Granted Patent B2

US 12,531,856 · App. 18/488,133 · Granted Jan 20, 2026

Inventors: Archana Babu Rajendran (Tamil Nadu, IN); Harshit Agarwal (Bengaluru, IN); Vishal Mishra (Odisha, IN); Mauruthi Geetha Mohan (Seattle, WA); Kranthi Kumar Bathula (Sammamish, WA)

Assignee: Oracle International Corporation

H04L63/0846H04L63/102H04L63/20

Abstract

Claims (66)

1 . A cloud-based method of rotating a secret stored in a secrets storage of a cloud-based infrastructure and stored in a target system, the method comprising:

receiving an identifier of a function for rotating the secret or an identifier of the target system when the target system comprises a management Application Programming Interface (API) for rotating the secret;

determining that the secret needs to be rotated based on a rotating schedule;

when the identifier of the function is received, rotating the secret using the function; and

when the identifier of the target system is received, rotating the secret using the management API;

wherein rotating the secret comprises updating the secret at the secrets storage and at the target system;

wherein the rotating the secret using the function comprises verifying a connection to the target system, creating a pending version of a first new secret; updating the target system with the first new secret and promoting the pending version of the first new secret to a current secret at the secrets storage.

2 . The method of claim 1 , wherein the rotating the secret using the management API comprises:

generating a second new secret as a pending secret in the secrets storage;

updating the target system with the pending secret using the management API; and

switching a state of the second new secret from pending to active in the secrets storage.

3 . The method of claim 2 , wherein the target system is an autonomous database.

4 . The method of claim 1 , wherein the cloud-based infrastructure comprises a first virtual cloud network (VCN) comprising a local peering gateway (LPG) communicatively coupled to a secure shell (SSH) VCN via the LPG;

wherein the LPG is contained in a control plane VCN and the SSH VCN is communicatively coupled to a data plane VCN.

5 . The method of claim 1 , wherein the secret comprises one of a database password, identity username/password or a private key.

6 . The method of claim 1 , further comprising:

receiving a first account and a second account from a user, the first account and second account having identical permissions, the first account having a current version secret and the second account having a previous version secret;

storing the current version secret and the previous version secret at the secret storage corresponding to a same secret;

creating a pending version secret corresponding to the same secret;

connecting to the target system using the previous version secret; and

updating the target system to use the pending version secret.

7 . The method of claim 1 , further receiving a rotation interval comprising a frequency for rotating the secret.

8 . A non-transitory computer readable medium having instructions stored thereon that, when executed by one or more processors, cause the processors to provide a cloud-based rotating of a secret stored in a secrets storage of a cloud-based infrastructure and stored in a target system, the rotating comprising:

receiving an identifier of a function for rotating the secret or an identifier of the target system when the target system comprises a management Application Programming Interface (API) for rotating the secret;

determining that the secret needs to be rotated based on a rotating schedule;

when the identifier of the function is received, rotating the secret using the function; and

when the identifier of the target system is received, rotating the secret using the management API;

wherein rotating the secret comprises updating the secret at the secrets storage and at the target system;

wherein the rotating the secret using the function comprises verifying a connection to the target system, creating a pending version of a first new secret; updating the target system with the first new secret and promoting the pending version of the first new secret to a current secret at the secrets storage.

9 . The computer readable medium of claim 8 , wherein the rotating the secret using the management API comprises:

generating a second new secret as a pending secret in the secrets storage;

updating the target system with the pending secret using the management API; and

switching a state of the second new secret from pending to active in the secrets storage.

10 . The computer readable medium of claim 9 , wherein the target system is an autonomous database.

11 . The computer readable medium of claim 8 , wherein the cloud-based infrastructure comprises a first virtual cloud network (VCN) comprising a local peering gateway (LPG) communicatively coupled to a secure shell (SSH) VCN via the LPG;

wherein the LPG is contained in a control plane VCN and the SSH VCN is communicatively coupled to a data plane VCN.

12 . The computer readable medium of claim 8 , wherein the secret comprises one of a database password, identity username/password or a private key.

13 . The computer readable medium of claim 8 , the rotating further comprising:

receiving a first account and a second account from a user, the first account and second account having identical permissions, the first account having a current version secret and the second account having a previous version secret;

storing the current version secret and the previous version secret at the secret storage corresponding to a same secret;

creating a pending version secret corresponding to the same secret; connecting to the target system using the previous version secret; and

updating the target system to use the pending version secret.

14 . The computer readable medium of claim 8 , further receiving a rotation interval comprising a frequency for rotating the secret.

15 . A cloud-based secret rotation system comprising:

a secrets storage;

a communications link to a target system;

one or more processors executing instructions and configured to:

receive an identifier of a function for rotating the secret or an identifier of the target system when the target system comprises a management Application Programming Interface (API) for rotating the secret;

determine that the secret needs to be rotated based on a rotating schedule;

when the identifier of the function is received, rotate the secret using the function; and

when the identifier of the target system is received, rotate the secret using the management API;

wherein rotating the secret comprises updating the secrets at the secret storage and at the target system;

wherein the rotating the secret using the function comprises verifying a connection to the target system, creating a pending version of a first new secret; updating the target system with the first new secret and promoting the pending version of the first new secret to a current secret at the secrets storage.

16 . The system of claim 15 , wherein the rotating the secret using the management API comprises:

generating a second new secret as a pending secret in the secrets storage;

updating the target system with the pending secret using the management API; and

switching a state of the second new secret from pending to active in the secrets storage.

17 . The system of claim 16 , wherein the target system is an autonomous database.

18 . The system of claim 15 , wherein the system is executed on a cloud infrastructure, the cloud infrastructure comprising a first virtual cloud network (VCN) comprising a local peering gateway (LPG) communicatively coupled to a secure shell (SSH) VCN via the LPG;

wherein the LPG is contained in a control plane VCN and the SSH VCN is communicatively coupled to a data plane VCN.

19 . The system of claim 15 , wherein the secret comprises one of a database password, identity username/password or a private key.

20 . The system of claim 15 , further comprising:

receiving a first account and a second account from a user, the first account and second account having identical permissions, the first account having a current version secret and the second account having a previous version secret;

storing the current version secret and the previous version secret at the secret storage corresponding to a same secret;

creating a pending version secret corresponding to the same secret; connecting to the target system using the previous version secret; and

updating the target system to use the pending version secret.

Assignments (1)

Continuity (1)

References Cited (34)