Virtual Cloud Network Certificate Updates with Self-Validation

Solution Overview

Problem

Existing systems in virtual cloud networks face challenges in updating digital certificates without causing downtime, especially when transitioning between operating system images, and require inefficient resource usage and prolonged provisioning times.

Innovation Solution

A method for distributing updated certificate bundles that includes a combination of current and new CA certificates, with self-validation processes ensuring compatibility before installation, thereby avoiding downtime and reducing resource consumption.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If digital certificates are updated in virtual cloud networks, then security is improved, but downtime occurs and provisioning time increases

Engineering Contradiction:

ImprovesecurityVSAvoiddowntime

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The system performs preliminary actions by creating and validating new certificate bundles before the old certificates expire. The new certificate authority (CA) is established in advance, and certificate bundles are prepared and distributed to network entities before the transition, ensuring that updates occur without downtime or service interruption.

Inventive Principle:

Principle #10Preliminary action

2Reliability

If digital certificates are updated in virtual cloud networks, then security is improved, but provisioning time increases

Engineering Contradiction:

ImprovesecurityVSAvoidprovisioning time

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The system performs preliminary actions by creating and validating new certificate bundles before the old certificates expire. The new certificate authority (CA) is established in advance, and certificate bundles are prepared and distributed to network entities before the transition, ensuring that updates occur without downtime or service interruption.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

Network entities perform self-validation of certificate bundles using their existing certificates and public keys. This automated validation process eliminates the need for manual verification and reduces provisioning time, as each entity can independently verify the validity of new certificates against their stored reference data.

Inventive Principle:

Principle #25Self-service

3Reliability

If certificate validation is performed before installation, then compatibility is ensured, but resource consumption increases

Engineering Contradiction:

ImprovecompatibilityVSAvoidresource consumption

Core Design Contradiction:

ReliabilityVSUse of energy by moving object

Solution Approach 1:

Network entities perform self-validation of certificate bundles using their existing certificates and public keys. This automated validation process eliminates the need for manual verification and reduces provisioning time, as each entity can independently verify the validity of new certificates against their stored reference data.

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

The system performs validation only on the critical aspects of certificate compatibility using existing validation logic and stored reference data. Rather than comprehensive re-validation of all certificate properties, the system checks essential elements such as signature verification against stored public keys and expiration dates, reducing computational overhead while ensuring sufficient compatibility.

Inventive Principle:

Principle #16Partial or excessive action

Data Source

PatentUS12401526B2Updating digital certificates associated with a virtual cloud network

Publication Date: 2025.08.26 ORACLE INT CORP

AI summary

Techniques for updating certificate bundles may include receiving, at an entity associated with a virtual cloud network, a certificate bundle that includes an updated set of certificate authority (CA) certificates. The techniques may include applying a validation process to an entity certificate based on the certificate bundle, with the entity certificate having been issued to the entity prior to the entity receiving the certificate bundle. The validation process may include validating, by the entity, a certificate chain that includes the entity certificate and a CA certificate included in the updated set of CA certificates. The techniques may include, responsive to validating the certificate chain, installing the certificate bundle in a storage medium associated with the entity, and utilizing, by the entity, the certificate bundle to authenticate at least one additional entity associated with the virtual cloud network.