Granted Patent B2

US 12,726,365 · App. 18/648,025 · Granted Sep 1, 2026

Inventors: Jeremiah David Small (Wesford, MA); Alexander Chebaturkin (Seattle, WA); Yavor Tashev (Issaquah, WA); Siddharth Satish Shenoy (Sammamish, WA); Thom Dixon (Kent, WA); Xin Xu (Redmond, WA)

Assignee: Oracle International Corporation

H04L9/3263H04L63/0807

Abstract

Claims (76)

1 . One or more non-transitory computer readable media comprising instructions which, when executed by one or more hardware processors, cause performance of operations comprising:

receiving, at a certificate authority, a certificate signing request associated with an operator device, wherein the certificate signing request includes a user identifier associated with the operator device, and a first resource identifier associated with one or more target hosts;

wherein the first resource identifier comprises at least one of: (a) a host name; or (b) a host class;

wherein the certificate signing request comprises a token that substantiates that an authentication action was successfully completed;

forming a first target-specific principal comprising the user identifier and the first resource identifier;

verifying an entitlement of the first target-specific principal based on a set of access data;

at least in response to verifying the entitlement of the first target-specific principal: generating a certificate, wherein the certificate comprises the first target-specific principal, and the certificate is signed by the certificate authority; and

transmitting the certificate in response to the certificate signing request.

2 . The non-transitory computer-readable media of claim 1 , wherein verifying an entitlement of the first target-specific principal based on a set of access data comprises:

identifying, from the set of access data, a set of one or more authorized principals, each comprising a respective user identifier and a respective resource identifier;

determining a match between the first target-specific principal and an authorized principal of the set of authorized principals, wherein a match comprises matching a string that comprises the user identifier of the first target-specific principal and the resource identifier of the first target-specific principal with a second string that comprises user identifier of the authorized principal and the resource identifier of the authorized principal.

3 . The non-transitory computer-readable media of claim 1 , wherein validating the first principal against the set of access data comprises:

identifying, from the set of access data, a set of one or more authorized principals, each comprising a respective user identifier and a respective resource identifier;

determining a match between the first target-specific principal and an authorized principal of the set of authorized principals, wherein a match comprises (a) a first match between the user identifier of the first target-specific principal and the user identifier of the authorized principal and (b) a second match between the resource identifier of the first target-specific principal and the resource identifier of the authorized principal.

4 . The non-transitory computer-readable media of claim 1 , wherein the certificate signing request includes a second resource identifier, the operations further comprising:

forming a second target-specific principal comprising the user identifier and the second resource identifier;

validating a second principal against the set of access data, the second principal comprising the user identifier and the second resource identifier;

wherein the certificate comprises the second principal.

5 . The non-transitory computer-readable media of claim 1 , wherein the certificate signing request includes a third resource identifier, the operations further comprising:

determining that a third principal is not valid when compared against the set of access data, the third principal comprising the user identifier and the third resource identifier;

wherein the certificate does not include the third principal.

6 . The non-transitory computer-readable media of claim 1 , wherein the certificate forms a basis for opening a secure connection between the operator device and a target host associated with the first resource identifier.

7 . The non-transitory computer-readable media of claim 6 , wherein the operations further comprise:

receiving, at the target host, (a) a secure remote access request, associated with the operator device, to open a secure connection with the target host, and (b) the certificate;

determining that the certificate is signed by a trusted certificate authority;

performing, at the target host, a validation to determine whether the principal is authorized to access the target host;

at least in response to determining that the principal has authorization to access the target host: granting the secure remote access request to open the secure connection.

8 . The non-transitory computer-readable media of claim 7 , wherein performing a validation to determine whether the principal is authorized to access the target host comprises:

identifying, from the set of access data, a set of one or more authorized principals;

determining that the principal corresponds to at least one authorized principal of the set of authorized principals.

9 . The non-transitory computer-readable media of claim 7 , wherein the secure remote access request is received from a connection agent, and the operations further comprise:

receiving, at the connection agent, a command to initiate a first secure remote access connection to the target host, wherein the command is received from the operator device;

transmitting the certificate signing request on behalf of the operator device to the certificate authority, wherein the certificate signing request further comprises a first operator device public key;

receiving, at the connection agent, the certificate from the certificate authority;

wherein the certificate is signed by the certificate authority using a certificate authority public key;

wherein the certificate further comprises the operator device public key and the first target-specific principal;

initiating, by the connection agent, a first secure remote access connection between the operator device and the target host, using the first certificate.

10 . The non-transitory computer-readable media of claim 1 , wherein the certificate comprises an expiration indicator that specifies or references an expiration time.

11 . The non-transitory computer-readable media of claim 1 , wherein the certificate signing request further comprises a public key of a key pair associated with the operator device, the certificate comprises the public key, and an access request substantiated using the certificate is signed with a private key of the key pair associated with the operator device.

12 . The non-transitory computer-readable media of claim 1 , wherein the certificate further comprises one or more tenancy identifiers related to a cloud infrastructure environment.

13 . The non-transitory computer-readable media of claim 1 , wherein the certificate further comprises a user identifier related to a cloud infrastructure environment.

14 . A method, comprising:

receiving, at a certificate authority, a certificate signing request associated with an operator device, wherein the certificate signing request includes a user identifier associated with the operator device, and a first resource identifier associated with one or more target resources;

wherein the first resource identifier comprises at least one of: (a) a host name; or (b) a host class;

wherein the certificate signing request comprises a token that substantiates that an authentication action was successfully completed;

forming a first target-specific principal comprising the user identifier and the first resource identifier;

verifying an entitlement of the first target-specific principal based on a set of access data;

at least in response to verifying the entitlement of the first target-specific principal: generating a certificate, wherein the certificate comprises the first target-specific principal, and the certificate is signed by the certificate authority; and

transmitting the certificate in response to the certificate signing request;

wherein the method is performed on one or more devices, each comprising a hardware processor.

15 . The method of claim 14 , wherein verifying an entitlement of the first target-specific principal based on a set of access data comprises:

identifying, from the set of access data, a set of one or more authorized principals, each comprising a respective user identifier and a respective resource identifier;

determining a match between the first target-specific principal and an authorized principal of the set of authorized principals, wherein a match comprises matching a string that comprises the user identifier of the first target-specific principal and the resource identifier of the first target-specific principal with a second string that comprises user identifier of the authorized principal and the resource identifier of the authorized principal.

16 . The method of claim 14 , wherein validating the first principal against the set of access data comprises:

identifying, from the set of access data, a set of one or more authorized principals, each comprising a respective user identifier and a respective resource identifier;

determining a match between the first target-specific principal and an authorized principal of the set of authorized principals, wherein a match comprises (a) a first match between the user identifier of the first target-specific principal and the user identifier of the authorized principal and (b) a second match between the resource identifier of the first target-specific principal and the resource identifier of the authorized principal.

17 . The method of claim 14 , wherein the certificate signing request includes a second resource identifier, the method further comprising:

forming a second target-specific principal comprising the user identifier and the second resource identifier;

validating a second principal against the set of access data, the second principal comprising the user identifier and the second resource identifier;

wherein the certificate comprises the second principal.

18 . A system, comprising:

at least one device including a hardware processor;

the system being configured to perform operations comprising:

receiving, at a certificate authority, a certificate signing request associated with an operator device, wherein the certificate signing request includes a user identifier associated with the operator device, and a first resource identifier associated with one or more target resources;

wherein the first resource identifier comprises at least one of: (a) a host name; or (b) a host class;

wherein the certificate signing request comprises a token that substantiates that an authentication action was successfully completed;

forming a first target-specific principal comprising the user identifier and the first resource identifier;

verifying an entitlement of the first target-specific principal based on a set of access data;

at least in response to verifying the entitlement of the first target-specific principal: generating a certificate, wherein the certificate comprises the first target-specific principal, and the certificate is signed by the certificate authority; and

transmitting the certificate in response to the certificate signing request.

19 . The system of claim 18 , wherein verifying an entitlement of the first target-specific principal based on a set of access data comprises:

identifying, from the set of access data, a set of one or more authorized principals, each comprising a respective user identifier and a respective resource identifier;

determining a match between the first target-specific principal and an authorized principal of the set of authorized principals, wherein a match comprises matching a string that comprises the user identifier of the first target-specific principal and the resource identifier of the first target-specific principal with a second string that comprises user identifier of the authorized principal and the resource identifier of the authorized principal.

20 . The system of claim 18 , wherein validating the first principal against the set of access data comprises:

identifying, from the set of access data, a set of one or more authorized principals, each comprising a respective user identifier and a respective resource identifier;

determining a match between the first target-specific principal and an authorized principal of the set of authorized principals, wherein a match comprises (a) a first match between the user identifier of the first target-specific principal and the user identifier of the authorized principal and (b) a second match between the resource identifier of the first target-specific principal and the resource identifier of the authorized principal.

Assignments (1)

Continuity (1)

References Cited (400)