Techniques for validating cloud regions built at a prefab factory

Patent metadata

Field	Value
Publication number	US-12481795-B2
Application number	US-202318122675-A
Country	US
Kind code	B2
Filing date	Mar 16, 2023
Priority date	Mar 16, 2023
Publication date	Nov 25, 2025
Grant date	Nov 25, 2025

Abstract

Techniques are disclosed for validating a cloud region built at a prefab factory. A computing device of the cloud region can receive a network configuration from a manager service. The network configuration can correspond to a network topology of physical resources in the cloud region and can include a first identifier associated with a computing device, a second identifier associated with a neighboring computing device, and information associating the computing device with the neighboring computing device. The computing device can be configured for transmitting to a second data center and can boot into a test mode at the second data center and receive a new identifier from a server device. The computing device can verify the new identifier and send a validation request to the neighboring computing device. The computing device can validate a network connection to the neighboring computing device based on a response to the validation request.

First claim

What is claimed is:

1 . A method, comprising:
receiving, at a computing device from a manager service, a network configuration corresponding to a network topology of physical resources in a first data center, the network configuration comprising a first identifier associated with the computing device, a second identifier associated with a neighboring computing device, and information associating the computing device with the neighboring computing device, and the physical resources comprising the computing device and the neighboring computing device; receiving, from the manager service, an indication; responsive to the indication from the manager service, configuring the computing device for shipping to a second data center; booting the computing device into a test mode at the second data center; receiving, by the computing device from a server device at the second data center, a new identifier; verifying, by the computing device using the network configuration, the new identifier by comparing the new identifier with the first identifier; sending, by the computing device, a validation request to the neighboring computing device, the validation request sent according to the second identifier associated with the neighboring computing device; and validating, by the computing device, a network connection to the neighboring computing device based on a response to the validation request, wherein the network connection is characterized by the network configuration.

2 . The method of claim 1 , wherein configuring the computing device for shipping to a second data center comprises:
encrypting, using a second encryption key associated with the neighboring computing device, a second data volume of the neighboring computing device; storing, in a first data volume of the computing device, the second encryption key; encrypting, using a first encryption key associated with the computing device, the first data volume of the computing device; and storing the first encryption key at a secure storage volume communicatively connected to the computing device.

3 . The method of claim 2 , wherein the response to the validation request comprises a validation indication received from the neighboring computing device, and further comprising:
responsive to the validation indication, obtaining, by the computing device, the first encryption key from the secure storage volume; decrypting the first data volume of the computing device; receiving a key request from the neighboring computing device; responsive to the key request, obtaining, by the computing device, the second encryption key from the first data volume; and sending the second encryption key to the neighboring computing device.

4 . The method of claim 2 , wherein storing the first encryption key at the secure storage volume communicatively connected to the computing device comprises storing the first encryption key at a smart network interface card connected to the computing device.

5 . The method of claim 2 , wherein storing the first encryption key at the secure storage volume communicatively connected to the computing device comprises storing the first encryption key at a hardware security module connected to the computing device.

6 . The method of claim 1 , further comprising:
configuring the neighboring computing device for shipping to the second data center by at least generating, by the manager service, a device snapshot comprising a software image of the neighboring computing device; determining, based at least in part on the response to the validation request, that the neighboring computing device is non-functional; based at least in part on the determination that the neighboring computing device is non-functional, generating, by the manager service, instructions usable to replace the neighboring computing device with a functional neighboring computing device at the second data center; configuring, by the manager service, the functional neighboring computing device with the device snapshot; sending, by the computing device, an additional validation request to the functional neighboring computing device; and revalidating, by the computing device, the network connection to the functional neighboring computing device.

7 . The method of claim 1 , wherein receiving the validation indication from the neighboring computing device comprises receiving an acknowledgement that the validation request was successfully sent to the neighboring computing device using the second identifier.

8 . The method of claim 1 , further comprising responsive to the validation indication, sending, by the computing device to the manager service, a further indication that the computing device was successfully installed at the second data center.

9 . The method of claim 1 , wherein booting the computing device into the test mode comprises booting from a boot volume stored on a smart network interface card connected to the computing device.

10 . A computing system, comprising:
one or more processors; and one or more memories storing computer-executable instructions that, when executed by the one or more processors, cause the computing system to:
receive, from a manager service, a network configuration corresponding to a network topology of physical resources in a first data center, the network configuration comprising a first identifier associated with a computing device, a second identifier associated with a neighboring computing device, and information associating the computing device with the neighboring computing device, and the physical resources comprising the computing device and the neighboring computing device;
receiving, from the manager service, an indication;
responsive to the indication from the manager service, configure the computing device for shipping to a second data center;
boot the computing device into a test mode at the second data center;
receive, at the computing device from a server device at the second data center, a new identifier;
verify, using the network configuration, the new identifier by comparing the new identifier with the first identifier;
send, by the computing device, a validation request to the neighboring computing device, the validation request sent according to the second identifier associated with the neighboring computing device; and
validate, by the computing device, a network connection to the neighboring computing device based on a response to the validation request, wherein the network connection is characterized by the network configuration.

11 . The computing system of claim 10 , wherein configuring the computing device for shipping to a second data center comprises:
encrypting, using a second encryption key associated with the neighboring computing device, a second data volume of the neighboring computing device; storing, in a first data volume of the computing device, the second encryption key; encrypting, using a first encryption key associated with the computing device, the first data volume of the computing device; and storing the first encryption key at a secure storage volume communicatively connected to the computing device.

12 . The computing device of claim 11 , wherein the response to the validation request comprises a validation indication received from the neighboring computing device, and wherein the one or more memories store additional instructions that, when executed by the one or more processors, cause the computing system to further:
obtain, in response to the validation indication, the first encryption key from the secure storage volume; decrypt the first data volume of the computing device; receive a key request from the neig

Assignees

• Oracle Int Corp

Inventors

• Adogla Eden
• Kuehnel Thomas Werner
• Gartrell John Ryan

Classifications

• G06F21/78

  to assure secure storage of data (address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00) · CPC title

• G06F9/4416

  Network booting; Remote initial program loading [RIPL] · CPC title

• H04L9/0897 Primary

  involving additional devices, e.g. trusted platform module [TPM], smartcard or USB · CPC title

• G06F21/73 Primary

  by creating or determining hardware identification, e.g. serial numbers · CPC title