IP Library › Granted Patent US 12695603
Granted Patent B2
US 12695603 · App. 18/789,436 · Granted Jul 28, 2026

Key reuse in a cloud environment

Inventors: Peter Martin Hanily (Dublin, IE); Ryan Daniel Schilcher (Seattle, WA); Christopher Robert Baker (Nashua, NH); Jonathan Philip Taimanglo (Arlington, VA)
Assignee: Oracle International Corporation
H04L9/0825H04L9/0844
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 12695603
App. No.
18/789,436
Granted
Jul 28, 2026
Kind
B2
Abstract

Techniques for detected reuse of a public key of a public/private cryptographic key pair within a cloud environment are disclosed. A database maintained within a cloud environment is accessed, the database storing a plurality of public keys. Each public key has a corresponding attribute, and the database further stores a plurality of attributes corresponding to the plurality of public keys. Each public key is associated with either (i) a corresponding user account of a corresponding tenancy of the cloud environment or (ii) a compute instance hosted within a corresponding tenancy of the cloud environment. A number of times a first public key or a first attribute corresponding to the first public key occurring within the database is determined. Responsive to the number of times being equal to or greater than a threshold number, the first public key is tagged as being reused for at least the threshold number of times.

Claims (46)

1 . A method comprising:

accessing a database maintained within a cloud environment, the database storing a plurality of public keys, wherein each public key has a corresponding fingerprint, and the database further storing a plurality of fingerprints corresponding to the plurality of public keys, and wherein each public key is associated with either (i) a corresponding user account of a corresponding tenancy of the cloud environment or (ii) a compute instance hosted within a corresponding tenancy of the cloud environment;

determining a number of occurrences of a first public key or a first fingerprint corresponding to the first public key within the database, wherein each occurrence corresponds to a current association of the first public key or the first fingerprint for a respective cloud resource, such that the number of occurrences corresponds to a number of different cloud resources with which the first public key or the first fingerprint is simultaneously associated, each cloud resource comprising a distinct user account or a distinct compute instance, and wherein each occurrence corresponds to association of a user-provided version of the first public key with a respective cloud resource;

determining that the number of occurrences is equal to or greater than a threshold number;

tagging the first public key as being reused for at least the threshold number of occurrences; and

generating an output indicating that the first public key is being reused for at least the threshold number of occurrences.

2 . The method of claim 1 , wherein the threshold number is a positive integer that is greater than one.

3 . The method of claim 1 , wherein determining the number of occurrences of the first public key or the first fingerprint corresponding to the first public key within the database comprises:

determining that (i) a first occurrence of the first public key or the first fingerprint is associated with a first user account of a first tenancy of the cloud environment, and (ii) a second occurrence of the first public key or the first fingerprint is associated with a second user account of a second tenancy of the cloud environment.

4 . The method of claim 3 , wherein the first tenancy and the second tenancy are different tenancies of the cloud environment.

5 . The method of claim 4 , wherein the first tenancy and the second tenancy are rented out to a same cloud customer, or rented out to a first cloud customer and a second cloud customer, respectively.

6 . The method of claim 3 , wherein the first tenancy and the second tenancy are a same tenancy of the cloud environment.

7 . The method of claim 1 , wherein determining the number of occurrences of the first public key or the first fingerprint corresponding to the first public key within the database comprises:

determining that (i) a first occurrence of the first public key or the first fingerprint is associated with a first compute instance hosted within a first tenancy of the cloud environment, and (ii) a second occurrence of the first public key or the first fingerprint is associated with a second compute instance hosted within a second tenancy of the cloud environment.

8 . The method of claim 7 , wherein the first tenancy and the second tenancy are different tenancies of the cloud environment, or a same tenancy of the cloud environment.

9 . The method of claim 1 , wherein determining the number of occurrences of the first public key or the first fingerprint corresponding to the first public key within the database comprises:

determining that (i) a first occurrence of the first public key or the first fingerprint is associated with a user account of a first tenancy of the cloud environment, and (ii) a second occurrence of the first public key or the first fingerprint is associated with a compute instance hosted within a second tenancy of the cloud environment.

10 . The method of claim 9 , wherein the first tenancy and the second tenancy are different tenancies of the cloud environment, or a same tenancy of the cloud environment.

11 . The method of claim 1 , wherein the first fingerprint is generated from the first public key by applying a hash function to the first public key.

12 . The method of claim 1 , wherein the first public key is associated with at least (i) a first user account or (ii) a first compute instance, and wherein the method further comprises:

responsive at least in part to the output indicating that the first public key is being reused for at least the threshold number of occurrences, prompting a user of the first user account or the first compute instance to associate a public key, which is different from the first public key, with the first user account or the first compute instance.

13 . The method of claim 1 , wherein the threshold number is a low threshold number, and wherein the method further comprises:

determining that the number of occurrences is equal to or greater than a high threshold number that is greater than the low threshold number; and

generating a request to deactivate or delete one or more user accounts or one or more compute instances associated with the first public key.

14 . The method of claim 1 , further comprising:

receiving a request to open a first user account or host a first compute instance, the request accompanied by the first public key; and

responsive at least in part to (i) the first public key being tagged for being reused for at least the threshold number of occurrences and (ii) receiving the request, rejecting the request and requesting an association of a public key, which is different from the first public key, with the first user account or the first compute instance.

15 . The method of claim 1 , wherein the database stores the plurality of public keys and the plurality of fingerprints for a single tenancy of the cloud environment.

16 . The method of claim 1 , wherein the database stores the plurality of public keys and the plurality of fingerprints for a plurality of tenancies of the cloud environment.

17 . A non-transitory computer-readable medium including instructions that when executed by one or more processors, cause the one or more processors to perform operations including:

accessing a database maintained within a cloud environment, the database storing a plurality of public keys, wherein each public key has a corresponding fingerprint, and the database further storing a plurality of fingerprints corresponding to the plurality of public keys, and wherein each public key is associated with either (i) a corresponding user account of a corresponding tenancy of the cloud environment or (ii) a compute instance hosted within a corresponding tenancy of the cloud environment;

determining a number of occurrences of a first public key or a first fingerprint corresponding to the first public key within the database, wherein each occurrence corresponds to a current association of the first public key or the first fingerprint for a respective cloud resource, such that the number of occurrences corresponds to a number of different cloud resources with which the first public key or the first fingerprint is simultaneously associated, each cloud resource comprising a distinct user account or a distinct compute instance, and wherein each occurrence corresponds to association of a user-provided version of the first public key with a respective cloud resource;

determining that the number of occurrences is equal to or greater than a threshold number;

tagging the first public key as being reused for at least the threshold number of occurrences; and

generating an output indicating that the first public key is being reused for at least the threshold number of occurrences.

18 . The non-transitory computer-readable medium of claim 17 , wherein the database one of (i) stores the plurality of public keys and the plurality of fingerprints for a single tenancy of the cloud environment, or (ii) stores the plurality of public keys and the plurality of fingerprints for a plurality of tenancies of the cloud environment.

19 . A system comprising:

one or more processors;

a storage repository including a database for storing a plurality of public keys, wherein each public key has a corresponding fingerprint, and the database for further storing a plurality of fingerprints corresponding to the plurality of public keys, and wherein each public key is associated with either (i) a corresponding user account of a corresponding tenancy of a cloud environment or (ii) a compute instance hosted within a corresponding tenancy of the cloud environment; and

one or more non-transitory computer-readable media storing instructions, which, when executed by the system, cause the system to perform a set of actions including:

accessing the database;

determining a number of occurrences of a first public key or a first fingerprint corresponding to the first public key within the database, wherein each occurrence corresponds to a current association of the first public key or the first fingerprint for a respective cloud resource, such that the number of occurrences corresponds to a number of different cloud resources with which the first public key or the first fingerprint is simultaneously associated, each cloud resource comprising a distinct user account or a distinct compute instance, and wherein each occurrence corresponds to association of a user-provided version of the first public key with a respective cloud resource;

determining that the number of occurrences is equal to or greater than a threshold number;

tagging the first public key as being reused for at least the threshold number of occurrences; and

generating an output indicating that the first public key is being reused for at least the threshold number of occurrences.

20 . The system of claim 19 , wherein the database one of (i) stores the plurality of public keys and the plurality of fingerprints for a single tenancy of the cloud environment, or (ii) stores the plurality of public keys and the plurality of fingerprints for a plurality of tenancies of the cloud environment.