the digital signature manager are described. As shown in Figure 8A, operation 800 may include, in block 802, discovering one or more sets of new CA certificates in a certificate repository on a first virtual cloud network. In one example, discovering one or more sets of new CA certificates may include identifying one or more new CA certificates in the certificate repository and determining that one or more new CA certificates are unrelated to the current digital signature from the key management service.

[0156] In block 804, operation 800 may include transmitting a CA dataset, which includes one or more sets of new CA certificates, to a key management service hosted on a second virtual cloud network. In one example, the CA dataset may include a certificate bundle, which may include a set of CA certificates. The set of CA certificates in the certificate bundle may include one or more new CA certificates. In one example, transmitting the CA dataset may include transmitting a request to the key management service to digitally sign the CA dataset. Additionally or alternatively, operation 800 may include transmitting credentials to the key management service to authenticate the request to the key management service to digitally sign the CA dataset.

[0157] In block 806, operation 800 may include receiving a digital signature of a CA dataset from a key management service. The digital signature of the CA dataset may be generated based on at least a global private key stored on a second virtual cloud network within a private key repository associated with the key management service. In block 808, operation 800 may include storing the digital signature in a certificate repository in a data structure that associates the digital signature with the CA dataset.

[0158] In block 810, operation 800 may include determining whether the certificate repository contains another set of new CA certificates. For example, operation 800 may include periodically checking the certificate repository for another set of new CA certificates. Additionally or alternatively, operation 800 may include receiving notification that the certificate repository contains another set of new CA certificates. If the certificate repository contains another set of new CA certificates, the operation may return to block 804. Additionally or alternatively, if the certificate repository does not contain another set of new CA certificates, operation 800 of the digital signature manager may terminate in block 812.

[0159] In one example, operation 800 may include generating at least one new CA certificate, for example, in connection with deploying a region and / or in connection with deploying a first virtual cloud network within the region. In one example, the at least one new CA certificate may include one or more root CA certificates for issuing intermediate CA certificates and / or entity certificates to network entities associated with the first virtual cloud network.

[0160] In one example, operation 800 may include transmitting a CA dataset and a digital signature of the CA dataset to at least one network entity. The CA dataset and a digital signature of the CA dataset may be transmitted to at least one network entity, for example, in response to a request from at least one network entity, as illustrated with reference to Figure 8C.

[0161] B. Distribution service operation Referring to Figure 8B, the operations associated with the delivery service are further illustrated. As shown in Figure 8B, operation 800 may, in block 822, include receiving a request for at least one new set of Certificate Authority (CA) certificates from a network entity in the delivery service associated with the first virtual cloud network. In one example, the request for at least one new CA certificate may be associated with the initial provisioning of cloud resource instances on the first virtual cloud network. Additionally or alternatively, the request for at least one new CA certificate may be one of a series of periodic requests for updated certificate bundles.

[0162] In block 824, operation 800 may include, in response to receiving a request, transmitting to the network entity (a) a CA dataset containing at least one new set of CA certificates, and (b) a digital signature of the CA dataset. In one example, operation 800 may include locating the CA dataset and digital signature within a certificate repository. For example, the current CA dataset may be located based on one or more identification instructions, such as an identification number or timestamp associated with the CA dataset. In block 826, operation may include determining whether another request is received from the network entity. If another request is received from the network entity, operation may return to block 824. Alternatively, the operation of the delivery service may terminate in block 828.

[0163] In one example, in response to receiving a request from a network entity, operation 800 in block 822 may include determining whether the current CA dataset has already been transmitted to the network entity. The determination of whether the current CA dataset has already been transmitted to the network entity may be made based on a comparison of a timestamp corresponding to the digital signature of the CA dataset and a timestamp corresponding to a previous transmission of the CA dataset to the network entity. For example, operation 800 may include determining a first timestamp corresponding to the digital signature of the CA dataset, determining a second timestamp corresponding to a previous transmission of the CA dataset to the network entity, and determining whether the second timestamp precedes the first timestamp. Operation 800 may include determining that the current CA dataset has not yet been transmitted to the network entity if the second timestamp precedes the first timestamp. Additionally or alternatively, operation 800 may include determining that the current CA dataset has not yet been transmitted to the network entity if the second timestamp precedes the first timestamp. In response that the second timestamp precedes the first timestamp, operation 800 may include transmitting the CA dataset and the digital signature of the CA dataset to the network entity.

[0164] In one example, the digital signature of a CA dataset may be generated by a key management service hosted on a second virtual cloud network. The key management service may generate the digital signature of the CA dataset using a global private key stored on the second virtual cloud network in a private key repository associated with the key management service. The CA dataset may be verifiable, for example, by a network entity using a global public key corresponding to the global private key. The global public key may be stored in a public key repository associated with the network entity.

[0165] In one example, operation 800 may include verifying the CA dataset using a global public key corresponding to a global private key before transmitting the CA dataset and its digital signature to a network entity. The global public key used by the delivery service to verify the CA dataset may be stored in a public key repository associated with the delivery service. The global public key used by the delivery service may be an identical copy of the global public key used by the network entity to verify the CA dataset.

[0166] C. Network Entity Operation Referring to Figure 8C, the operations associated with the network entity are further described. As shown in Figure 8C, operation 800 may, in block 832, transmit a request to a delivery service associated with the first virtual cloud network for use by the network entity for a set of one or more Certificate Authority (CA) certificates. In block 834, operation 800 may, from the delivery service, (a) a CA dataset containing one or more CA certificates, and (b) a digital signature of the CA dataset.

[0167] In block 836, the operation may include verifying the CA dataset using a global public key stored in a public key repository on a first virtual cloud network. In one example, the global public key may be embedded within the operating system image of the network entity. The global public key used to verify the CA dataset may correspond to a global private key used by a key management service to generate a digital signature of the CA dataset. The key management service may be hosted on a second virtual cloud network, and the global private key may be stored on the second virtual cloud network in a private key repository associated with the key management service. In one example, the key management service may be a third-party service. In block 838, if the CA dataset is valid, operation 800 may proceed to block 840. Alternatively, in block 838, if the CA dataset is invalid, operation 800 may return to block 832. In block 840, operation 800 may include installing one or more sets of CA certificates into a storage medium associated with the network entity. In one example, installing one or more sets of CA certificates may represent the operation of a provisioning process for a network entity, as illustrated with reference to, for example, Figures 9 and 10.

[0168] D. Further characteristics of the example operation Referring further to Figures 8A-8C, the first virtual cloud network described with respect to operation 800 may be an auxiliary VCN, for example, as described with reference to Figure 6A. In one example, the first virtual cloud network may be located in a first area of ​​a first realm. The first area may include a first set of one or more interconnected data centers where the first virtual cloud network is deployed, and the first realm may include a first IaaS system infrastructure. Additionally or alternatively, the second virtual cloud network may be a home VCN, for example, as described with reference to Figure 6A. The second virtual cloud network may be located in a second area of ​​a second realm. The second area may include a second set of one or more interconnected data centers where the second virtual cloud network is deployed. The second realm may include a second IaaS system infrastructure.

[0169] 8. Provisioning cloud resource instances Referring now to Figure 9, an example of operations for provisioning a cloud resource instance associated with a virtual cloud network is further described. Provisioning a cloud resource instance may include creating and configuring the cloud resource instance for use on the virtual cloud network. After provisioning, the cloud resource instance may be made available for use on the virtual cloud network. Following provisioning, various deployment operations may be performed, for example, by the customer or tenant of the cloud resource instance. As shown in Figure 9, the provisioning process 900 may include several phases 902. Each of the phases 902 may include one or more operations for provisioning a cloud resource instance. The phases 902 and / or operations associated with each phase 902 of the provisioning process 900 may be modified, rearranged, or omitted collectively. Therefore, a particular sequence of phases 902 and / or associated operations described with reference to Figure 9 should not be construed as limiting the scope of one or more embodiments.

[0170] As shown in Figure 9, the provisioning process 900 may include at least one of the following: a configuration file generation phase 904, a local environment setup phase 906, a network configuration phase 908, an instance parameter configuration phase 910, or an instance finalization phase 912. Additionally or alternatively, the provisioning process 900 may include a certificate bundle provisioning phase 914.

[0171] In one example, configuration file generation phase 904 may include one or more actions associated with the provisioning module and / or instance provisioning agent identifying available data sources and generating configuration files accordingly. Available data sources may include storage media associated with delivery services, certificate repositories, and / or network entities. Additionally or alternatively, available data sources may include metadata sources, such as cloud provider metadata services and / or instance-specific metadata services.

[0172] In one example, the local environment setup phase 906 may include one or more actions associated with setting up the local environment of a cloud resource instance. For example, the local environment phase may include configuring a hostname, setting up user accounts, and executing scripts or commands specified within a data source referenced in connection with the provisioning process 900.

[0173] In one example, network configuration phase 908 may include one or more actions associated with configuring network interfaces and associated settings, such as assigning IP addresses, configuring DNS settings, defining routes, and managing network bonding or bridging configurations. Additionally or alternatively, network configuration phase 908 may include configuring security protocol settings, including creating a certificate bundle file directory, generating a pointer to the certificate bundle file directory, and / or obtaining network entity certificates for cloud resource instances.

[0174] In one example, instance parameter configuration phase 910 may include one or more actions associated with processing the configuration file generated in configuration file generation phase 904, and / or one or more actions associated with applying specified settings to the cloud resource instance. Specified settings may include package installation settings, user-specific settings, file modification settings, and / or service configuration settings.

[0175] In one example, instance finalization phase 912 may include one or more actions associated with additional instance configuration scripts and / or system cleanup tasks.

[0176] In one example, certificate bundle provisioning phase 914 may include one or more actions associated with obtaining, verifying, and installing a certificate bundle containing a set of CA certificates. For example, certificate bundle provisioning phase 914 may include one or more actions as described with reference to Figure 10.

[0177] In one example, at least a portion of the provisioning process 900 may be performed by a provisioning module associated with a cloud resource instance. Additionally or alternatively, a portion of the provisioning process 900 may be performed by one or more provisioning agents. One or more provisioning agents may represent a portion of the provisioning module. Additionally or alternatively, provisioning agents may represent services to run on a virtual cloud network. The provisioning module may invoke one or more provisioning agents and prompt them to perform at least a portion of the provisioning process.

[0178] In one example, as shown, the provisioning process may include one or more actions performed by an instance provisioning agent and one or more actions performed by a certificate bundle provisioning agent. The instance provisioning agent and / or certificate bundle provisioning agent may represent a part of a provisioning module or a service running on a virtual cloud network. In one example, the instance provisioning agent may perform at least one of the following: configuration file generation phase 904, local environment setup phase 906, network configuration phase 908, instance parameter configuration phase 910, or instance finalization phase 912. The certificate bundle provisioning agent may perform one or more actions associated with the certificate bundle provisioning phase 914.

[0179] In one example, the certificate bundle provisioning phase 914 may be triggered by a certificate bundle acquisition trigger 916 within the provisioning process 900. The certificate bundle acquisition trigger 916 may be an executable command associated with one or more actions in the provisioning process 900. For example, as shown, the certificate bundle acquisition trigger may be associated with the network configuration phase 908. In response to detecting the certificate bundle acquisition trigger 916, the instance provisioning agent may prompt the certificate bundle provisioning agent to perform one or more actions associated with the certificate bundle provisioning phase 914. After completing one or more actions associated with the certificate bundle provisioning phase 914, the certificate bundle provisioning agent may prompt the instance provisioning agent to perform one or more actions associated with the certificate bundle provisioning phase 914. For example, the certificate bundle provisioning phase 914 may include a certificate bundle-install trigger 918. In response to detecting the certificate bundle-install trigger 918, the certificate bundle provisioning agent may send a notification to the instance provisioning agent that one or more actions associated with the certificate bundle provisioning phase 914 have been completed, prompting the instance provisioning agent to do so. In response to receiving a prompt from the certificate bundle provisioning agent, the instance provisioning agent may perform one or more subsequent actions of provisioning process 900.

[0180] One or more phases of the provisioning process 900 may be performed before the certificate bundle acquisition trigger 916 is detected. For example, the configuration file generation phase 904 and the local environment setup phase 906 may be performed before the certificate bundle acquisition trigger 916 is detected. Additionally or alternatively, at least a portion of the network configuration phase may be performed before the certificate bundle acquisition trigger 916 is detected. One or more phases of the provisioning process 900 may be performed after the certificate bundle installation trigger 918, such as after the certificate bundle provisioning phase 914 is completed. For example, the instance parameter configuration phase 910 and the instance finalization phase 912 may be performed after the certificate bundle installation trigger 918. Additionally or alternatively, at least a portion of the network configuration phase 908 may be performed after the certificate bundle installation trigger 918.

[0181] In one example, the provisioning process 900 may include initializing a security protocol for secure communication between a cloud resource instance and another network entity associated with the virtual cloud network. The security protocol may be initialized as part of the network configuration phase 908. For example, the security protocol may be initialized to enable the execution of further actions associated with the network configuration phase 908 and / or one or more other phases of the provisioning process 900.

[0182] In one example, initializing a security protocol may include receiving an entity certificate from a network entity and authenticating the entity certificate using at least one CA certificate in the certificate bundle. In one example, after initializing the security protocol, one or more subsequent operations of the provisioning process 900 may be performed, such as one or more operations of the network configuration phase 908, the instance parameter configuration phase 910, and / or the instance finalization phase 912. In one example, one or more subsequent operations of the provisioning process 900 may include, after initializing the security protocol, receiving a first secure communication from a network entity in accordance with the security protocol, or sending a second secure communication to the network entity in accordance with the security protocol.

[0183] In one example, a cloud resource instance may not have access to at least one CA certificate before detecting the certificate bundle acquisition trigger 916 and / or before the completion of the certificate bundle provisioning phase 914. The cloud resource instance may gain access to the CA certificate upon completion of the certificate bundle provisioning phase 914. In one example, one or more subsequent actions of the provisioning process 900 performed after the certificate bundle provisioning phase 914 may include one or more actions that utilize secure communication established between the cloud resource instance and the network entity in accordance with a security protocol.

[0184] In one example, at least one subsequent action of the provisioning process 900 may include sending a notification to a service agent running on a cloud resource instance, containing the location of a certificate bundle in a storage medium. Additionally or alternatively, the certificate bundle may be sent to the service agent. The service agent may include, or be associated with, an overlay service, a base service, or an interface service. The service agent may perform one or more provisioning actions associated with provisioning the overlay service, a base service, or an interface service. For example, the service agent may perform one or more actions with respect to an overlay service, a base service, or an interface service, associated with the provisioning process 900 described herein.

[0185] 9. Obtain and install the certificate bundle. Referring now to Figure 10, the operations 1000 relating to provisioning network entities associated with a virtual cloud network are further described. One or more operations 1000 described with reference to Figure 10 may be collectively modified, rearranged, or omitted. Therefore, a particular sequence of operations 1000 described with reference to Figure 10 should not be construed as limiting the scope of one or more embodiments. In one example, the operations 1000 described with reference to Figure 10 may represent a part of a provisioning process for provisioning cloud resource instances associated with a virtual cloud network. For example, the operations 1000 described with reference to Figure 10 may include operations associated with the certificate bundle provisioning phase of the provisioning process.

[0186] As shown in Figure 10, operation 1000 may include, in block 1002, performing at least one provisioning operation of the provisioning process for cloud resource instances associated with a virtual cloud network. In one example, the at least one provisioning operation may include at least one operation associated with the configuration file generation phase and / or at least one operation associated with the local environment setup phase, as illustrated with reference to Figure 9, for example. Additionally or alternatively, the at least one provisioning operation may include at least one operation associated with the network configuration phase, as illustrated with reference to Figure 9, for example.

[0187] During the provisioning process, certificate bundle retrieval may be triggered. In block 1004, operation 1000 may include detecting whether certificate bundle retrieval is triggered. The certificate bundle retrieval trigger may be an executable command associated with one or more operations in the provisioning process, for example, as illustrated with reference to Figure 9. The executable command may be incorporated into a computer executable instruction by the instance provisioning agent, for example. In one example, the instance provisioning agent may detect that certificate bundle retrieval is triggered, for example, based on an executable command in a computer executable instruction. In response to detecting the certificate bundle retrieval trigger, the instance provisioning agent may prompt the certificate bundle provisioning agent to perform one or more operations associated with the certificate bundle provisioning phase, for example, as illustrated with reference to Figure 9. The certificate bundle provisioning agent performs one or more operations associated with the certificate bundle provisioning phase according to the executable operations performed by the certificate bundle provisioning agent.

[0188] If certificate bundle retrieval is not triggered, action 1000 may return to block 1002, where additional actions in the provisioning process may be performed. When certificate bundle retrieval is triggered, action 1000 may proceed to block 1006.

[0189] In block 1006, the operation may include sending a request for a certificate bundle for the cloud resource instance to a network interface linked to the cloud resource instance. For example, the request for the certificate bundle may be sent to a delivery service running on the network interface. The request for the certificate bundle for the cloud resource instance may be sent by a certificate bundle provisioning agent, for example, as described with reference to Figure 9. The location of the network interface and / or the delivery service may be determined from the network directory address associated with the network interface and / or the delivery service running on the network interface. The network directory address may be incorporated into a computer executable instruction, for example, by the certificate bundle provisioning agent. The request for the certificate bundle may include configuration information about the cloud resource instance. The network interface may select a certificate bundle based on its configuration information. The request for the certificate bundle may include the network location to which the network interface should send the certificate bundle, such as the network directory address of the cloud resource instance and / or the file directory associated with the cloud resource instance where the certificate bundle may be installed.

[0190] In response to receiving a request, the operation in block 1008 may include receiving from the network interface (i) a CA dataset containing a certificate bundle for a cloud resource instance, and (ii) a digital signature of the CA dataset. The certificate bundle may contain one or more sets of CA certificates. One or more sets of CA certificates may contain one or more root CA certificates and / or one or more intermediate CA certificates.

[0191] In block 1010, the operation may include verifying the CA dataset using a global public key stored in a public key repository on a first virtual cloud network. In one example, the global public key may be embedded within the operating system image of a cloud resource instance. The global public key used to verify the CA dataset may correspond to a global private key used by a key management service to generate a digital signature of the CA dataset. The key management service may be hosted on a second virtual cloud network, and the global private key may be stored on the second virtual cloud network in a private key repository associated with the key management service. In block 1012, if the CA dataset is valid, operation 800 may proceed to block 1014. Alternatively, in block 1012, if the CA dataset is invalid, operation 800 may return to block 1006.

[0192] In block 1014, operation 1000 may include installing a certificate bundle into a storage medium associated with a cloud resource instance. Installing a certificate bundle may include making the certificate bundle available to the cloud resource instance for use in verifying network entities. For example, installing a certificate bundle may include creating a file and storing the certificate bundle in the file. Additionally or alternatively, installing a certificate bundle may include creating a file directory for the certificate bundle and / or specifying a location where a process or application that may run on the cloud resource instance can find the certificate bundle. For example, the location of the certificate bundle may be specified in an operating system configuration file, a registry settings file, or an executable file. Installing a certificate bundle may represent an operation in the provisioning process. In one example, before installing the certificate bundle, operation 1000 may include one or more validation operations on the certificate bundle. In one example, operation 1000 may include performing validation on the certificate bundle, determining that the certificate bundle passes the validation, and, in response to determining that the certificate bundle passes the validation, installing the certificate bundle into a storage medium.

[0193] In one example, validating a certificate bundle may involve performing a subject key identifier check on at least a subset of CA certificates from the set of CA certificates within the certificate bundle. The validation operation may involve determining that each CA certificate in the subset of CA certificates passes the subject key identifier check. In one example, the subject key identifier check may be performed on all CA certificates in the certificate bundle. For a particular CA certificate, the subject key identifier check may involve calculating the hash value of the public key corresponding to that particular CA certificate, determining the subject key identifier corresponding to that particular CA certificate, and comparing the hash value to the subject key identifier. The subject key identifier may be a digital signature on a CA certificate. The subject key identifier may be a private key associated with a public key. The private and public keys may represent an asymmetric key pair. For example, a subject key identifier such as a digital signature on a CA certificate may be generated using a private key. The subject key identifier may be decrypted using a hash function.

[0194] In one example, a subject key identifier check may further include determining whether a hash value matches the subject key identifier corresponding to a particular CA certificate. A particular CA certificate may be determined to pass the subject key identifier check if a match exists between the hash value and the subject key identifier. In one example, the match between the hash value and the subject key identifier may be determined by decrypting the subject key identifier using a hash function and comparing the resulting decryption to the hash value of the public key. If the public key matches the subject key identifier, the decryption of the subject key identifier matches the hash value of the public key. Verification may include determining, based on this match, that a particular CA certificate passes the subject key identifier check.

[0195] In one example, operation 1000 may include determining that the certificate bundle fails to validate and generating an alert for a display on an interface device indicating that the certificate bundle failed to validate. Additionally or alternatively, in response to determining that the certificate bundle failed to validate, operation 1000 may include sending a subsequent request for an updated certificate bundle for the cloud resource instance to the network interface (and / or a delivery service running on the network interface). In response to receiving the subsequent request at the network interface (and / or the delivery service), operation 1000 may include sending the updated certificate bundle for the cloud resource instance to the network interface. Additionally or alternatively, operation 1000 may include receiving the updated certificate bundle for the cloud resource instance from the network interface. The updated certificate bundle may include an updated set of CA certificates. Operation 1000 may further include performing subsequent validation of the updated certificate bundle. For example, subsequent validation may include a signing key identifier check as described above. In response to determining that the updated certificate bundle will pass subsequent verification, operation 1000 may include installing the updated certificate bundle onto a storage medium.

[0196] After installing the certificate bundle in block 1014, operation 1000 may further include performing one or more additional provisioning operations in block 1016 for the provisioning process for the cloud resource instance associated with the virtual cloud network. In one example, one or more additional provisioning operations may include at least one operation associated with the network configuration phase, as illustrated with reference to Figure 9, for example. For example, one or more additional provisioning operations may include configuring one or more network configuration settings for the cloud resource instance. One or more network configuration settings may be configured as part of the network configuration phase. In one example, one or more additional provisioning operations in the provisioning process may be triggered by a certificate bundle installation trigger, as illustrated with reference to Figure 9. The certificate bundle installation trigger may be an executable command incorporated into a computer executable instruction executed by the certificate bundle provisioning agent. In response to detecting the certificate bundle installation trigger, the certificate bundle provisioning agent may send a notification to the instance provisioning agent that one or more operations associated with the certificate bundle provisioning phase have been completed, prompting the instance provisioning agent. In response to receiving a prompt from the certificate bundle provisioning agent, the instance provisioning agent may perform one or more subsequent operations in the provisioning process.

[0197] In one example, in block 1016, operation 1000 may include performing the network configuration stage of the provisioning process. During or after the network configuration stage, operation 1000 may include performing at least one of the following: detecting a certificate bundle acquisition trigger, receiving a certificate bundle, and installing the certificate bundle into storage. Additionally or alternatively, operation 1000 may include creating a file directory in storage, installing the certificate bundle into the file directory, and / or sending a message to a service agent running on a cloud resource instance containing the directory path to the file directory. Additionally or alternatively, one or more additional provisioning operations in the provisioning process in block 1016 may include at least one operation associated with the instance parameter configuration phase and / or at least one operation associated with the instance finalization phase, as illustrated, for example, with reference to Figure 9. One or more additional provisioning operations in the provisioning process may be performed in block 1016 by an instance provisioning agent, for example, in accordance with computer executable instructions executed by an instance provisioning agent. 8. Miscellaneous notes, expansion Embodiments cover systems comprising one or more devices, including a hardware processor, and configured to perform any of the operations described herein and / or enumerated in any of the following claims. Embodiments cover systems comprising means for performing any of the operations described herein and / or enumerated in any of the following claims. In embodiments, a non-temporary computer-readable storage medium, when executed by one or more hardware processors, includes instructions that cause the performance of any of the operations described herein and / or enumerated in any of the following claims.

[0198] Any combination of the features and functions described herein may be used according to one or more embodiments. In the foregoing specification, embodiments are described with reference to a number of specific details which may vary from one implementation to another. This specification and the drawings are therefore intended to be illustrative rather than restrictive. The sole and exclusive guideline for the scope of the invention, and what the applicant intends to be the scope of the invention, is the literal and equivalent scope of the set of claims derived in this application, including any subsequent amendments, which is in the particular form from which such claims arise.

[0199] All references cited herein, including publications, patent applications, and patents, are incorporated herein by reference to the same extent that each reference is individually and specifically indicated as being incorporated herein by reference, and to the same extent that it is included herein in whole.

Claims

1. One or more non-temporary computer-readable media containing instructions that, when executed by one or more hardware processors, cause an action to be performed, the action is To detect at least one new Certificate Authority (CA) certificate within the certificate repository on the first virtual cloud network, Transmitting the CA dataset, which includes the at least one new CA certificate, to a key management service hosted on a second virtual cloud network, Receiving the digital signature of the CA dataset from the aforementioned key management service, The digital signature of the CA dataset is generated based on at least a global secret key, and the global secret key is stored on the second virtual cloud network in a secret key repository associated with the key management service. The aforementioned operation is, The further comprising storing the digital signature in the certificate repository, the certificate repository comprising one or more non-temporary computer-readable media including a data structure that associates the digital signature with the CA dataset.

2. The first virtual cloud network is located within a first area of ​​a first realm, the first area includes a first set of one or more interconnected data centers where the first virtual cloud network is deployed, and the first realm includes a first Infrastructure-as-a-Service (IaaS) system infrastructure. The medium according to claim 1, wherein the second virtual cloud network is located within a second area of ​​a second realm, the second area includes a second set of one or more interconnected data centers where the second virtual cloud network is deployed, and the second realm includes a second IaaS system infrastructure.

3. The aforementioned operation is, The medium according to claim 2, further comprising generating the at least one new CA certificate in connection with deploying the first area and / or the first virtual cloud network.

4. The medium according to claim 3, wherein the at least one new CA certificate includes a root CA certificate for issuing intermediate CA certificates and / or entity certificates to network entities associated with the first virtual cloud network.

5. The aforementioned operation is, The medium according to claim 1, further comprising transmitting the CA dataset and the digital signature of the CA dataset to at least one network entity.

6. Detecting at least one new CA certificate is, Identifying at least one CA certificate, The determination that the at least one CA certificate is unrelated to the current digital signature from the key management service, The medium according to claim 1, including the following:

7. The medium according to claim 1, wherein the CA dataset includes a certificate bundle, the certificate bundle includes a set of CA certificates, and the set of CA certificates includes the at least one new CA certificate.

8. Transmitting the CA dataset to the key management service means The medium according to claim 1, comprising transmitting to the key management service a request to digitally sign the CA dataset.

9. Transmitting the CA dataset to the key management service means The medium according to claim 8, comprising transmitting credentials to the key management service in order to authenticate a request to the key management service to digitally sign the CA dataset.

10. One or more non-temporary computer-readable media containing instructions that, when executed by one or more hardware processors, cause an action to be performed, the action is In a delivery service associated with a first virtual cloud network, receiving a request for at least one new Certificate Authority (CA) certificate from a network entity, In response to receiving the aforementioned request, the network entity transmits to (a) a CA dataset containing the at least one new CA certificate, and (b) a digital signature of the CA dataset. Includes, The digital signature of the CA dataset is generated using a global secret key by a key management service hosted on a second virtual cloud network. The global private key is stored on the second virtual cloud network within a private key repository associated with the key management service. The CA dataset is verifiable using a first global public key corresponding to the global private key, and the first global public key is stored in one or more non-temporary computer-readable media within a public key repository associated with the network entity.

11. The aforementioned operation is, The medium according to claim 10, further comprising verifying the CA dataset and the digital signature of the CA dataset with a second global public key corresponding to the global private key before transmitting the CA dataset and the digital signature of the CA dataset to the network entity, wherein the second global public key is stored in a second public key repository associated with the distribution service.

12. Verifying the CA dataset mentioned above is A first hash value is generated by applying a hash function to the CA dataset. The second hash value is generated by decrypting the digital signature of the CA dataset using the second global public key, Comparing the first hash value with the second hash value, Determining that the first hash value matches the second hash value, The medium according to claim 11, including the following:

13. The aforementioned operation is, The medium according to claim 10, further comprising locating the CA dataset and the digital signature within a certificate repository in response to receiving the aforementioned request.

14. The request for at least one new CA certificate is associated with the initial provisioning of a cloud resource instance on the first virtual cloud network, or The medium according to claim 10, wherein the request for at least one new CA certificate is one of a series of periodic requests for an updated certificate bundle.

15. The medium according to claim 10, wherein the CA dataset includes a certificate bundle, the certificate bundle includes a set of CA certificates, and the set of CA certificates includes the at least one new CA certificate.

16. The aforementioned operation is, In response to receiving the aforementioned request, Determining a first timestamp corresponding to the digital signature of the CA dataset, Determining a second timestamp corresponding to a previous transmission to the aforementioned network entity, The preceding transmission further includes a preceding CA dataset containing one or more preceding CA certificates, The aforementioned operation is, Determining that the second timestamp precedes the first timestamp, In response to determining that the second timestamp precedes the first timestamp, the CA dataset and the digital signature of the CA dataset are transmitted to the network entity. The medium according to claim 10, further comprising:

17. The first virtual cloud network is located within a first area of ​​a first realm, the first area includes a first set of one or more interconnected data centers where the first virtual cloud network is deployed, and the first realm includes a first Infrastructure-as-a-Service (IaaS) system infrastructure. The medium according to claim 10, wherein the second virtual cloud network is located within a second area of ​​a second realm, the second area includes a second set of one or more interconnected data centers where the second virtual cloud network is deployed, and the second realm includes a second IaaS system infrastructure.

18. The aforementioned operation is, Before receiving the request from the aforementioned network entity, To detect at least one new CA certificate within the certificate repository on the first virtual cloud network, Transmitting the CA dataset to the key management service, Receiving the digital signature of the CA dataset from the key management service, The digital signature is stored in the aforementioned certificate repository, The medium according to claim 10, further comprising the certificate repository including a data structure that associates the digital signature with the CA dataset.

19. One or more non-temporary computer-readable media containing instructions that, when executed by one or more hardware processors, cause an action to be performed, the action is To transmit a request for at least one Certificate Authority (CA) certificate for use by a network entity to a distribution service associated with the first virtual cloud network, Receiving from the distribution service (a) a CA dataset containing the at least one CA certificate, and (b) a digital signature of the CA dataset, Includes, The digital signature of the CA dataset is generated using a global secret key by a key management service hosted on a second virtual cloud network. The global private key is stored on the second virtual cloud network within a private key repository associated with the key management service. The aforementioned operation is, The method further includes verifying the CA dataset using a global public key corresponding to the global private key, wherein the global public key is stored in a public key repository on the first virtual cloud network. The aforementioned operation is, One or more non-temporary computer-readable media, further comprising installing the at least one CA certificate on a storage medium associated with the network entity.

20. The storage medium according to claim 19, wherein installing the at least one CA certificate on the storage medium represents the operation of the provisioning process for the network entity.

21. The aforementioned operation is, During the provisioning process, a certificate bundle acquisition trigger is detected, In response to detecting the certificate bundle acquisition trigger, the request for the at least one CA certificate is transmitted. The medium according to claim 20, further comprising:

22. The aforementioned operation is, The medium according to claim 21, further comprising performing additional operations of the provisioning process after installing the at least one CA certificate.

23. The medium according to claim 19, wherein the global public key is embedded within the operating system image of the network entity.

24. The medium according to claim 19, wherein the aforementioned key management service is a third-party service.

25. The first virtual cloud network is located within a first area of ​​a first realm, the first area includes a first set of one or more interconnected data centers where the first virtual cloud network is deployed, and the first realm includes a first Infrastructure-as-a-Service (IaaS) system infrastructure. The medium according to claim 19, wherein the second virtual cloud network is located within a second area of ​​a second realm, the second area includes a second set of one or more interconnected data centers where the second virtual cloud network is deployed, and the second realm includes a second IaaS system infrastructure.

26. One or more non-temporary computer-readable media containing instructions that, when executed by one or more hardware processors, cause an action to be performed, the action is The process includes transmitting a request for at least one Certificate Authority (CA) certificate from a network entity to a distribution service, wherein the network entity and the distribution service are associated with a first virtual cloud network. The aforementioned operation is, The distribution service receives the request, In response to receiving the aforementioned request, the distribution service transmits to the network entity (a) a CA dataset containing the at least one new CA certificate, and (b) a digital signature of the CA dataset. It further includes, The digital signature of the CA dataset is generated using a global secret key by a key management service hosted on a second virtual cloud network. The aforementioned operation is, The network entity receives the CA dataset containing the at least one CA certificate, and the digital signature of the CA dataset. The CA dataset is verified using the global public key corresponding to the global private key, Installing the at least one CA certificate on a storage medium associated with the network entity, It further includes, The global private key is stored on the second virtual cloud network within a private key repository associated with the key management service. The global public key is stored on the first virtual cloud network in one or more non-transient computer-readable media within a public key repository associated with the network entity.

27. The aforementioned operation is, In response to receiving the aforementioned request, The process further includes verifying the CA dataset using a second global public key corresponding to the global private key, wherein the second global public key is stored on the first virtual cloud network in a second public key repository associated with the delivery service. The aforementioned operation is, Based on the above verification, it is determined that the CA dataset is valid, Following the determination that the CA dataset is valid, the CA dataset and the digital signature of the CA dataset are transmitted to the network entity. The medium according to claim 26, further comprising:

28. The aforementioned operation is, The provisioning process for the aforementioned network entity includes detecting a certificate bundle acquisition trigger, In response to detecting the certificate bundle acquisition trigger, the request for the at least one CA certificate is transmitted. The medium according to claim 26, further comprising:

29. A computer program product that, when executed by one or more hardware processors, includes instructions that cause the execution of any one of the operations described in claims 1 to 28.

30. A method comprising the operation described in any one of claims 1 to 28.

31. A system comprising at least one device including a hardware processor, configured to perform the operations described in any one of claims 1 to 28.

32. A system comprising means for performing the operation described in any one of claims 1 to 28.

Images