Agent-Based Certificate Scanning for Valid Cloud Traffic Distribution

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing cloud-based systems face inefficiencies and revenue loss due to invalid certificates in computing resources, lacking an effective method to determine and remediate such issues.

Innovation Solution

Implementing an intermediary computer system instance to scan and manage certificates, distributing computational load from the certificate authority, and using a load balancer to ensure only instances with valid certificates receive data, while allowing instances with invalid certificates to update their certificates in parallel.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If the certificate authority scans all computing resource instances to verify certificates, then certificate validity can be determined, but the computational load on the certificate authority increases and system efficiency decreases

Engineering Contradiction:

Improvecertificate validity determinationVSAvoidsystem efficiency

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The patent divides the certificate scanning function into two segments: computing resource instances perform self-scanning of their own certificates, while the certificate authority maintains a centralized list of valid certificates. This segmentation reduces the computational burden on the certificate authority while maintaining reliable certificate validation through distributed participation.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent introduces an intermediary mechanism where computing resource instances act as intermediaries by scanning their own certificates and reporting to the certificate authority. This intermediary approach allows the certificate authority to verify certificate validity without directly scanning all instances, thereby maintaining reliability while improving system efficiency.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Duration of action of stationary object

If computing resources with invalid certificates continue to operate, then service availability is maintained, but revenue is lost due to inefficient resource utilization

Engineering Contradiction:

Improveservice availabilityVSAvoidrevenue loss

Core Design Contradiction:

Duration of action of stationary objectVSLoss of energy

Solution Approach 1:

The patent implements a feedback mechanism where computing resource instances provide feedback about their certificate validity status to the certificate authority. The certificate authority then uses this feedback information to generate a list of valid certificates and communicates this back to instances. This feedback loop enables the system to identify and exclude invalid certificates from service allocation, maintaining availability while preventing revenue loss from inefficient resources.

Inventive Principle:

Principle #23Feedback

Solution Approach 2:

The patent applies preliminary action by having computing resource instances scan their own certificates before being allocated services. This preliminary certificate verification ensures that only resources with valid certificates are included in the service allocation pool, preventing revenue loss from invalid certificates while maintaining service availability through proactive rather than reactive validation.

Inventive Principle:

Principle #10Preliminary action

3Reliability

If the certificate authority centrally manages all certificates, then certificate validity can be uniformly enforced, but the complexity of the system increases

Engineering Contradiction:

Improvecertificate validity enforcementVSAvoidsystem complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent segments the certificate management function by having each computing resourceinstance perform its own certificate scanning and self-validation. This distributes the complexity away from a centralized certificate authority, reducing overall system complexity while maintaining reliable certificate enforcement through the distributed self-scanning mechanism.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent implements self-service by having computing resource instances autonomously scan their own certificates and manage their own certificate validity status. This self-service approach eliminates the need for complex centralized management systems, reducing system complexity while maintaining reliable certificate enforcement through instance-level autonomy.

Inventive Principle:

Principle #25Self-service

Data Source

PatentUS12355755B2Network traffic distribution using certificate scanning in agent-based architecture

Publication Date: 2025.07.08 AMAZON TECH INC

AI summary

Systems and methods are disclosed herein for determining the validity of certificates possessed by a plurality of computer system instances operating under a service of a computing resource service provider. A certificate authority may hold an election to determine an intermediary computer system instance among the plurality of computer system instances to communicate between the certificate authority and the plurality of computer system instances. The intermediary instance may receive a set of certificate fingerprints from the plurality of computer system instances. The intermediary instance may compare the set of certificate fingerprints to a valid certificate fingerprint generated using a valid certificate to determine the validity of certificates possessed by the plurality of computer system instances. The intermediary instance may generate a report based on the determination of the validity of the certificates. The certificate authority may modify the instances operating under the service based on the report.