Systems, methods, and computer programs (dynamic resource compliance determination for containerized systems)

Abstract

For crypto assets mounted to pods as files or environment variables, security and compliance can be complex and therefore may be inadequately managed. [Solution] The system may include memory and a processor that communicates with the memory. The processor may be configured to perform operations. The operations may include steps to monitor network actions between resources in a network and steps to extract encrypted data from the network actions. The operations may include steps to detect connection security data from the encrypted data and steps to obtain resource health reports for the resources in the network. The operations may include steps to merge the connection security data with the resource health reports and steps to generate security compliance reports.

Description

Technical Field

[0001] The present disclosure generally relates to container-based environments, and more specifically, to resource deployment in container-based environments.

Background Art

[0002] A container-based environment, architecture, or platform provides a structure for automating the deployment, scaling, and operation of application workloads across one or more clusters of host nodes. A container-based environment may include host nodes that host components of an application workload deployed on a host; the host nodes can be either physical or virtual. A container-based environment may include control nodes that manage the workloads of the cluster and direct communication across the cluster.

[0003] A container-based environment can be used to store various information, including confidential data such as passwords, authorization tokens, and access authentication information. In some container-based environments, secrets are used to securely provide cryptographic certificates and keys to applications. Security certificates, encryption algorithms, and various access controls ensure the security of the confidential data.

Summary of the Invention

Problems to be Solved by the Invention

[0004] For encrypted assets mounted as files or environment variables to a pod, security and compliance can be complicated and thus management can be insufficient.

Means for Solving the Problems

[0005] Embodiments of this disclosure include systems, methods, and computer program products for resource deployment security compliance in container-based environments. Systems according to some embodiments of this disclosure may comprise memory and a processor communicating with said memory. The processor may be configured to perform operations. The operations may include steps for monitoring network actions between resources in a network; and steps for extracting encrypted data from said network actions. The operations may include steps for detecting connectivity security data from said encrypted data and steps for obtaining resource health reports for the resources in the network. The operations may include steps for merging the connectivity security data with the resource health reports and steps for generating security compliance reports.

[0006] The above summary is not intended to describe any of the embodiments or implementations illustrated in this disclosure. [Brief explanation of the drawing]

[0007] The drawings included herein are incorporated herein and form part thereof. They illustrate embodiments of the herein and, together with this description, serve to illustrate the principles of the herein. The drawings are illustrative of specific embodiments and do not limit the herein.

[0008] [Figure 1] This disclosure shows the architecture of a resource deployment system according to several embodiments.

[0009] [Figure 2A] This disclosure provides deployment architectures for resource deployment compliance systems according to several embodiments of this disclosure.

[0010] [Figure 2B] This disclosure presents development architectures for resource deployment compliance systems according to several embodiments.

[0011] [Figure 3] A flowchart of compliance detection using a resource deployment system according to some embodiments of the present disclosure is shown.

[0012] [Figure 4] A playbook for a resource deployment system according to some embodiments of the present disclosure is shown.

[0013] [Figure 5] A compliance report graph according to some embodiments of the present disclosure is shown.

[0014] [Figure 6] A compliance analysis module of a resource deployment compliance system according to some embodiments of the present disclosure is shown.

[0015] [Figure 7] A connection compliance registry for a resource deployment compliance system according to some embodiments of the present disclosure is shown.

[0016] [Figure 8] A computer-implemented resource deployment compliance method according to some embodiments of the present disclosure is shown.

[0017] [Figure 9] A method for a container-based deployment system according to some embodiments of the present disclosure is shown.

[0018] [Figure 10] A computer-implemented method for a container-based deployment system according to some embodiments of the present disclosure is shown.

[0019] [Figure 11]FIG. 1 illustrates an embodiment of a computer system and its components configured to operate in a network environment (including a cloud environment) in which embodiments including the systems and methods described herein can be implemented in accordance with the present disclosure.

[0020] The present invention is applicable to various modifications and alternative forms, and details thereof are shown by way of example in the drawings and will be described in detail. However, it should be understood that there is no intention to limit the present invention to the specific embodiments described. Rather, it is intended to cover all modifications, equivalents, and alternatives falling within the spirit and scope of the present invention.

Best Mode for Carrying Out the Invention

[0021] Aspects of the present disclosure relate to container-based environments, and more particularly, to resource deployment in container-based environments.

[0022] A container-based environment can be used to store various information including sensitive data such as passwords, access and / or authorization tokens (e.g., OAuth tokens), and access authentication information (e.g., SSH keys). A container-based environment, which may also be referred to as a containerized environment or containerized environments, can be, for example, a node, a cluster, or a supercluster. In some container-based environments, secrets are used to securely provide cryptographic certificates and keys to applications. Security certificates, encryption algorithms, and various access controls ensure the security of sensitive data.

[0023] In an exemplary use case for secrets, cryptographic certificates and keys are securely provided to an application. In a containerized environment, crypto assets such as secrets can be made accessible to applications by mounting them to a pod as files or environment variables. However, security and compliance for crypto assets mounted to a pod as files or environment variables can be complex and therefore may be poorly managed. As security threats evolve, it is essential to analyze and ensure the compliance and security of these certificates and keys and address potential issues such as expired certificates, weak cryptographic algorithms, and misconfigured access controls. This disclosure enables security and compliance for containerized systems by identifying and displaying the security and compliance of containerized resources.

[0024] In some embodiments, the disclosure enables the identification and / or indication of whether a containerized resource is security compliant. In some embodiments, the disclosure enables the identification and / or indication of whether a connection between containerized resources is security compliant.

[0025] Administrators may not be aware of whether a containerized deployment is security compliant. Some embodiments of this disclosure may include identifying security compliance issues and displaying any security compliance issues to administrators. In some embodiments, one or more resources with potential risks may be identified. Furthermore, other security concerns may be identified, such as security exploits in certificates and / or keys used by the resource, weak cryptographic algorithms used by the certificates and / or keys used by the resource, and certificates and / or keys configured by the resource to use weak cryptographic algorithms. Identified security concerns may be automatically rectified and / or made known to administrators based on current protocols.

[0026] In some situations, a team may be responsible for developing different components for a product; the product may be too large for the team to manually identify resources within the product that do not comply with current security protocols within the allotted time. In some situations, dependencies between resources may be complex and frequently revised, resulting in a security compliance status that is, ideally, dynamically detected and updated. Aspects of this disclosure may provide solutions for automatically and / or dynamically identifying and displaying security compliance concerns about resources and / or dependencies between resources.

[0027] This disclosure provides, in some embodiments, solutions for identifying, displaying, and / or remediating security compliance concerns by automatically analyzing mounted secrets within a pod, extracting cryptographic certificates and / or keys, and evaluating cryptographic certificates and / or keys against a predefined set of compliance and security rules.

[0028] In some embodiments, the disclosure includes a parameter for representing extended dependencies; this parameter may be referred to as the rdhd parameter. Furthermore, another parameter is introduced for representing a list of resources in a containerized environment as well as resource certificates and / or keys; this parameter may be referred to as the mounted security secret parameter. Resource certificates and / or keys may be evaluated against a predefined set of compliance and security rules.

[0029] In some embodiments, the Disclosure provides a network monitor that monitors network transactions, captures transmission control protocol (TCP) connections within a container environment, identifies both ends of such connections (e.g., resources on both sides of the connection), and stores such connections in a registry (e.g., a connection compliance registry). In some embodiments, the registry functions as a storage space for storing connections between two resources. The registry may mark compliance status as red, yellow, or green; a red compliance status may indicate that the resource and / or connection has a common vulnerability and / or exposure (CVE); a yellow compliance status may indicate that compliance for the resource and / or connection has not been detected; and a green compliance status may indicate that compliance for the resource and / or connection is fully compliant with current security protocols.

[0030] In some embodiments, the Disclosure provides a security compliance handler that parses mounted security secret parameters in a deployment health report graph, extracts cryptographic certificates and / or keys, and evaluates the extracted assets against compliance criteria. Compliance criteria may include, for example, certificate expiration date, key length, encryption algorithm, and others. This information can be used to identify and mark the compliance status of resources. The security compliance handler may generate a security compliance report graph by merging the compliance status of resources in a containerized environment with the compliance status of connections between resources in that environment. The security compliance report graph may include the security compliance status of each resource in the containerized environment and the compliance status of connections between multiple resources in that environment.

[0031] This disclosure enables users to quickly determine the overall security compliance of their resource deployments and to address security issues by using a resource compliance graph to resolve resource security problems. This disclosure provides rapid status updates when compliance violations (e.g., potential security issues) are identified. This disclosure provides a mechanism for automatically alerting administrators regarding compliance violations and security risks.

[0032] This disclosure provides a solution for automatically analyzing mounted secrets within a containerized environment pod, extracting cryptographic certificates and / or keys, and evaluating them against a predefined set of compliance and security rules. This disclosure provides a mechanism for monitoring network connectivity in a containerized environment and detecting security vulnerabilities in connections within that network; in some embodiments, the monitor may detect security vulnerabilities in connections within the network based on a network deployment health report graph. This disclosure enables the establishment of a security compliance report graph for displaying network security protocol compliance and / or non-compliance to the user.

[0033] In development, parameters may be used to represent extended dependencies; these parameters may be referred to as rdhd parameters. Parameters may be used to represent a list of resources in a containerized environment and the keys of those resources; these parameters may be referred to as mounted security secret parameters. The key of a resource may include the certificate of the resource; these keys may be evaluated against a predefined set of compliance and security rules.

[0034] A network monitor may be used to monitor network transactions on a network; in some embodiments, the network monitor may be a network cryptographic connection monitor. The network monitor may capture TCP connections within a container environment, identify both ends of the connection (e.g., resources on both sides of the connection), and store the connection in a registry (e.g., a connection compliance registry). In some embodiments, the registry functions as a storage space for storing connections between two resources. The registry may indicate compliance status as red, yellow, or green; a red compliance status may indicate that the resource and / or connection has a Common Vulnerability Identifier (CVE), a yellow compliance status may indicate that compliance for the resource and / or connection has not been detected, and a green compliance status may mark that the compliance for the resource and / or connection is fully compliant with current security protocols.

[0035] In some embodiments, this disclosure provides a security compliance handler that parses mounted security secret parameters in a deployment health report graph, extracts cryptographic certificates and / or keys, and evaluates the extracted assets against compliance criteria. Compliance criteria may include, for example, certificate expiration dates, key lengths, encryption algorithms, and others. Thus, the compliance status of resources and / or connections to those resources can be identified and marked. The security compliance handler may generate a security compliance report graph by combining the compliance status of resources in a containerized environment and the compliance status of connections between resources in that environment. The security compliance report graph may include the security compliance status of each resource in the containerized environment and the compliance status of connections between multiple resources in that environment. In some embodiments, the security compliance report graph may be based on a deployment health report dependency graph.

[0036] In some embodiments, the system according to this disclosure may include one or more operators having updated modules. The system may include a dependency store; modules may report data (e.g., dependency information) to the dependency store, which may use the data to generate a deployment health dependency graph. The system may include a deployment controller; the deployment controller may submit a report graph file to a security compliance handler. The system may include a network monitor for monitoring the network and submitting monitoring data to a registry; registry data may be used by a security compliance handler to generate a security compliance report.

[0037] In some embodiments of this disclosure, the updated module may be used by each operator in a containerized environment; the updated module may report dependencies to a dependency store (e.g., a resource deployment health dependency store). The dependency store may report dependencies to a controller (e.g., a resource health deployment controller). The controller may use the dependency information to generate or update a dependency report graph. A network monitor (e.g., a network crypto monitor) may monitor transactions over connections in the network to identify connections in the network and store connection data in a registry (e.g., a connection compliance registry).

[0038] In some embodiments, connection data stored in the registry may be used by a security compliance handler to generate a security compliance report graph. The security compliance handler may parse mounted security secret parameters, extract cryptographic certificates and / or keys, and evaluate the extracted assets against compliance criteria. Thus, the security compliance handler can identify the compliance status of resources and / or their connections, thereby generating a security compliance report graph.

[0039] Some embodiments of this disclosure may include a resource deployment health dependency module within the operator; the resource deployment health dependency module may automatically generate a resource deployment health dependency store. The resource deployment health dependency store may analyze the dependency items in the store and thereby construct a resource deployment health dependency graph. The resource deployment health dependency graph defines resource relationships such as resource dependencies and prerequisites. In some embodiments, the resource deployment health dependency graph may be stored in a configmap.

[0040] According to this disclosure, a user may create a virtual deployment instance; the user may be, for example, an administrator, a developer, and / or a tester. A virtual deployment instance may contain names and variables within a custom resource (CR); for example, a virtual deployment instance may contain a knowledge graph configmap name and associated variables within the virtual deployment CR.

[0041] Some embodiments of this disclosure may also include a network monitor; the network monitor may monitor actions between resources on a network. The network monitor may detect whether connections between resources are secure and store connection security data in a registry. The registry may be a connection compliance registry; specifically, the connection compliance registry may store connection security compliance data.

[0042] Some embodiments of this disclosure may further include a resource health deployment controller; the resource health deployment controller may generate a resource deployment health report graph report according to the CR; the resource deployment health report graph report may be a configmap. The resource deployment health report graph describes resource relationships within a network (e.g., a cluster).

[0043] Some embodiments of this disclosure may also include a server for reading a resource deployment health report graph (e.g., a resource deployment health report graph configmap) and generating a resource deployment health report graph; such server may be a dashboard user interface (UI) server. The resource deployment health report graph may represent the entirety of resource dependency data. In some circumstances, resources that should be present may be missing; in such circumstances, such resources may be marked as missing in the resource deployment health report graph (e.g., such resources may be marked with a missing status).

[0044] Some embodiments of this disclosure may further include a security compliance handler. The security compliance handler may update reports and / or graph files with the compliance status of each resource and / or the connection of each resource. The security compliance handler may merge connection information from a registry (e.g., a connection compliance registry) with established information (e.g., an initial report graph file). The security compliance handler may generate a security compliance report graph using reports, graph files, updated data, resource compliance status data, and / or connection compliance status data.

[0045] In some embodiments of this disclosure, the method includes the steps of deploying resources within a container-based environment and identifying mounted security secrets. A security compliance handler determines whether the mounted security secrets comply with the current security protocol. If the mounted security secrets do not comply with the current security protocol, the compliance check type is set to non-compliant; if the mounted security secrets comply with the current security protocol, the compliance check type is set to compliant. The method continues by defining resource dependencies to determine dependencies; the method includes the steps of identifying mounted security secrets for each dependency and performing dependency checks. A network monitor (e.g., a network cryptographic connection monitor) monitors the network to determine the compliance status of each connection in the network; non-compliant connections may be marked red as CVEs, missing connections may be marked yellow as undetected, and compliant connections may be marked green as compliant. Connection status data may be stored and used to update the security compliance record of the container-based system. In some embodiments, the method may loop to check for updates regarding compliance status and / or dependencies.

[0046] In some embodiments of this disclosure, one or more playbooks may be used to implement resource deployment compliance. A containerized system may have a resource deployment health dependency (RDHD) module for extracting dependency rules from tasks; in some embodiments, the RDHD module may be customized. A mounted secret may contain fields that include information about certificate configuration. A mounted security secret parameter may include a name field having the name of the secret containing the certificate or key, and a key field having a name field in the secret containing the binary value of the certificate or key.

[0047] Some embodiments of this disclosure may include a report graph. The report graph may be referred to as a compliance report graph, a deployment report graph, or a deployment compliance report graph. The report graph is a map of a network having indicators that mark which resources and connections in the network comply with the current security protocol, which resources and connections in the network do not comply with the current security protocol, and which resources and connections that should be in the network are missing or otherwise not detected in the network. A network monitor (e.g., a network cryptographic connection monitor) may detect the compliance, non-compliance, and / or missing status of resources and / or connections in the network.

[0048] The report graph may include indicators that identify resource compliance; a compliant resource indicator indicates that the workload is using a security-compliant certificate. The report graph may include indicators that identify resource non-compliance; a non-compliant resource indicator indicates that the workload is using a security-non-compliant certificate. The report graph may include indicators that identify missing resources; a missing resource indicator indicates that a resource is expected to be present in the network but has not been detected.

[0049] The report graph may include indicators that identify connection compliance (e.g., a green line between the first resource and the second resource that depends on the first resource); a compliant connection indicator indicates that the connection has no security vulnerabilities. The report graph may include indicators that identify connection non-compliance or CVEs (e.g., a red line between the first resource and the second resource that depends on the first resource); a non-compliant connection indicator indicates that the connection has security vulnerabilities. The report graph may include indicators that identify missing connections (e.g., a yellow line between the first resource and the resources that depend on the first resource); a missing resource indicator indicates that connections that are expected to exist in the network have not been detected.

[0050] Some embodiments of this disclosure may include a registry (e.g., a connectivity compliance registry). The registry may include data about resources and / or dependencies within a container-based environment to provide a robust schema for tracking resource and dependency data, including security compliance data. In some embodiments, resource data may be stored in resource tables, and resource relationship information, such as dependency data, may be stored in dependency tables; the resource tables may capture key details and status of each resource, and the dependency tables may illustrate the relationships between resources in the network. Resource tables and dependency tables may enable better management and monitoring of resources and dependencies in the network. Schemas using resource tables and dependency tables may be particularly useful for applications that require enforcing and validating resource dependencies to ensure a consistent and reliable state within a cluster before performing certain actions (e.g., creating resources and / or updating connections).

[0051] A resource object can store information about various resources within a network; a resource whose information is stored by a resource object may be referred to as a resource managed by the resource object. Each entry within a resource object represents a unique resource having specific attributes that define the resource; this information may include, for example, the resource's identity (ID), name, type, and / or current status. In some embodiments, a resource object may store resource information in a resource table.

[0052] A dependency object can store information about dependencies between resources. Each entry in a dependency object represents a relationship between two resources (for example, one resource depending on another). The information in a dependency object can enable the understanding and management of dependencies within a containerized environment. In some embodiments, a dependency object can store resource relationship information in a dependency table.

[0053] This disclosure provides a mechanism for dynamically determining resource deployment compliance in container-based systems. In some embodiments, this disclosure is readily applicable to operator deployment products. In some embodiments, this disclosure provides a mechanism for storing dependency data structures, including automatically generating and storing them in a configmap. In some embodiments, complex dependency logic for components in a system can be directly represented, for example, via a graph. In some embodiments, testers and / or developers can contribute to building resource relationships. Some embodiments of this disclosure may help developers debug problems in the network; some embodiments may help users (e.g., developers, customers, and / or clients) understand product logic. By using this disclosure, site reliability engineers (SREs) may be able to easily identify problematic components and thus quickly restore the system to a fully functional state.

[0054] This disclosure provides a mechanism for diagnosing the deployment health of container-based systems by identifying dependency paths. Furthermore, this disclosure provides a mechanism for improving collaboration among parties interested in the deployment (e.g., developers, testers, deployers, and end users); in some embodiments, one or more parties can coordinate one or more dependencies in real time. In some embodiments, this disclosure may define and show both deployment dependencies and business dependencies; in some embodiments, it may focus on the resource deployment phase. Some aspects of this disclosure do not require physical connections between processes. In some embodiments, this disclosure may define and show dependencies in the deployment process. In some embodiments, a dependency graph may be generated before the network topology can be generated and connected.

[0055] Some aspects of this disclosure may include parameters and attributes such as rdhd parameters, mounted security secret parameters, dependency attributes, external dependency service attributes, prerequisite attributes, and dependency type attributes. These parameters and attributes may be included in a playbook using this disclosure. This disclosure further discusses features including resource deployment health dependency modules (which may be deployed within the engine), dependency stores, and / or dependency graphs. Some aspects of this disclosure may allow a user to manually, visually, and / or dynamically adjust one or more dependencies in the system; in some embodiments, the user may adjust the relationships using an interactive panel.

[0056] According to some embodiments of the present disclosure, a computer implementation method may comprise the steps of analyzing a secret mounted within a containerized deployable unit in a network, and extracting a cryptographic certificate from the containerized deployable unit. The method may further comprise the steps of evaluating the cryptographic certificate against a set of security rules, and monitoring network connectivity in the network. The method may further comprise the steps of detecting security data in the network connectivity, and generating a security compliance report graph based on the security data.

[0057] According to some embodiments of the present disclosure, the method may comprise the steps of generating a resource deployment health dependency store and constructing a resource deployment health dependency graph. The method may further comprise the steps of generating a virtual deployment instance; the virtual deployment instance may include a virtual deployment custom resource. The method may further comprise the steps of generating a resource deployment health report graph configmap based on the virtual deployment custom resource. The method may further comprise the steps of monitoring network actions between resources, extracting encryption algorithms from the network actions, and detecting connection security data based on the encryption algorithms. The method may further comprise the steps of storing connection security data in a connection compliance registry. The method may further comprise the steps of updating an initial report graph file with the compliance status of each resource, merging connection security data with the initial report graph file, and generating a security compliance report graph.

[0058] Systems according to some embodiments of the present disclosure may include memory and a processor that communicates with the memory. The processor may be configured to perform operations. The operations may include steps for monitoring network actions between resources in a network; and steps for extracting encrypted data from the network actions. The operations may include steps for detecting connection security data from the encrypted data and steps for obtaining resource health reports for resources in the network. The operations may include steps for merging the connection security data with the resource health reports and steps for generating security compliance reports.

[0059] In some embodiments of this disclosure, the procedure for monitoring network actions may include the procedure for capturing interactions between resources. In some embodiments, the interactions between resources may be network actions; in some embodiments, the network actions may be client messages or server responses. In some embodiments, the interactions may include handshakes, messages, and responses to those messages. In some embodiments, the interactions may be between a server and a client. In some embodiments, the interactions may include client messages (i.e., messages from the client) and server responses (i.e., responses from the server).

[0060] In some embodiments of this disclosure, encrypted data may include at least one of an encryption algorithm, a cryptographic certificate, an encryption key, and an encryption key length. In some embodiments, the operation may have a procedure for extracting the key length from a network action; connection security data may be based on the encrypted data and the key length.

[0061] In some embodiments of this disclosure, the operation may include a procedure for generating a virtual deployment instance. In some embodiments, the virtual deployment instance may include a custom resource.

[0062] In some embodiments of this disclosure, the operation may include a procedure for generating a resource deployment health report graph. In some embodiments, the resource deployment health report graph may include resources in the network, resource relationships in the network, and status in the network. In some embodiments, the resource deployment health report graph may be a configmap.

[0063] In some embodiments of this disclosure, the operation may include a step to update the resource deployment health report graph.

[0064] In some embodiments of this disclosure, the operation may include steps to construct a resource health report. In some embodiments, the steps to construct a resource health report may include steps to analyze dependencies within the network, steps to define resources within the network, steps to define relationships within the network, and steps to define conditions within the network.

[0065] In some embodiments of this disclosure, the operation may include a procedure for generating a resource deployment health dependency store. In some embodiments, the resource health report is based on the resource deployment health dependency store.

[0066] Figure 1 shows an architecture for a resource deployment compliance engine 100 according to several embodiments of the present disclosure. The resource deployment compliance engine 100 includes a first existing operator 110 and a second existing operator 120. The first existing operator 110 may include a set of dependency rules 112 and an updated module 114; the set of dependency rules 112 includes dependency rule 11 112a, dependency rule 12 112b, and dependency rule 13 112c. The second existing operator 120 may include a set of dependency rules 122 and an updated module 124; the set of dependency rules 122 includes dependency rule 21 122a, dependency rule 22 122b, and dependency rule 23 122c.

[0067] The updated modules 114 and 124 generate a predefined dependency store 130. The predefined dependency store 130 stores a dependency configmap set 132, which includes a first operator dependency configmap 132a and a second operator dependency configmap 132b. The predefined dependency store 130 uses the operator dependency data to generate a deployment health dependency graph 140. The deployment health dependency graph 140 includes a workflow server 142, a zen deployment 144, an ID and access management deployment 146, and a message service stateful set 148.

[0068] A predefined dependency store 130 submits operator dependency data to the deployment controller 172 in the controller set 170. Target systems 150 having virtual deployments 152, 154, and 156 submit data to the deployment controller 172; in some embodiments, the target systems 150 may be virtual deployments. The deployment controller 172 generates a report graph file 174 and submits the report graph file 174 to the security compliance handler 164.

[0069] The network cryptographic connection monitor 160 submits network action data to the connection compliance registry 162. In some embodiments, the network cryptographic connection monitor 160 may monitor the network (e.g., the target system 150 or a containerized environment cluster) to obtain network action data. In some embodiments, the network cryptographic connection monitor 160 may extract cryptographic data from the network action data and / or detect connection security data from the cryptographic data. The connection compliance registry 162 may store network action data that may contain cryptographic data and / or connection security data. The connection compliance registry 162 submits network action data to the security compliance handler 164.

[0070] The security compliance handler 164 generates a security compliance report graph file. The security compliance report graph file 166 may contain data from the report graph file and / or network action data. The security compliance report graph file 166 is submitted to the dashboard user interface (UI) server 178. The dashboard UI server 178 uses the security compliance report graph file 166 to generate a set 180 of deployment report graphs 180A, 180B, and 180C. The first deployment report graph 180A includes the server 182a, the zen deployment 184a, the identity access management deployment 186a, and the message service stateful set 188a.

[0071] Figure 2A shows a deployment architecture for a resource deployment compliance system 200A according to several embodiments of the present disclosure. System 200A includes a cluster 210; cluster 210 may be a container-based cluster. Cluster 210 includes an operator group 212. Operator group 212 includes operator A260 with updated module 266, operator B270 with updated module 276, and operator C280 with updated module 286. In some embodiments, operator group 212 may include more or fewer operators.

[0072] The updated modules 266, 276, and 286 within operator group 212 submit data to the dependency store 214. The updated modules 266, 276, and 286 may report dependencies to the dependency store 214. The dependency store 214 reports data (e.g., dependency data) to the resource health deployment controller 230. A user (e.g., an end user) or deployer (e.g., an administrator) may create a virtual deployment 208; the virtual deployment 208 submits data to the resource health deployment controller 230.

[0073] Cluster 210 includes workload 220; workload 220 includes a full workflow state set 222, a Zen deployment 224, a full message service state set 226, and a database startup job 228. In some embodiments, there may be more, fewer, and / or different workloads and / or workload types within workload 220. The resource health deployment controller 230 reads the status of workload 220.

[0074] The resource health deployment controller 230 generates and / or updates a dependency report graph 232; in some embodiments, the health deployment controller 230 generates and / or updates the dependency report graph 232 using dependency information from the dependency store 214, data from the virtual deployment 208, and / or the status of the workload 220. The resource health deployment controller 230 submits the dependency report graph 232 to the security compliance handler 240.

[0075] The network cryptography monitor 234 submits network data to the connection compliance registry 236. The network cryptography monitor 234 can identify connections within the network by monitoring transactions through connections within the network; the network cryptography monitor 234 can store connection data in the connection compliance registry 236. The connection compliance registry 236 submits network data to the security compliance handler 240.

[0076] The security compliance handler 240 generates a security compliance report graph 242. In some embodiments, the security compliance handler 240 may generate the security compliance report graph 242 using data from the dependency report graph 232 and / or data from the connection compliance registry 236.

[0077] The deployment architecture for the resource deployment compliance system 200A includes an online report 206. In some embodiments, a user (e.g., a deployer or tester) can view the online report 206. The online report 206 is submitted to the dashboard UI server 244 and used to generate and / or update the security compliance report graph 242.

[0078] Figure 2B shows a development architecture for a resource deployment compliance system 200B according to several embodiments of the present disclosure. System 200B includes an environment 250 (e.g., a cluster or pod). Environment 250 includes operator A260 having a normal deployment step 262 and an updated module 266; operator A260 also includes a first dependency 264a, a second dependency 264b, and a third dependency 264c. Environment 250 includes operator B270 having a normal deployment step 272 and an updated module 276; operator B270 also includes a first dependency 274a, a second dependency 274b, and a third dependency 274c. Environment 250 includes operator C280 having a normal deployment step 282 and an updated module 286; operator C280 also includes a first dependency 284a, a second dependency 284b, and a third dependency 284c. In some embodiments, the environment 250 may include more or fewer operators. In some embodiments, such operators may include more or fewer dependencies.

[0079] The updated modules 266, 276, and 286 within the operator submit data to the resource deployment health dependency store 216. The updated modules 266, 276, and 286 report dependencies to the resource deployment health dependency store 216. The updated module 266 of operator A 260 reports operator A's dependency 268 to the resource deployment health dependency store 216, the updated module 276 of operator B 270 reports operator B's dependency 278 to the resource deployment health dependency store 216, and the updated module 286 of operator C 280 reports operator C's dependency 288 to the resource deployment health dependency store 216.

[0080] Figure 3 shows a flowchart 300 of a resource deployment system according to several embodiments of the present disclosure. The flowchart 300 includes initiating a deployment 302 and determining whether the deployment has a mounted security secret parameter 304. The flowchart 300 shows that if the deployment does not have a mounted security secret parameter, the process terminates 308; in some embodiments, the absence of a mounted security secret parameter may indicate, for example, that the deployment is not subject to the current security protocol, and therefore the process terminates 308. In some embodiments, if the deployment does not have a mounted security secret parameter, a mounted security secret parameter may be added to the deployment. If a mounted security secret parameter is found, the flowchart 300 proceeds to submit the mounted security secret parameter to a security compliance handler 310. The security compliance handler 310 checks the compliance of the mounted security secret parameter 312; if the mounted security secret parameter is not compliant, the security compliance handler 310 sets the compliance check type to non-compliant 314, indicating that the mounted security secret parameter is non-compliant with the current security protocol.

[0081] If the mounted security secret parameter is compliant, the security compliance handler 310 sets the compliance check type to compliant 316, indicating that the mounted security secret parameter is compliant with the current security protocol. Flowchart 300 proceeds by defining resource dependencies 320 and retrieving dependencies 322. Flowchart 300 continues by determining 330 whether the dependency 322 is configured with the mounted security secret parameter. If one or more dependencies 322 are configured with the mounted security secret parameter, Flowchart 300 then loops back to the security compliance handler 310 to determine whether the mounted security secret parameter is compliant with the current security protocol. If the dependency 322 does not have the mounted security secret parameter, Flowchart 300 proceeds to perform a dependency check 332.

[0082] Flowchart 300 continues with the network encryption connection monitor 340 monitoring the network and determining the compliance status of each connection within the network. Non-compliant connections are marked as CVEs 342, missing connections are marked as undetected 344, and compliant connections are marked as compliant with a green line 346. Connection status data is saved and used to update the security compliance record 350 in the configmap. Flowchart 300 loops to dependency 322.

[0083] Flowchart 300 continues the process 330 from saving and updating the compliance record 350 in the configmap to looping back to dependency 322 and determining whether dependency 322 is configured with a mounted security secret parameter. In some embodiments, each dependency 322 may be checked individually, so that in the first loop, it is determined whether the first dependency is configured with a mounted security secret parameter, in the second loop, it is determined whether the second dependency is configured with a mounted security secret parameter, and so on. For example, in one embodiment where one dependency check is performed per loop, a single source object with five dependencies loops back to dependency 322 four times, so that the loop is executed five times (once per dependency).

[0084] Figure 4 shows a set of 400 exemplary playbooks for a resource deployment system according to several embodiments of the present disclosure. The playbooks may be used to implement resource deployment compliance. The containerized system may have an RDHD module for extracting dependency rules from tasks; in some embodiments, the RDHD module may be customized. A mounted secret may contain fields that include information about certificate configuration. The mounted security secret parameter may include a name field having the name of the secret containing the certificate or key, and a key field having a name field in the secret containing the binary value of the certificate or key.

[0085] The exemplary set of playbooks 400 shown in Figure 4 includes playbooks A410, B440, and C470. Each playbook contains at least one mounted security secret parameter. Each mounted security secret parameter contains a name and key for the mounted security secret parameter.

[0086] Figure 5 shows a compliance report graph 500 according to several embodiments of the present disclosure. The compliance report graph 500 includes resources 512, 514, 516, 518, 522, 524, 526, and 528 within a cluster 510, as well as external resources 532, 534, and 536 located outside of the cluster 510. In some embodiments, the cluster (e.g., cluster 510) may be deployed by a first entity (e.g., a first company), and the resources outside the cluster (e.g., external resources 532, 534, and 536) may be deployed by one or more other entities (e.g., a second company and affiliated organizations). Some of the resources 512, 514, 516, 518, and 528 in the compliance report graph 500 comply with current security protocols and therefore have shielded checkmark indicators. Some parts of resources 522 and 524 do not comply with current security protocols and therefore have a disconnected shield indicator.

[0087] Resources 526, 532, 534, and 536, whose compliance or non-compliance with the current security protocol has not been determined, are not marked with an indicator. Resources may not be marked as compliant or non-compliant because the system (e.g., the resource deployment compliance engine 100 shown in Figure 1) is unable to locate the resource (e.g., the resource is missing), the system is unable to locate the connection to the resource (e.g., the connection and / or intermediate resources are missing), and / or the resource is outside the system's reach, and therefore the system does not have access to the resource data. In the report graph 500 in Figure 5, resource 526 within cluster 510 is missing, as indicated by the dashed line, and two external resources 532 and 536 outside cluster 510 are also missing.

[0088] The compliance report graph 500 includes connections 542, 544, 546, 548, 552, 556, 558, 562, 564, and 566 between resources 512, 514, 516, 518, 522, 524, 526, 528, 532, 534, and 536. Connections 542, 544, 546, and 548 that do not have security vulnerabilities are indicated by standard arrows, connections 552, 556, and 558 that have security vulnerabilities are indicated by bold arrows, and missing connections 562, 564, and 566 are indicated by dashed arrows to indicate that the connection is not detected. In some embodiments, the status of each connection as compliant (e.g., no security vulnerabilities identified), non-compliant (e.g., security vulnerabilities identified), or missing (e.g., not detected) is determined by a network monitor (e.g., the network cryptographic connection monitor 160 shown in Figure 1).

[0089] Figure 6 shows a compliance analysis module system 600 of a resource deployment compliance system according to several embodiments of the present disclosure. The compliance analysis module system 600 includes a compliance analysis module 610. The compliance analysis module 610 receives certificates and / or keys from a database 608 and performs an analysis 612 on the certificates and / or keys. The analysis 612 includes collecting the certificates and / or keys 614 and analyzing the certificates and / or keys 616. The compliance analysis module 610 in Figure 6 includes an example 618 of the analysis 612 of the certificates and / or keys.

[0090] The compliance analysis module 610 performs analysis 620 on connections within a container-based system. As shown in Figure 6, there exist first node 632 and second node 634 which are part of the container-based system; the container-based system may have any number of nodes and / or connections in accordance with this disclosure. The compliance analysis module 610 receives connection 630 data about the nodes; in some embodiments, connection 630 may be a transport layer security (TLS) connection, and connection 630 data may be TLS connection data. The connection analysis 620 includes collecting connection data 622, capturing the handshake 624, and dumping the algorithm and key length 626.

[0091] The compliance analysis module 610 analyzes resources and connections to generate information about the system. In Figure 6, the data is output to table 640. Table 640 includes columns for key 650, key type 660, key length 670, and affiliate 680. Key 650 in the table includes key 1 652, certificate 2 654, certificate 3 656, and TLS3 658. Key type 660 in the table includes RSA662, RSA664, ECDSA666, and RSA668. Key length 670 in the table includes 1024 672, 2048 674, secp256r1 676, and 2048 3 678. Affiliate 680 in the table includes node 1 682, node 1 684, node 2 686, and node 3-node 4 688.

[0092] Figure 7 shows a connectivity compliance registry 700 for a resource deployment compliance system according to several embodiments of the present disclosure. The connectivity compliance registry 700 is an exemplary registry of the network security compliance status of connections within a container-based system. In some embodiments, a network monitor (e.g., the network cryptographic connectivity monitor 234 in Figure 2A) may detect the connectivity compliance status and / or generate the connectivity compliance registry 700.

[0093] The connection compliance registry 700 in Figure 7 records connection data, including compliance data, between resources within a container-based system. The connection compliance registry 700 records data for a system having three resources and two connections; one connection is marked as non-compliant (here, "CVE") to indicate a security vulnerability, and the other connection is marked as compliant (here, "green") to indicate that no security vulnerability was identified. According to this disclosure, the connection compliance registry may record connection data for any number of connections between any number of resources, any of which connections may be compliant, non-compliant, or missing.

[0094] The computer implementation method described herein may include the steps of monitoring network actions between resources in a network and extracting encrypted data from the network actions. The method may also include the steps of detecting connection security data from the encrypted data and obtaining resource health reports for resources in the network. The method may also include the steps of merging the connection security data with the resource health reports and generating security compliance reports.

[0095] In some embodiments of this disclosure, the step of monitoring network actions may include a step of capturing interactions between resources. In some embodiments, the interactions between resources may be network actions; in some embodiments, the network actions may be client messages or server responses. In some embodiments, the interactions may include handshakes, messages, and responses to those messages. In some embodiments, the interactions may be between a server and a client. In some embodiments, the interactions may include client messages and server responses.

[0096] In some embodiments of this disclosure, encrypted data may include at least one of an encryption algorithm, a cryptographic certificate, an encryption key, and an encryption key length. In some embodiments, the method may include a step of extracting the key length from a network action; connection security data may be based on the encrypted data and the key length.

[0097] In some embodiments of this disclosure, the method may include a step of generating a virtual deployment instance. In some embodiments, the virtual deployment instance may include a custom resource.

[0098] In some embodiments of this disclosure, the method may include a step of generating a resource deployment health report graph. In some embodiments, the resource deployment health report graph may include resources in the network, resource relationships in the network, and status in the network. In some embodiments, the resource deployment health report graph may be a configmap.

[0099] In some embodiments of the present disclosure, the method may include a step of updating a resource deployment health report graph.

[0100] In some embodiments of this disclosure, the method may include a step of building a resource health report. In some embodiments, the step of building a resource health report may include a step of analyzing dependencies in the network, a step of defining resources in the network, a step of defining relationships in the network, and a step of defining conditions in the network.

[0101] In some embodiments of this disclosure, the method may comprise the step of generating a resource deployment health dependency store. In some embodiments, the resource health report is based on the resource deployment health dependency store.

[0102] Figure 8 shows a computer implementation resource deployment compliance method 800 according to several embodiments of the present disclosure. The method 800 comprises a step 810 of analyzing a secret within a unit in a network; the secret includes an extended dependency 812 and a mounted security secret 814. The method 800 also comprises a step 820 of extracting a cryptographic certificate and a step 830 of evaluating the cryptographic certificate against security rules.

[0103] Method 800 includes a step 840 of monitoring network connections within the network. A network cryptographic connection monitor 842 performs network connection monitoring 840 and stores connection data in a connection compliance registry 844. Method 800 includes a step 850 of detecting security data in network connections; a security compliance handler 852 performs network connection security data detection. Method 800 includes a step 860 of generating a security compliance report graph.

[0104] Figure 9 shows a method 900 for a container-based deployment system according to several embodiments of the present disclosure. Method 900 includes the step of building a resource health report for resources in the system 910 and the step of monitoring network actions between resources in the system 930. Method 900 includes the step of extracting encrypted data from network actions 940 and the step of detecting connectivity security data from the network action encrypted data 950. Method 900 further includes the step of merging the connectivity security data with the resource health report 980 and the step of generating a security compliance report 990.

[0105] Figure 10 shows a computer implementation method 1000 for a container-based deployment system according to some embodiments of the present disclosure. The method 1000 comprises a step 1008 of generating a resource deployment health dependency store, and a step 1010 of constructing a resource deployment health dependency graph for resources in the system. The step 1010 of constructing the resource deployment health dependency graph includes a step 1012 of analyzing dependencies in the system, a step 1014 of defining resources in the system, a step 1016 of defining relationships in the system, and a step 1018 of defining conditions in the system.

[0106] Method 1000 comprises a step 1020 for generating a virtual deployment instance; the virtual deployment instance comprises a custom resource 1022. Method 1000 also comprises a step 1028 for generating a resource deployment health report graph configmap.

[0107] Method 1000 includes a step 1030 for monitoring network actions between resources in a system. Network actions include interactions over a network. The step 1030 for monitoring network actions includes a step 1032 for capturing interactions between resources. These interactions include a handshake 1034, a client message 1036, and a server response 1038.

[0108] Method 1000 comprises a step 1040 for extracting encrypted data from a network action. The encrypted data may include an encryption algorithm 1042, a cryptographic certificate 1044, a cryptographic key 1046, and a cryptographic key length 1048. In some embodiments of the present disclosure, the encrypted data may include multiple encryption algorithms, cryptographic certificates, cryptographic keys, and / or cryptographic key lengths.

[0109] Method 1000 comprises a step 1050 of detecting connection security data from encrypted data. Method 1000 comprises a step 1052 of storing the connection security data; in some embodiments, the connection security data may be stored in a registry (e.g., a connection compliance registry 162 shown in Figure 1).

[0110] Method 1000 comprises a step 1060 for generating a resource deployment health report graph. The resource deployment health report graph includes a resource 1062, a relationship 1064, and status data 1066 for resource 1062 and relationship 1064.

[0111] Method 1000 comprises a step 1070 to update the resource deployment health report graph, a step 1080 to merge connection security data with the updated report graph, and a step 1090 to generate a security compliance report.

[0112] The computer program product provided herein may comprise a computer-readable storage medium in which program instructions are embodied. The program instructions may be executable by a processor to cause the processor to perform a function. The function may include procedures for monitoring network actions between resources in a network and for extracting encrypted data from such network actions. The function may include procedures for detecting connection security data from the encrypted data and for obtaining resource health reports for the resources in the network. The function may include procedures for merging the connection security data with the resource health reports and for generating security compliance reports.

[0113] In some embodiments of this disclosure, the procedure for monitoring network actions may include the procedure for capturing interactions between resources. In some embodiments, the interactions between resources may be network actions; in some embodiments, the network actions may be client messages or server responses. In some embodiments, the interactions may include handshakes, messages, and responses to those messages. In some embodiments, the interactions may be between a server and a client. In some embodiments, the interactions may include client messages and server responses.

[0114] In some embodiments of this disclosure, encrypted data may include at least one of an encryption algorithm, a cryptographic certificate, an encryption key, and an encryption key length. In some embodiments, the function may include a procedure for extracting the key length from a network action; connection security data may be based on the encrypted data and the key length.

[0115] In some embodiments of this disclosure, the functionality may include a procedure for generating a virtual deployment instance. In some embodiments, the virtual deployment instance may include a custom resource.

[0116] In some embodiments of this disclosure, the function may include a procedure for generating a resource deployment health report graph. In some embodiments, the resource deployment health report graph may include resources in the network, resource relationships in the network, and status in the network. In some embodiments, the resource deployment health report graph may be a configmap.

[0117] In some embodiments of this disclosure, the function may include a procedure for updating a resource deployment health report graph.

[0118] In some embodiments of this disclosure, the function may include steps for constructing a resource health report. In some embodiments, steps for constructing a resource health report may include steps for analyzing dependencies within the network, steps for defining resources within the network, steps for defining relationships within the network, and steps for defining conditions within the network.

[0119] In some embodiments of this disclosure, the functionality may include a procedure for generating a resource deployment health dependency store. In some embodiments, the resource health report is based on the resource deployment health dependency store.

[0120] It should be noted that various aspects of this disclosure may be described by explanatory text, flowcharts, block diagrams of computer systems, and / or block diagrams of machine logic included in embodiments of computer program products (CPPs). With respect to any flowchart (depending on the technology involved), operations may be performed in a different order than those shown in the flowchart. For example, two operations shown in consecutive blocks of a flowchart may be performed in reverse order, as a single integrated step, simultaneously, or with at least partial time overlap. Embodiments of computer program products ("CPP Embodiments") are a term used in this disclosure and may describe any set of one or more storage media (or "Multiple Media") that are collectively included in one or more sets of storage devices.

[0121] A storage medium may collectively contain machine-readable code corresponding to instructions and / or data for performing computer operations. A “storage device” may refer to any tangible hardware or device capable of holding and storing instructions for use by a computer processor. Computer-readable storage media may include, but are not limited to, electronic storage media, magnetic storage media, optical storage media, electromagnetic storage media, semiconductor storage media, mechanical storage media, and / or any combination thereof. Some known types of storage devices, including the media referred to herein, may include diskettes, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), compact disc read-only memory (CD-ROM), digital versatile disk (DVD), memory sticks, floppy disks, mechanically encoded devices (such as pits / lands formed on the main surface of punch cards or disks), or any suitable combination thereof. Computer-readable storage media should not be interpreted as storage in the form of transient signals themselves, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides, light pulses passing through optical fiber cables, electrical signals communicated through wires, and / or other transmission media. As will be understood by those skilled in the art, data is typically moved at several intermittent points during the normal operation of a storage device, such as during access, defragmentation, or garbage collection; however, data is not transient while it is stored, and this does not mean that a storage device is transient.

[0122] Figure 11 shows a block diagram illustrating one embodiment of a computer system and its components configured to operate in a network environment (including a cloud environment), on which embodiments including the systems and methods described herein may be implemented in accordance with this disclosure.

[0123] Embodiments of a computer program product ("CPP Embodiment" or "CPP") are terms used in this disclosure to describe any set of one or more storage media (also called "Multiple Media") that collectively comprise a set of one or more storage devices and collectively comprise machine-readable code corresponding to instructions and / or data for performing computer operations specified in a given CPP claim. "Storage Device" is any tangible device capable of holding and storing instructions for use by a computer processor. Computer-readable storage media may, but are not limited to, electronic storage media, magnetic storage media, optical storage media, electromagnetic storage media, semiconductor storage media, mechanical storage media, or any preferred combination thereof. Some types of storage devices, including these media, include diskettes, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), compact disk read-only memory (CD-ROM), digital versatile disks (DVDs), memory sticks, floppy disks, mechanically encoded devices (such as pits / lands formed on the main surface of punch cards or disks), or any suitable combination of those described above. When the term "computer-readable storage medium" is used in this disclosure, it shall not be construed as storage in the form of a transient signal itself, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides, optical pulses passing through optical fiber cables, electrical signals communicated through wires, and / or other transmission media. As will be understood by those skilled in the art, data is typically moved at several intermittent points during the normal operation of the storage device, such as during access, defragmentation, or garbage collection; however, data is not transient while it is stored, and this does not mean that the storage device is transient.

[0124] The computing environment 1100 includes an example of an environment for executing at least a portion of the computer code involved in performing the method of the present invention, such as the resource deployment compliance engine 100. In addition to the resource deployment compliance engine 100, the computing environment 1100 includes, for example, a computer 1101, a wide area network (WAN) 1102, an end user device (EUD) 1103, a remote server 1104, a public cloud 1105, and a private cloud 1106. In this embodiment, the computer 1101 includes a processor set 1110 (including processing circuits 1120 and a cache 1121), a communication fabric 1111, volatile memory 1112, persistent storage 1113 (including an operating system 1122 and the resource deployment compliance engine 100 identified above), a peripheral device set 1114 (including a user interface (UI) device set 1123, storage 1124, and an Internet of Things (IoT) sensor set 1125), and a network module 1115. The remote server 1104 includes the remote database 1130. The public cloud 1105 includes the gateway 1140, the cloud orchestration module 1141, the host physical machine set 1142, the virtual machine set 1143, and the container set 1144.

[0125] Computer 1101 can take the form of a desktop computer, laptop computer, tablet computer, smartphone, smartwatch, or other wearable computer, mainframe computer, quantum computer, or any other form of computer or mobile device, currently known or to be developed in the future, that can run programs, access networks, or query databases such as remote database 1130. As is well understood in the field of computer technology, and depending on the technology, the execution of a computer implementation can be distributed among multiple computers and / or multiple locations. On the other hand, in this presentation of the computing environment 1100, in order to keep the presentation as concise as possible, the detailed discussion focuses on a single computer, specifically computer 1101. Although computer 1101 is not shown in the cloud in Figure 11, it can be located in the cloud. On the other hand, computer 1101 does not need to be located in the cloud, except to any extent that can be definitively shown.

[0126] The processor set 1110 includes one or more computer processors of any type currently known or to be developed in the future. The processing circuitry 1120 may be distributed across multiple packages, for example, multiple coordinated integrated circuit chips. The processing circuitry 1120 may implement multiple processor threads and / or multiple processor cores. The cache 1121 is memory located within the processor chip package and is typically used for data or code that should be available for high-speed access by threads or cores running on the processor set 1110. The cache memory is typically organized into multiple levels depending on its relative proximity to the processing circuitry. Alternatively, some or all of the cache for the processor set may be located "off-chip". In some computing environments, the processor set 1110 may operate using qubits and be designed to perform quantum computing.

[0127] Computer-readable program instructions are typically loaded onto computer 1101, causing the processor set 1110 of computer 1101 to execute a series of operational steps, thereby enabling the computer implementation method. As a result, the instructions thus executed instantiate the method specified in the flowcharts and / or descriptions of the computer implementation method contained herein (collectively referred to as the "Method of the Invention"). These computer-readable program instructions are stored in various types of computer-readable storage media, such as cache 1121 and other storage media discussed below. The program instructions and associated data are accessed by the processor set 1110 to control and direct the execution of the Method of the Invention. In the computing environment 1100, at least some of the instructions for executing the Method of the Invention may be stored in the resource deployment compliance engine 100 in persistent storage 1113.

[0128] The communication fabric 1111 is a signal conduction path that enables various components of the computer 1101 to communicate with one another. Typically, this fabric is made up of switches and conductive paths, such as buses, bridges, physical input / output ports, and similar components. Other types of signal communication paths may be used, such as fiber optic communication paths and / or wireless communication paths.

[0129] Volatile memory 1112 is any type of volatile memory currently known or to be developed in the future. Examples include dynamic random access memory (RAM) or static RAM. Typically, volatile memory 1112 is characterized by random access, but this is not mandatory unless explicitly stated. In computer 1101, volatile memory 1112 is located in a single package and resides inside computer 1101, but alternatively or additionally, volatile memory may be distributed across multiple packages and / or located externally to computer 1101.

[0130] The persistent storage 1113 is any form of non-volatile storage for a computer that is currently known or may be developed in the future. The non-volatility of this storage means that the stored data is maintained regardless of whether power is supplied directly to the computer 1101 and / or to the persistent storage 1113. The persistent storage 1113 may be read-only memory (ROM), but typically at least a portion of the persistent storage allows for writing, deleting, and rewriting of data. Some well-known forms of persistent storage include magnetic disks and solid-state storage devices. The operating system 1122 can take multiple forms, such as various known proprietary operating systems or open-source portable operating system interface type operating systems that employ a kernel. The code included in the resource deployment compliance engine 100 typically includes at least a portion of computer code involved in performing the methods of the present invention.

[0131] The peripheral device set 1114 includes a set of peripheral devices for the computer 1101. Data communication connections between the computer 1101's peripheral devices and other components can be implemented in various ways, including Bluetooth® connections, Near-Field Communication (NFC) connections, connections made by cables (such as universal serial bus (USB) type cables), insert-type connections (e.g., secure digital (SD) cards), connections made through local area communication networks, and even connections made through wide area networks such as the Internet. In various embodiments, the UI device set 1123 may include components such as a display screen, speaker, microphone, wearable devices (such as goggles and smartwatches), keyboard, mouse, printer, touchpad, game controller, and haptic devices. Storage 1124 is external storage such as an external hard drive, or insertable storage such as an SD card. Storage 1124 may be persistent and / or volatile. In some embodiments, storage 1124 may take the form of a quantum computing memory device for storing data in the form of qubits. In embodiments where computer 1101 is required to have a large amount of storage (for example, when computer 1101 locally stores and manages a large database), this storage may be provided by peripheral storage devices designed to store very large amounts of data, such as a storage area network (SAN) shared by multiple geographically distributed computers. The IoT sensor set 1125 consists of sensors that can be used in Internet of Things applications. For example, one sensor may be a thermometer and another may be a motion detector.

[0132] The network module 1115 is a collection of computer software, hardware, and firmware that enables computer 1101 to communicate with other computers via the WAN 1102. The network module 1115 may include hardware such as a modem or Wi-Fi® signal transceiver, software for packetizing and / or depacketizing data for communication network transmission, and / or web browser software for communicating data over the Internet. In some embodiments, the network control and network forwarding functions of the network module 1115 are performed on the same physical hardware device. In other embodiments (e.g., embodiments utilizing Software-Defined Networking (SDN)), the control and forwarding functions of the network module 1115 are performed on physically separate devices, such that the control function manages multiple different network hardware devices. Computer-readable program instructions for performing the method of the present invention can typically be downloaded to computer 1101 from an external computer or external storage device via a network adapter card or network interface included in the network module 1115.

[0133] WAN1102 is any wide area network (e.g., the Internet) that can communicate computer data over non-local distances using any currently known or future-developed technology for communicating computer data. In some embodiments, WAN1102 may be replaced and / or supplemented by a local area network (LAN), such as a Wi-Fi network, designed to communicate data between devices located in a local area. WANs and / or LANs typically include computer hardware such as copper transmission cables, optical transmission fibers, wireless transmissions, routers, firewalls, switches, gateway computers, and edge servers.

[0134] The end-user device (EUD) 1103 is any computer system used and controlled by an end-user (e.g., a customer of the company operating computer 1101) and can take any of the forms discussed above in relation to computer 1101. EUD 1103 typically receives useful and valuable data from the operation of computer 1101. For example, in a hypothetical case where computer 1101 is designed to provide recommendations to an end-user, these recommendations would typically be communicated from computer 1101's network module 1115 to EUD 1103 via WAN 1102. In this way, EUD 1103 can display or otherwise present the recommendations to the end-user. In some embodiments, EUD 1103 may be a client device such as a thin client, heavy client, mainframe computer, desktop computer, and similar.

[0135] The remote server 1104 is any computer system that provides at least some data and / or functionality to computer 1101. The remote server 1104 may be controlled and used by the same entity that operates computer 1101. The remote server 1104 represents a machine that collects and stores useful and valuable data for use by other computers, such as computer 1101. For example, in a hypothetical case where computer 1101 is designed and programmed to provide recommendations based on historical data, this historical data may be provided to computer 1101 from the remote database 1130 of the remote server 1104.

[0136] The public cloud 1105 is any computer system available for use by multiple entities, providing on-demand availability of computer system resources and / or other computer functions, particularly data storage (cloud storage) and computing power, without direct active management by the user. Cloud computing typically leverages resource sharing to achieve coherence and economies of scale. Direct active management of the computing resources of the public cloud 1105 is performed by the computer hardware and / or software of the cloud orchestration module 1141. The computing resources provided by the public cloud 1105 are typically implemented by virtual computing environments running on various computers that make up the host physical machine set 1142, which is the universe of physical computers within and / or available in the public cloud 1105. The virtual computing environment (VCE) typically takes the form of virtual machines from the virtual machine set 1143 and / or containers from the container set 1144. These VCEs can be stored as images and transferred between and between various physical machine hosts, either as images or after VCE instantiation. The cloud orchestration module 1141 manages the transfer and storage of images, deploys new VCE instantiations, and manages active instantiations of VCE deployments. The gateway 1140 is a collection of computer software, hardware, and firmware that enables the public cloud 1105 to communicate through the WAN 1102.

[0137] Here, some further explanation of virtualized computing environments (VCEs) is provided. A VCE can be stored as an "image." A new active instance of a VCE can be instantiated from an image. Two well-known types of VCEs are virtual machines and containers. A container is a VCE that uses operating system-level virtualization. This refers to an operating system feature where the kernel allows for the existence of multiple isolated user-space instances called containers. These isolated user-space instances typically behave like actual computers in terms of the programs running within them. Computer programs running on a normal operating system can utilize all of that computer's resources, including connected devices, files and folders, network shares, CPU power, and quantifiable hardware capabilities. However, programs running inside a container can only use the contents of the container and the devices allocated to the container; this feature is known as containerization.

[0138] The private cloud 1106 is similar to the public cloud 1105, except that its computing resources are available only for use by a single enterprise. While the private cloud 1106 is shown as being in communication with the WAN 1102, in other embodiments, the private cloud may be completely isolated from the internet and accessible only through a local / private network. A hybrid cloud is a combination of multiple clouds of different types (e.g., private, community, or public cloud types), often implemented by different vendors. Each of the multiple clouds remains a separate, discrete entity, but the larger hybrid cloud architecture is bound together by standardized or proprietary technologies that enable orchestration, management, and / or data / application portability between the multiple configuration clouds. In this embodiment, both the public cloud 1105 and the private cloud 1106 are part of a larger hybrid cloud.

[0139] Cloud computing services and / or microservices (not shown separately in Figure 11): Private and public clouds 1106 are programmed and configured to deliver cloud computing services and / or microservices (unless otherwise indicated, the term “microservices” should be interpreted as including larger “services,” regardless of scale). Cloud services are typically infrastructure, platforms, or software hosted by a third-party provider and made available to users over the internet. Cloud services facilitate the flow of user data from front-end clients (e.g., user-side servers, tablets, desktops, laptops) to the provider’s systems over the internet and vice versa. In some embodiments, cloud services may be configured and orchestrated according to an “as-a-service” technology paradigm, where something is presented to internal or external customers in the form of a cloud computing service. An As-a-Service offering typically provides endpoints that various customers interface with. These endpoints are typically based on a set of APIs. One category of as-a-service offerings is Platform as a Service (PaaS), where a service provider provisions, instantiates, runs, and manages modular bundles of code that customers can use to instantiate a computing platform and one or more applications without the complexity of building and maintaining the infrastructure typically associated with them. Another category is Software as a Service (SaaS), where software is centrally hosted and allocated on a subscription basis. SaaS is also known as on-demand software, web-based software, or web-hosted software.The four technical subfields involved in cloud services are: deployment, integration, on-demand, and virtual private networks.

[0140] Various aspects of this disclosure are described by explanatory text, flowcharts, block diagrams of computer systems, and / or block diagrams of machine logic included in CPP embodiments. With respect to any flowchart, depending on the technology involved, operations may be performed in a different order than those shown in a given flowchart. For example, also depending on the technology involved, two operations shown in consecutive blocks of a flowchart may be performed in reverse order, as a single integrated step, simultaneously, or with at least partial time overlap.

[0141] While this disclosure is described in terms of specific embodiments, it is expected that modifications and alterations thereto will be obvious to those skilled in the art. The descriptions of the various embodiments of this disclosure are presented for illustrative purposes only and are not intended to be comprehensive or limit to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein has been selected to best describe the principles, practical applications, or technical improvements to the technologies available on the market of the embodiments, or to enable other persons skilled in the art to understand the embodiments disclosed herein. Accordingly, the following claims are intended to be construed as encompassing all such modifications and variations that fall within the true spirit and scope of this disclosure.

Claims

1. memory; and Processor that communicates with the aforementioned memory The processor is configured to perform an operation, the operation being: Procedures for monitoring network actions between resources within a network; Procedure for extracting encrypted data from the aforementioned network action; A procedure for detecting connection security data from the aforementioned encrypted data; Procedure for obtaining a resource health report for resources within the aforementioned network; Procedure for merging connection security data with the resource health report; and Steps to generate a security compliance report A system that has

2. The procedure for monitoring the aforementioned network actions is as follows: Procedure for capturing the interaction between the aforementioned resources The system according to claim 1, including the following:

3. The aforementioned exchange was: Handshake; Message; and Response to the aforementioned message The system according to claim 2, including the above.

4. The system according to any one of claims 1 to 3, wherein the encrypted data includes at least one from the group consisting of an encryption algorithm, a cryptographic certificate, an encryption key, and an encryption key length.

5. The aforementioned operation is: Steps to create a virtual deployment instance The system according to any one of claims 1 to 3, further comprising:

6. The aforementioned operation is: Steps to generate a resource deployment health report graph The system according to any one of claims 1 to 3, further comprising:

7. The aforementioned operation is: Procedure for constructing the aforementioned resource health report The system according to any one of claims 1 to 3, further comprising:

8. The stage of monitoring network actions between resources within the network; The step of extracting encrypted data from the aforementioned network action; A step in which connection security data is detected from the encrypted data; The step of obtaining a resource health report for resources within the aforementioned network; The step of merging connection security data with the resource health report; and The stage of generating a security compliance report A method for providing this.

9. The steps for monitoring the aforementioned network actions are: The step of capturing the interaction between the aforementioned resources. The method according to claim 8, wherein the method is characterized by having the following:

10. The aforementioned exchange was: Handshake; Message; and Response to the aforementioned message The method according to claim 9, including the method described in claim 9.

11. The method according to any one of claims 8 to 10, wherein the encrypted data includes at least one from the group consisting of an encryption algorithm, a cryptographic certificate, a cryptographic key, and a cryptographic key length.

12. The stage of generating virtual deployment instances The method according to any one of claims 8 to 10, further comprising:

13. The stage of generating the resource deployment health report graph. The method according to any one of claims 8 to 10, further comprising:

14. The method according to claim 13, wherein the resource deployment health report graph includes resources in the network, resource relationships in the network, and status in the network.

15. The stage of constructing the aforementioned resource health report. The method according to any one of claims 8 to 10, further comprising:

16. To the computer: Procedures for monitoring network actions between resources within a network; Procedure for extracting encrypted data from the aforementioned network action; A procedure for detecting connection security data from the aforementioned encrypted data; Procedure for obtaining a resource health report for resources within the aforementioned network; Procedure for merging connection security data with the resource health report; and Steps to generate a security compliance report A computer program designed to execute something.

17. The procedure for monitoring the aforementioned network actions is as follows: Procedure for capturing the interaction between the aforementioned resources The computer program according to claim 16, including the computer program described in claim 16.

18. The computer program according to claim 16 or 17, wherein the encrypted data includes at least one from the group consisting of an encryption algorithm, a cryptographic certificate, a cryptographic key, and a cryptographic key length.

19. To the aforementioned computer: Steps to create a virtual deployment instance A computer program according to claim 16 or 17 for further execution of the above.

20. To the aforementioned computer: Steps to generate a resource deployment health report graph A computer program according to claim 16 or 17 for further execution of the above.

Images