Cloud Access Credential Authorization via Stateless Certificate Validation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing cloud computing systems face challenges in efficiently authorizing access credentials for network entities due to the need for storing and managing session state information for each network entity accessing cloud resources, which increases administrative operations and complexity.

Innovation Solution

Implementing a stateless validation protocol using digital certificates that contain session state information, allowing credential requests to be authorized without storing public keys on the target service, and periodically rotating asymmetric key pairs and digital certificates to maintain security.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If the service stores public keys for each network entity to validate credential requests, then the authorization process can be completed, but the administrative operations and system complexity increase

Engineering Contradiction:

Improveauthorization validityVSAvoidsession state management complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent extracts the session state information from the service's storage system and embeds it directly into digital certificates issued to network entities. The certificate contains the entity's public key and authentication tokens, allowing the service to validate credentials without storing entity-specific state information.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

Instead of storing the actual public keys in the service's session state, the system uses digital certificates that contain copies of the public keys and authentication information. These certificates are issued to network entities and presented during credential requests, eliminating the need for the service to maintain persistent storage of entity credentials.

Inventive Principle:

Principle #26Copying

2Ease of operation

If the service stores and manages session state information for each network entity, then credential authorization can be performed, but the administrative operations increase

Engineering Contradiction:

Improvecredential authorizationVSAvoidsession state information management

Core Design Contradiction:

Ease of operationVSDevice complexity

Solution Approach 1:

Network entities obtain their own digital certificates from a certificate authority and use them to authenticate themselves when requesting credentials. The entities self-manage their authentication materials rather than relying on the service to store and manage their session state, reducing the service's administrative burden.

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

A certificate authority acts as an intermediary between the service and network entities. The CA issues digital certificates that contain entity identification and public keys, serving as a trusted mediator that eliminates the need for the service to directly store or manage entity session state information.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Reliability

If public keys are stored for each network entity, then access credential requests can be validated, but the security risk increases due to potential exposure of session state information

Engineering Contradiction:

Improvecredential validationVSAvoidsecurity vulnerability

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The system uses short-lived digital certificates with limited validity periods instead of permanently storing public keys. Each certificate is issued for a specific time window and purpose, and after use or expiration, the service does not retain the entity's authentication information, reducing the window of opportunity for security breaches.

Inventive Principle:

Principle #27Cheap short-living objects (Disposable)

Data Source

PatentUS12438733B2Authorizing requests for access credentials, for accessing cloud resources, based on successful stateless validation of digital certificates

Publication Date: 2025.10.07 ORACLE INT CORP

AI summary

Operations of a system may include executing a provisioning process that includes provisioning a network entity with a digital certificate for use in a stateless validation protocol. After provisioning the network entity with the digital certificate, the system may include receive a credential request from the network entity that includes the digital certificate and a request for an access credential for accessing a cloud resource. In response to the credential request, the system may execute an access-authorization process with respect to the network entity, including authenticating the digital certificate in accordance with the stateless validation protocol. Upon determining that the network entity authorized to receive an access credential, the system may provision the network entity with the access credential. The network entity may then use the access credential to access the cloud resource.