Techniques to improve virtual instance detection using disk cloning

Abstract

A system and method for cyber-security threat checks for real-time virtual instances in a cloud computing environment that utilizes disk cloning techniques. The method includes selecting a real-time virtual instance in a cloud computing environment, where the real-time virtual instance includes a disk with a disk descriptor having an address in a cloud storage system. An instruction that clones a disk of the real-time virtual instance is generated, and when executed, the instruction causes a cloned disk descriptor to be generated, the cloned disk descriptor having a data field that includes a disk address of the real-time virtual instance. Performing a network security threat check on the cloned disk, and releasing the cloned disk in response to completion of the disk check.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims priority to U.S. patent application No. 17 / 664,508, filed on May 23, 2022, the contents of which are incorporated herein by reference. Technical Field

[0003] The present disclosure relates generally to detection of vulnerabilities and exposures in cloud computing environments, and more particularly to reducing resources required to detect cybersecurity threats to cloud computing environments. Background Art

[0004] Such as Network Services( Web Services, AWS), Cloud Platform( Cloud Platform (GCP), Azure Azure) and Cloud Infrastructure Cloud computing infrastructure providers such as Open Cloud Infrastructure (OCI) are able to provision hardware resources for multiple tenants (i.e., users and user groups) by creating an abstraction layer and provisioning resources on demand.

[0005] Tenants in a cloud computing infrastructure can deploy their own cloud computing environments on top of the infrastructure and provision resources for them. While the advantages of such cloud computing environments, such as the ability to scale up or down, are well documented, they also present security risks. In essence, these cloud computing environments require network access from outside the cloud computing environment, such as to provide services. This not only allows authorized users to enter the cloud computing environment, but also provides malicious attackers with the opportunity to attempt to enter the cloud computing environment.

[0006] Access to cloud computing environments allows attackers to potentially access sensitive data or use the cloud computing environment's resources for other purposes, such as mining cryptocurrency. Therefore, it is critical to detect vulnerabilities and exposures in cloud computing environments and in workloads deployed therein, such as virtual machines (VMs), containers, and serverless functions.

[0007] There are various solutions for scanning workloads deployed in cloud computing environments. Agent-based solutions require agents to be installed on the workload. This is an additional computational burden because agents are applications that require memory, processing power, etc. to run. For example, agentless-based solutions may require generating a snapshot of a virtual instance (e.g., a virtual machine) disk. When generating a snapshot, the disk is accessed, a snapshot file is generated, and a second disk is mounted based on the generated snapshot, which requires an intermediate step of generating a snapshot file.

[0008] In addition, snapshots are only taken for a single disk, which may cause problems in some cases. For example, Azure virtual machines can be deployed using the following three types of disks: operating system (OS) disk, temporary disk, and data disk. In addition, generating snapshots requires a garbage collection mechanism because snapshot generation may be interrupted, which requires cleaning up garbage data and generating another snapshot until the process succeeds.

[0009] Figure 5 is an example diagram 500 of a virtual machine 512 from which a snapshot is generated according to the prior art. The virtual machine (VM) 512 is deployed as VM. Virtual machine 512 includes multiple disks assigned to virtual machine 512. Virtual machine 512 can be deployed with only an operating system disk, with an operating system disk and multiple data disks, etc. The multiple disks include an operating system (OS) disk 502, an optional temporary disk 504, and at least one data disk 506. Operating system disk 502 includes a pre-installed operating system, such as Windows or The pre-installed operating system is located in the boot volume of the operating system disk 502. The optional temporary disk 504 can be used to store temporary data, such as a page file, swap file, etc. The data disk 506 can be used to store applications, application code, libraries, binaries, application data, etc. In some configurations, the disks in the multiple disks can be further encrypted. For example, the operating system disk 502 and the data disk 506 can be encrypted disks. In some embodiments, the encrypted disk is associated with an encryption key that can be used to decrypt the disk. For example, A virtual machine that has a disk assigned to it can be configured to use BitLocker to encrypt the data disk assigned to the virtual machine. The virtual machine to which the disk is allocated can be configured to use DM Encrypt data disks assigned to virtual machines.

[0010] Multiple disks are allocated to virtual machines 512 by disk-level provisioning 505. In an embodiment, disk-level provisioning 505 is an application deployed in a cloud computing infrastructure. Disk-level provisioning 505 supplies hardware resources to virtual machines 512, which results in the allocation of disks. The hardware resources are supplied from cloud storage pages 510 of the cloud computing infrastructure. The hardware resources can be solid state device (SSD) storage devices, hard disk drive (HDD) storage devices, optical storage devices, other magnetic storage devices, etc. In an example embodiment, cloud storage pages 510 are Azure page binary large objects (page blobs). A page blob is a collection of pages, each of which has a predetermined size. For example, the predetermined size can be 512 bytes per page.

[0011] When creating a snapshot of a virtual machine 512, a disk needs to be selected because a snapshot is a copy of the disk at a certain point in time. Since the snapshot is based on a single disk, the inspection may become complicated when coordinating the use of multiple disks. For example, when disk striping is performed between multiple disks, coordination between snapshots is required. In addition, when a disk snapshot 508 is generated, for example, based on a data disk 506, the snapshot process may be interrupted, resulting in the need to delete pages through a garbage collection mechanism. In addition, if the disk from which the snapshot is generated is an encrypted disk, it is necessary to assign permissions for the checker workload to the disk snapshot 508, as well as access permissions to the encryption keys.

[0012] Therefore, it would be advantageous to provide a solution that overcomes the above challenges. Summary of the invention

[0013] The following is an overview of several example embodiments of the present disclosure. This overview is provided to provide a basic understanding of these embodiments for the convenience of the reader and does not fully limit the breadth of the present disclosure. This overview is not an extensive review of all contemplated embodiments, and is neither intended to identify the key or important elements of all embodiments nor to describe the scope of any or all aspects. Its sole purpose is to present some concepts of one or more embodiments in a simplified form as a prelude to a more detailed description presented later. For convenience, the term "some embodiments" or "certain embodiments" may be used herein to refer to a single embodiment or multiple embodiments of the present disclosure.

[0014] Certain embodiments disclosed herein include a method for performing a network security threat check on a real-time virtual instance in a cloud computing environment. The method includes: selecting a real-time virtual instance in a cloud computing environment, wherein the real-time virtual instance includes a disk having a disk descriptor, the disk descriptor having an address in a cloud storage system; generating an instruction to clone the disk of the real-time virtual instance, the instruction, when executed, causing the generation of a clone disk descriptor, the clone disk descriptor having a data field including the disk address of the real-time simulation instance; performing a network security threat check on the clone disk; and releasing the clone disk in response to completing the disk check.

[0015] Certain embodiments disclosed herein also include a non-transitory computer-readable medium having stored thereon instructions for causing a processing circuit to perform a process, the process including: selecting a real-time virtual instance in a cloud computing environment, wherein the real-time virtual instance includes a disk having a disk descriptor, the disk descriptor having an address in a cloud storage system; generating instructions for cloning the disk of the real-time virtual instance, the instructions, when executed, causing a clone disk descriptor to be generated, the clone disk descriptor having a data field including the disk address of the real-time simulation instance; performing a network security threat check on the clone disk; and releasing the clone disk in response to completing the disk check.

[0016] Certain embodiments disclosed herein also include a system for performing cybersecurity threat checks on real-time virtual instances in a cloud computing environment. The system includes: a processing circuit; and a memory, the memory containing instructions, which, when executed by the processing circuit, configure the system to: select a real-time virtual instance in a cloud computing environment, wherein the real-time virtual instance includes a disk having a disk descriptor, the disk descriptor having an address in a cloud storage system; generate instructions for cloning the disk of the real-time virtual instance, the instructions, when executed, causing a clone disk descriptor to be generated, the clone disk descriptor having a data field including the disk address of the real-time simulation instance; perform cybersecurity threat checks on the clone disk; and release the clone disk in response to completing the disk check. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The subject matter disclosed herein is particularly pointed out and distinctly claimed in the claims at the end of the specification. The above and other objects, features and advantages of the disclosed embodiments will become apparent from the following detailed description taken in conjunction with the accompanying drawings.

[0018] Figure 1 is a schematic diagram of a cloud computing infrastructure implemented according to an embodiment.

[0019] Figure 2 is a schematic diagram of a virtual machine and its cloned disk for describing an embodiment.

[0020] Figure 3is a flow chart of a method for generating a disk clone of a virtual instance for vulnerability checking according to an embodiment.

[0021] Figure 4 is a schematic diagram of a check controller according to an embodiment.

[0022] Figure 5 is a schematic diagram of a virtual machine from which a snapshot is generated according to the prior art. DETAILED DESCRIPTION

[0023] It is important to note that the embodiments disclosed herein are merely examples of the many advantageous uses of the innovative teachings herein. In general, statements in the specification of this application do not necessarily limit any of the various claimed embodiments. In addition, some statements may apply to some inventive features but not to other features. In general, unless otherwise stated, singular elements may be plural and vice versa without loss of generality. In the accompanying drawings, the same reference numerals represent the same parts in several views.

[0024] Various disclosed embodiments include methods and systems for inspecting a disk (original disk) of a live virtual instance deployed in a production environment of a cloud computing environment. The production environment is a cloud computing environment that provides services, resources, etc. to users of the production environment. The original disk is cloned into a clone disk, which includes generating a clone disk descriptor. The original disk is a virtual disk that is assigned a physical storage device by using a disk descriptor. The disk descriptor is a data structure that includes a reference, such as a pointer, to a physical storage address of a shared storage solution in a cloud computing environment. When the clone disk descriptor is generated, the clone disk descriptor contains a pointer to the physical storage address of the original disk. The clone disk can then be inspected while the live virtual instance remains undisturbed. The use of cloud computing resources is reduced, at least because it is not necessary to generate a disk snapshot that is later mounted and inspected. In addition, no copies are generated, so the data is not physically copied, which would require additional storage resources if performed.

[0025] Figure 1 is an example of a schematic diagram of a cloud computing infrastructure 100 implemented according to an embodiment. The cloud computing infrastructure 100 may be, for example Web Services (AWS), Cloud platform (GCP), Azure, Cloud infrastructure (OCI), etc. In an embodiment, multiple cloud computing infrastructures may be used, each of which is provided with at least one cloud computing environment. The cloud computing environment 110 is provided on the cloud computing infrastructure 100. The cloud computing environment 110 may be, for example, a virtual private cloud (VPC) provided on Azure.

[0026] The cloud computing environment 110 includes cloud entities, such as resources and principals. Resources are cloud entities that provide functions such as processing power, memory, storage devices, communications, etc. Resources can provide more than one function. Resources can include, for example, virtual machines (VMs) such as virtual machines 112, container engines such as container engines 114, serverless functions such as serverless functions 116, and so on. As used herein, unless otherwise specified, the terms "resources," "virtual instances," and "workloads" are used interchangeably. The cloud computing environment 110 may also include application programming interfaces (APIs) through which actions in the cloud environment can be triggered. The container engine can use Serverless functions can be implemented using Implementation. The virtual machine can use It can be implemented through VirtualBox, Azure virtual machine, etc.

[0027] In an embodiment, an Azure VM is deployed with an operating system (OS) disk, a temporary disk, and at least one data disk. It should be noted that in some embodiments, a virtual machine may be deployed with only an operating system disk. The at least one data disk is a managed disk that is attached to the virtual machine and used to store, for example, application data, generated content, etc. The operating system disk includes a pre-installed operating system and contains a boot volume. The temporary disk is an unmanaged optional disk used for short-term storage, such as for storing page files, swap files, etc. An example of a virtual machine 112 is shown below. Figure 2 A and 2B are discussed in more detail.

[0028] A principal is a cloud entity that acts on a resource, meaning it can request or otherwise initiate actions or operations in the cloud environment that cause a resource to perform a function. A principal can be, for example, a user account, a service account, a role, etc. In an embodiment, a principal is implemented as a data structure that includes information about the entity such as a username, password hash, associated roles, etc.

[0029] The cloud computing environment 110 is connected to the inspection environment 120. The inspection environment 120 is a cloud computing environment. In an embodiment, the inspection environment 120 is deployed on the cloud computing infrastructure 100, in another cloud computing infrastructure, or in a combination thereof. In some embodiments, a portion of the inspection environment 120 is deployed in the cloud computing environment 110. In some embodiments, some instances deployed in the inspection environment 120 can be deployed in the cloud computing environment 110.

[0030] The inspection environment 120 includes multiple inspectors (e.g., inspector 124) workloads. The inspector 124 is configured to inspect workloads (i.e., virtual instances) of the cloud computing environment 110. In some embodiments, the inspector (e.g., inspector 124) can be configured to inspect other cloud entities such as user accounts. In an embodiment, a storage device, such as a disk of a virtual machine, can be cloned. As will be discussed below, the cloned disk can be accessed by the inspector 124. The inspector 124 can perform security object (e.g., secrets, keys, user account information, etc.) inspection on the cloned disk of the workload. In some embodiments, the inspector 124 performs application, operating system, binary file, library, etc. inspection on the cloned workload.

[0031] In an embodiment, a clone disk is generated by generating instructions, which may be a clone of, for example, a data disk, an operating system disk, etc. When the instructions are executed by a cloud computing environment (e.g., by an orchestrator 111 of the cloud computing environment), the instructions generate a disk descriptor based on a virtual instance descriptor (e.g., a virtual machine descriptor). In a cloud computing environment, the orchestrator 111 is an application that configures, coordinates, and manages applications, deployments, etc. The virtual instance descriptor includes an address where the contents of the disk are stored. For example, the address may be an address of a page in a shared storage solution. The disk descriptor is a data structure that includes a data field that includes an original address from the virtual instance descriptor.

[0032] Cloned disks are immediately available for inspection because generating disk descriptors is an instant operation. In contrast, generating snapshots requires copying data, which is only available for inspection after the snapshot generation is complete. Therefore, disk cloning provides faster access to disks for inspection and also requires fewer computing resources to perform such inspections. This is advantageous because cloning does not interfere with live virtual instances (i.e., virtual instances deployed in production environments) while allowing access to their data disks without requiring cloud resources other than generating cloned disk descriptors. Inspection of cloned disks is discussed in more detail below.

[0033] The inspection environment 120 also includes a security database 122, which is a graph database. The security graph can be stored on the security database 122. The security graph includes a representation of the cloud computing environment 110. For example, the cloud entities of the cloud computing environment 110 can each be represented as a node in the security graph. In an embodiment, the security graph is generated based on objects detected by an inspector (such as the inspector 124). In an embodiment, a virtual instance (e.g., a virtual machine) is represented by a node stored in the security graph. Disks such as operating system disks, data disks, etc. are also each represented by a node that is connected to a node representing a virtual instance. In some embodiments, generating instructions for inspecting a virtual instance also includes querying the security graph to determine an identifier of a disk connected to the virtual instance by generating a query to detect a node representing a disk connected to another node representing the virtual instance.

[0034] Also included in the inspection environment 120 is a controller 126. In an embodiment, the controller 126 is a workload deployed in the inspection environment 120 that is configured to initiate an inspection of the cloud computing environment 110. For example, initiating an inspection may include determining which cloud entities to inspect, when to inspect them, and the like.

[0035] Figure 2 is an example diagram 200 of a virtual machine 112 and its cloned disk used to describe an embodiment. Cloud computing infrastructure, but it should be understood that the teachings herein are also applicable to other cloud computing infrastructures that provide the same functionality. Virtual machine 112 includes multiple disks assigned to virtual machine 112. Virtual machine 112 may deploy only an operating system disk, an operating system disk and multiple data disks, and the like.

[0036] In this example embodiment, the plurality of disks includes an operating system (OS) disk 202, an optional temporary disk 204, and at least one data disk 206. The operating system disk 202 includes a pre-installed operating system, such as Windows or The pre-installed operating system is located in the boot volume of the operating system disk 202. The optional temporary disk 204 can be used to store temporary data, such as page files, swap files, etc. The data disk 206 can be used to store applications, application code, libraries, binaries, application data, etc. In an embodiment, multiple data disks 206 can be assigned to the virtual machine 112. In some configurations, the disks in the multiple disks can be encrypted. For example, the operating system disk 202 and the data disk 206 can be encrypted disks. In some embodiments, the encrypted disk is associated with an encryption key that can be used to decrypt the disk. For example, a disk with A virtual machine that has a disk assigned to it can be configured to use BitLocker to encrypt the data disk assigned to the virtual machine. The virtual machine to which the disk is allocated can be configured to use DM Encrypt data disks assigned to virtual machines.

[0037] Multiple disks are allocated to the virtual machine 112 by disk-level provisioning 205. In an embodiment, disk-level provisioning 205 is an application deployed in a cloud computing infrastructure. Disk-level provisioning 205 supplies hardware resources to the virtual machine 112, which results in the allocation of disks. The hardware resources are supplied by cloud storage pages 210 of the cloud computing infrastructure. The hardware resources can be solid-state device (SSD) storage devices, hard disk drive (HDD) storage devices, optical storage devices, other magnetic storage devices, etc. In an example embodiment, the cloud storage page 210 is an Azure page blob. A page blob is a collection of pages, each of which has a predetermined size. For example, the predetermined size can be 512 bytes per page.

[0038] The disk clone 212 (also referred to as a clone disk 212) includes a disk descriptor that includes a reference to the disk address of the virtual machine 112. In some cloud computing infrastructures, when a disk is cloned, a pointer (such as pointer 216) is used to point to the original disk, which in this example is the data disk 206. In an embodiment, this can be achieved by dereferencing the virtual machine 112 pointer pointing to the data disk 206 and generating a pointer 216 pointing to the data disk 206 for the cloned virtual machine 212. In some embodiments where the disk is encrypted, a pointer to an encryption key can be generated for the cloned virtual machine 212.

[0039] In an embodiment, the cloning process generates the disk clone 212 as a background process. This is possible because differences (diffs) are utilized. Differences are additional content that includes the difference between the content at one point in time (e.g., when the original disk was cloned) and the content at a second later point in time. Therefore, the virtual machine 112 can access the data disk 206 and any differences generated or committed after the disk clone 212 is generated, while the disk clone 212 can only access the content of the original data disk 206 and cannot access any differences generated thereafter.

[0040] The clone disk 212 can then be checked by the checker (as above) Figure 1 In some embodiments, the cloud computing infrastructure may be divided into regions corresponding to geographic regions. In such embodiments, it is possible to clone a disk only if the disk clone is located in the same region as the original disk from which the clone was generated. In an embodiment, the inspection controller (e.g., Figure 1The controller 126 of the virtual instance can determine whether the disk clone or snapshot needs to be generated. In an embodiment, the determination is performed based on the geographic location of the virtual machine 112, the expected geographic location to which the disk of the virtual machine 112 is cloned, the geographic location of the inspection environment, the number of disks allocated to the virtual instance, or any combination thereof.

[0041] By checking the clone disk 212, no snapshot needs to be generated, which can prevent at least some of the above-mentioned drawbacks. In addition, the cloning is performed on a real-time virtual instance, which remains real-time during the inspection because the cloning does not interfere with the operation of the virtual instance. Once the inspection of the clone disk 212 is completed, the clone disk 212 can be spun down, releasing any resources allocated to it, and deleting the pointer to the virtual machine disk. In an embodiment, the clone disk 212 can be deleted to complete the spin down.

[0042] Figure 3 is an example flow chart 300 of a method for generating a disk clone of a virtual instance for vulnerability checking according to an embodiment.

[0043] At S310, a live virtual instance is detected in a cloud computing environment. A live virtual instance is a virtual instance deployed in a production environment at the time of detection. A production environment is a cloud computing environment that provides services and resources to users of the cloud computing environment. For example, this is an environment different from a test environment, in which applications, devices, codes, etc. are tested before being deployed in a production environment for general use.

[0044] In an embodiment, an application programming interface (API) of a cloud computing environment may be queried to detect virtual instances deployed therein. In other embodiments, a security graph may be queried to detect virtual instances deployed in a cloud computing environment. A security graph comprising a representation of a cloud computing environment may be queried to detect virtual instances based on at least one attribute. The at least one attribute may be, for example, a type of virtual instance (e.g., a virtual machine, a container, etc.), a region where the virtual instance is deployed, a tag indicating a virtual instance that should be checked, and the like.

[0045] In an embodiment, detecting the virtual instance further comprises determining an identifier of the virtual instance, such as a name, a network address, etc. The identifier can be used to access the virtual instance. The virtual instance comprises a disk (also referred to as a raw disk). In some embodiments, the disk is represented in the security graph as a node that is connected to another node that represents the virtual instance.

[0046] In some embodiments, detecting the real-time virtual instance includes receiving an identifier of the real-time virtual instance and instructions to inspect the real-time virtual instance.

[0047] At S320, an instruction is generated that, when executed, configures the cloud computing environment to clone the disk of the virtual instance. In an embodiment, the instruction is generated for execution by an orchestrator of a cloud computing environment that deploys a virtual instance (also referred to as a parent virtual instance). When executed, the instruction configures, for example, the cloud computing environment to allocate resources to the cloned disk. The cloned disk is an independent copy of the original disk of the parent virtual instance. An independent copy of a disk refers to a copy that can be deployed and accessed independently of the original disk. This is in contrast to a copy of a virtual instance (such as a snapshot), which requires additional resources to be allocated to deploy.

[0048] For example, a snapshot can be generated based on a single disk of a virtual instance. A new disk (e.g., a persistent volume) can be generated based on the snapshot, and a claim (e.g., a persistent volume claim) can be made to another virtual instance to access data stored on the new disk. Furthermore, a snapshot is only available after the disk has been fully copied. In contrast, a clone can be used immediately because the operation of generating a disk descriptor is faster than the operation of generating a snapshot. At least for this reason, the check completes faster.

[0049] In some embodiments, the instructions, when executed, configure the cloud computing environment to generate a clone disk with a reference (e.g., a pointer) that points to the original disk of the parent virtual instance. In some embodiments, the disk is encrypted by an encryption key. Both the encryption key and the disk may be dereferenced. Dereferencing the encryption key (or disk) may include determining where the pointer of the parent virtual instance points, for example, the pointer points to a block address of a managed block store. A new pointer may be stored for the clone disk that points to the same block address, encryption key, etc. as the dereferenced pointer.

[0050] In some embodiments, an optional check is performed to determine whether the clone disk is configured to be placed in the same region as the parent virtual instance. The cloud computing infrastructure may limit the ability to clone disks outside of the region. For example, if the check environment is not in the same region as the cloud computing environment of the check virtual instance, it may not be possible (i.e., not allowed) to generate a disk clone in the region where the check environment is located.

[0051] In other embodiments, an optional check may be performed to determine the number of disks associated with the virtual instance. For example, if the number of disks is equal to or exceeds a predetermined threshold, a cloning process may be initiated, otherwise a snapshot may be generated and the generated snapshot may be checked.

[0052] At S330, the cloned disk is checked for network security threats. In an embodiment, network security threats include but are not limited to exposure, vulnerability, malware, ransomware, spyware, automated programs, weak passwords, exposed passwords, exposed certificates, outdated certificates, configuration errors, suspicious events, etc.

[0053] In an embodiment, checking the clone disk includes assigning a checker to the clone disk. In some embodiments, assigning a checker (e.g. Figure 1 The checker 124 of the cloned disk provides access to the cloned disk. For example, the cloning process may include generating instructions that, when executed, configure the cloned disk to allow the checker workload to access the disk. The checker may check the cloned disk for security objects such as files, folders, etc. The security objects may be, for example, plaintext stored passwords, plaintext stored passwords, certificates, etc.

[0054] For example, in an embodiment, a signature of a file, folder, etc. is generated during the check. Such a signature matches another known signature. The known signature indicates the presence of a vulnerability. For example, a signature can be generated using a checksum.

[0055] At S340, the cloned disk is released. In an embodiment, an instruction may be generated that, when executed, configures the cloud computing environment to release the cloned disk. Releasing the cloned disk may include, for example, deprovisioning resources allocated to the cloned disk. For example, the cloned disk may be deleted. Responsive to completing the check, releasing the cloned disk is performed.

[0056] Although virtual machines are discussed in the present disclosure, it should be understood that the teachings herein are equally applicable to other virtual instances in terms of cloning and snapshotting.

[0057] Figure 4 4 is an example schematic diagram of an inspection controller 126 (controller 126) according to an embodiment. The controller 126 includes a processing circuit 410 coupled to a memory 420, a storage device 430, and a network interface 440. In an embodiment, the components of the controller 126 may be communicatively connected via a bus 450.

[0058] Processing circuit 410 may be implemented as one or more hardware logic components and circuits. For example, but not limited to, exemplary types of hardware logic components that may be used include field programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), system-on-a-chip (SOCs), graphics processing units (GPUs), tensor processing units (TPUs), general-purpose microprocessors, microcontrollers, digital signal processors (DSPs), etc., or any other hardware logic components that can perform calculations or other information operations.

[0059] The memory 420 may be volatile (eg, random access memory, etc.), non-volatile (eg, read-only memory, flash memory, etc.), or a combination thereof.

[0060] In one configuration, software for implementing one or more embodiments disclosed herein may be stored in storage device 430. In another configuration, memory 420 is configured to store such software. Software should be broadly interpreted as any type of instruction, whether referred to as software, firmware, middleware, microcode, hardware description language or other. Instructions may include code (e.g., source code format, binary code format, executable code format, or any other suitable code format). When executed by processing circuit 410, the instructions cause processing circuit 410 to perform various processes described herein.

[0061] The storage device 430 may be a magnetic storage device, an optical storage device, etc., and may be implemented as, for example, flash memory or other memory technology, a compact disk-read only memory (CD-ROM), a digital versatile disk (DVD), or any other medium that can be used to store the desired information.

[0062] The network interface 440 allows the controller 126 to communicate with, for example, the inspector 124 , the security database 122 , etc.

[0063] It should be understood that the embodiments described herein are not limited to Figure 4 While specific architectures are shown, other architectures may likewise be used without departing from the scope of the disclosed embodiments.

[0064] The various embodiments disclosed herein may be implemented as hardware, firmware, software, or any combination thereof. In addition, the software is preferably implemented as an application program tangibly embodied in a program storage unit or a computer-readable medium consisting of a component or certain devices and / or a combination of devices. The application program can be uploaded to and executed by a machine including any suitable architecture. Preferably, the machine is implemented on a computer platform having hardware such as one or more central processing units (central processing units, "CPUs"), memory, and input / output interfaces. The computer platform may also include an operating system and microinstruction codes. The various processes and functions described herein may be a part of a microinstruction code or a part of an application program that may be executed by a CPU (whether or not such a computer or processor is explicitly shown), or any combination thereof. In addition, various other peripheral units may be connected to the computer platform, such as an additional data storage unit and a printing unit. In addition, a non-transient computer-readable medium is any computer-readable medium other than a transient propagation signal.

[0065] All examples and conditional language listed herein are intended for teaching purposes to help readers understand the principles of the disclosed embodiments and the concepts contributed by the inventors to further develop the art, and should be interpreted as not being limited to these specifically listed examples and conditions. In addition, all statements of the principles, aspects, and embodiments of the disclosed embodiments listed herein, as well as their specific examples, are intended to cover equivalents of both their structures and functions. In addition, such equivalents are intended to include currently known equivalents and equivalents developed in the future, i.e., any element that performs the same function, regardless of its structure, is developed.

[0066] It should be understood that any reference to an element using the names "first", "second" etc. herein will not generally limit the quantity or order of these elements. On the contrary, these names are generally used as a convenient method to distinguish two or more elements or element instances in this article. Therefore, referring to the first and second elements does not mean that only two elements can be used there, nor does it mean that the first element must precede the second element in some way. In addition, unless otherwise stated, a group of elements includes one or more elements.

[0067] As used herein, the phrase "at least one" followed by a list of items means that any one of the listed items may be used alone or in any combination of two or more of the listed items may be used. For example, if a system is described as including "at least one of A, B, and C," the system may include only A; only B; only C; 2A; 2B; 2C; 3A; a combination of A and B; a combination of B and C; a combination of A and C; a combination of A, B, and C; a combination of 2A and C; a combination of A, 3B, and 2C; and so on.

Claims

1. A method for performing network security threat inspection on a real-time virtual instance in a cloud computing environment, comprising: Selecting a real-time virtual instance in a cloud computing environment, wherein the real-time virtual instance includes a disk having a disk descriptor, the disk descriptor having an address in a cloud storage system; generating instructions for cloning a disk of the real-time virtual instance, the instructions, when executed, causing generation of a clone disk descriptor having a data field including a disk address of the real-time virtual instance; Perform cybersecurity threat checks on cloned disks; and In response to completing the disk check, the clone disk is released.

2. The method according to claim 1, further comprising: A pointer to an encryption key of the clone disk descriptor is generated, the encryption key being used to encrypt the disk.

3. The method according to claim 1, wherein: The clone disk descriptor includes a pointer to a storage block address in a managed storage of the cloud computing environment.

4. The method according to claim 1, further comprising: Dereferencing a disk pointer of the real-time virtual instance; as well as A pointer to the clone disk descriptor is generated based on a dereference pointer of the disk of the real-time virtual instance.

5. The method according to claim 1, wherein: Performing a network security threat check on the cloned disk also includes: performing any of the following checks on the cloned disk: exposure, vulnerability, malware, ransomware, spyware, automated programs, weak passwords, exposed passwords, exposed certificates, configuration errors, suspicious events, and any combination thereof.

6. The method according to claim 1, further comprising: In response to completing the check of at least one disk, the clone disk descriptor is deprovisioned.

7. The method according to claim 1, wherein: During the inspection, the virtual instance remains in real time.

8. The method according to claim 1, wherein: The real-time virtual instance is detected in the cloud computing environment.

9. The method according to claim 1, further comprising: A security graph is queried to detect disk nodes representing disks connected to virtual instance nodes representing the real-time virtual instances, wherein the security graph represents the cloud computing environment.

10. A non-volatile computer-readable medium having stored thereon instructions for causing a processing circuit to perform a process, the process comprising: Selecting a real-time virtual instance in a cloud computing environment, wherein the real-time virtual instance includes a disk having a disk descriptor, the disk descriptor having an address in a cloud storage system; generating instructions for cloning a disk of the real-time virtual instance, the instructions, when executed, causing generation of a clone disk descriptor having a data field including a disk address of the real-time virtual instance; Perform cybersecurity threat checks on cloned disks; and In response to completing the disk check, the clone disk is released.

11. A system for performing network security threat inspection on real-time virtual instances in a cloud computing environment, comprising: Processing circuit; as well as a memory comprising instructions that, when executed by the processing circuit, configure the system to: Selecting a real-time virtual instance in a cloud computing environment, wherein the real-time virtual instance includes a disk having a disk descriptor, the disk descriptor having an address in a cloud storage system; generating instructions for cloning a disk of the real-time virtual instance, the instructions, when executed, causing generation of a clone disk descriptor having a data field including a disk address of the real-time virtual instance; Perform cybersecurity threat checks on cloned disks; and In response to completing the disk check, the clone disk is released.

12. The system according to claim 11, wherein: The memory also includes instructions that, when executed by the processing circuit, further configure the system to: A pointer to an encryption key of the clone disk descriptor is generated, the encryption key being used to encrypt the disk.

13. The system according to claim 11, wherein: The clone disk descriptor includes a pointer to a storage block address in a managed storage of the cloud computing environment.

14. The system according to claim 11, wherein: The memory also includes instructions that, when executed by the processing circuit, further configure the system to: dereferencing a disk pointer of the real-time virtual instance; and A pointer to the clone disk descriptor is generated based on a dereference pointer of the disk of the real-time virtual instance.

15. The system according to claim 11, wherein: The memory also includes instructions that, when executed by the processing circuit, further configure the system to: The cloned disk is checked for any of the following: exposure, vulnerability, malware, ransomware, spyware, automated programs, weak passwords, exposed passwords, exposed certificates, configuration errors, suspicious events, and any combination thereof.

16. The system according to claim 11, wherein: The memory also includes instructions that, when executed by the processing circuit, further configure the system to: In response to completing the check of at least one disk, the clone disk descriptor is deprovisioned.

17. The system of claim 11, wherein: During the inspection, the virtual instance remains in real time.

18. The system of claim 11, wherein: The real-time virtual instance is detected in the cloud computing environment.

19. The system of claim 11, wherein: The memory also includes instructions that, when executed by the processing circuit, further configure the system to: A security graph is queried to detect disk nodes representing disks connected to virtual instance nodes representing the real-time virtual instances, wherein the security graph represents the cloud computing environment.

Images