Host-Side Operator Account Provisioning with Certificate Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing IaaS provisioning systems face challenges in efficiently managing the initial setup and evolution of infrastructure, including the configuration of infrastructure components and the establishment of secure connections for accessing target resources, particularly in multi-cloud environments.
Innovation Solution
The implementation of a digital certificate-based system that generates operator accounts, allowing clients to access target resources by validating user principals through a provisioner account and subsequently creating an operator account with appropriate permissions, ensuring secure and controlled access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If a traditional IaaS provisioning system is used, then infrastructure components can be configured and connections established, but the system lacks efficient mechanisms for managing initial setup and infrastructure evolution in multi-cloud environments
Solution Approach 1:
The patent introduces a host account as an intermediary entity between the cloud entity and the infrastructure. The host account receives credentials from the cloud entity and uses them to access target resources, separating the provisioning logic from the resource access logic and simplifying the overall system architecture while improving provisioning efficiency in multi-cloud environments
Solution Approach 2:
The patent segments the access control mechanism into distinct components: cloud entities provision host accounts, host accounts manage infrastructure access, and operator accounts enable resource access. This segmentation allows each component to have specialized functionality, improving productivity without proportionally increasing overall system complexity
2Reliability
If operator accounts are provisioned for clients to access target resources, then secure and controlled access is enabled, but the provisioning process becomes more complex
Solution Approach 1:
The patent implements preliminary action by having the host account pre-configured with the necessary credentials and permissions before the client needs to access resources. The cloud entity provisions the host account with operator account credentials in advance, so that when access is needed, the client can immediately use the pre-configured operator account without undergoing a complex real-time provisioning process
Solution Approach 2:
The host account serves as an intermediary that simplifies the provisioning process between the cloud entity and the client. Instead of the cloud entity directly managing complex provisioning operations for each client, the host account mediates by receiving credentials from the cloud entity and presenting operator accounts to clients, thereby maintaining security while reducing provisioning complexity
Data Source
AI summary
A system includes a host network entity associated with a computing network. The host network entity may establish a first connection with a client network entity via a provisioner account in response to a connection request from a client network entity. The host network entity may receive a digital certificate from the client network entity via the first connection. The digital certificate may include an instruction set with a first instruction to generate an operator account for the client network entity. The host network entity may perform a validation of the digital certificate and the instruction set based on a public key associated with a certificate authority that is trusted by the host network entity, and responsive to the validation, the host network entity may generate the operator account based on the first instruction and establish a second connection with the client network entity via the operator account.