Techniques for secure deployment of infrastructure, i.e., code

Abstract

A system and method for secure deployment of computing infrastructure resources. The method includes identifying a first set of attributes in original definitions of computing infrastructure resources, where each original definition is a definition of a respective computing infrastructure resource; mapping the first set of attributes to a second set of attributes of a generic definition template to determine a matching generic definition template for each original definition, where each of the generic definitions corresponds to a respective type of computing infrastructure resource and is defined in a unified format; converting the original definition into a generic definition using the generic definition template, where converting each original definition further comprises: inserting at least one of the first set of attributes into a matching generic definition template for the original definition; and managing deployment of the computing infrastructure resources based on the generic definition.

Description

[0001] Cross - reference to related applications

[0002] This application claims priority to U.S. Patent Application No. 17 / 815,289, filed on July 27, 2022, which is currently pending and the content of which is incorporated herein by reference. Technical Field

[0003] The present disclosure generally relates to network security of a computing environment, and more particularly, to securing a computing environment by managing the deployment of computing infrastructure resources. Background Art

[0004] Infrastructure as code (IaC) is a management technique for computing infrastructure in a high - level descriptive model. IaC allows for the automated provisioning of information technology (IT) infrastructure without the need for developers to manually provision and manage servers, operating systems, database connections, storage, and other infrastructure components when developing, testing, and deploying software applications. The goal of IaC is typically to provision cloud resources from code.

[0005] In IaC, the infrastructure can include various computing infrastructure resources such as network adapters, applications, containers, etc., each of which can be implemented as code. IaC files are processed or executed in order to provide these computing infrastructure resources in a cloud environment.

[0006] Although IaC allows for the effective automation of cloud provisioning, the automation also brings the risk of misconfiguration, which can affect the security of the cloud environment. For example, a virtual machine intended for internal use may be exposed to the Internet, or a database that should be encrypted may be misconfigured as unencrypted. If not detected before provisioning, such misconfigurations can leave cloud resources vulnerable to cyberattacks.

[0007] Therefore, it would be advantageous to provide a solution that can overcome the above - mentioned challenges. Summary of the Invention

[0008] An overview of several example embodiments of the present disclosure is as follows. This overview is provided to facilitate a basic understanding of these embodiments by the reader and does not fully define the scope of the present disclosure. This overview is not an extensive review of all contemplated embodiments and is neither intended to identify the key or important elements of all embodiments nor to depict the scope of any or all aspects. Its sole purpose is to present some concepts of one or more embodiments in a simplified form as a prelude to the more detailed description presented later. For convenience, the term "some embodiments" or "certain embodiments" may be used herein to refer to a single embodiment or multiple embodiments of the present disclosure.

[0009] Certain embodiments disclosed herein include a method for securely deploying computing infrastructure resources. The method includes: identifying a first plurality of attributes in a plurality of original definitions of a plurality of computing infrastructure resources, wherein each original definition is a definition of a corresponding computing infrastructure resource of the plurality of computing infrastructure resources; mapping the first plurality of attributes to a second plurality of attributes of a plurality of general definition templates to determine a matching general definition template for each original definition, wherein each of the plurality of general definitions corresponds to a corresponding type of computing infrastructure resource and is defined in a unified format; using the plurality of general definition templates to convert the plurality of original definitions into a plurality of general definitions, wherein converting each original definition further includes: inserting at least one of the first plurality of attributes into the matching general definition template for the original definition; and managing the deployment of the plurality of computing infrastructure resources based on the plurality of general definitions.

[0010] Certain embodiments of the present disclosure further include a non-transitory computer-readable medium storing thereon a process for a processing circuit to execute, the process including: identifying a first plurality of attributes in a plurality of original definitions of a plurality of computing infrastructure resources, wherein each original definition is a definition of a corresponding computing infrastructure resource of the plurality of computing infrastructure resources; mapping the first plurality of attributes to a second plurality of attributes of a plurality of general definition templates to determine a matching general definition template for each original definition, wherein each of the plurality of general definitions corresponds to a corresponding type of computing infrastructure resource and is defined in a unified format; using the plurality of general definition templates to convert the plurality of original definitions into a plurality of general definitions, wherein converting each original definition further includes: inserting at least one of the first plurality of attributes into the matching general definition template for the original definition; and managing the deployment of the plurality of computing infrastructure resources based on the plurality of general definitions.

[0011] Certain embodiments of the present disclosure further include a system for securely deploying computing infrastructure resources. The system includes: a processing circuit; and a memory containing instructions that, when executed by the processing circuit, configure the system to: identify a first plurality of attributes in a plurality of original definitions of a plurality of computing infrastructure resources, wherein each original definition is a definition of a corresponding computing infrastructure resource of the plurality of computing infrastructure resources; map the first plurality of attributes to a second plurality of attributes of a plurality of general definition templates to determine a matching general definition template for each original definition, wherein each of the plurality of general definitions corresponds to a corresponding type of computing infrastructure resource and is defined in a unified format; use the plurality of general definition templates to convert the plurality of original definitions into a plurality of general definitions, wherein converting each original definition further includes: inserting at least one of the first plurality of attributes into the matching general definition template for the original definition; and managing the deployment of the plurality of computing infrastructure resources based on the plurality of general definitions. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] The subject matter of the present disclosure is particularly pointed out and distinctly claimed in the claims of the specification. The foregoing and other objects, features, and advantages of the disclosed embodiments will become apparent from the following detailed description taken in conjunction with the accompanying drawings.

[0013] Figure 1 is a network diagram for describing various disclosed embodiments.

[0014] Figure 2 is a flowchart showing a method for managing the deployment of computing infrastructure resources according to an embodiment.

[0015] Figure 3 is a flowchart of a method for transforming cloud resource definitions according to an embodiment.

[0016] Figure 4 is a schematic diagram of a deployment manager according to an embodiment. DETAILED DESCRIPTION

[0017] It should be noted that the embodiments of the present disclosure are merely examples of many useful applications of the innovative teachings herein. In general, statements made in the specification of this application do not necessarily limit any of the various claimed embodiments. Additionally, some statements may apply to some inventive features but not to others. In general, unless otherwise stated, without loss of generality, a single element may be plural and vice versa. In the drawings, the same numerals refer to the same parts in several views.

[0018] The various disclosed embodiments include methods and systems for detecting misconfigurations in a computing environment, particularly methods and systems for detecting misconfigurations based on the definition of computing infrastructure resources used to provision such resources. The disclosed embodiments can be used to detect misconfigurations in infrastructure - as - code (IaC) files before production (e.g., before provisioning cloud resources) and prevent misconfigured IaC files from entering production, thereby avoiding exposure to network threats resulting from the use of misconfigured files. Similarly, the disclosed embodiments can be used to verify that IaC files are correctly configured before production. In summary, the disclosed embodiments allow for the management of the deployment of computing infrastructure resources to ensure the secure deployment of computing infrastructure resources by allowing the deployment of correctly configured resources and preventing the deployment of misconfigured resources.

[0019] The disclosed embodiments can be implemented in a cloud-agnostic and IaC-agnostic manner, such that misconfigurations can be detected and correct configurations can be verified, regardless of the cloud technologies and IaC technologies used in the software development infrastructure, and such that it is not necessary to define different policies for each IaC language used to provision computing infrastructure resources in a computing environment. Additionally, the disclosed embodiments allow policies to be defined in a common format with respect to the common definition of computing infrastructure resources, such that the policies can be enforced regardless of the computing language used to implement the computing environment.

[0020] In an embodiment, a common definition template for various types of computing infrastructure resources is created as a representation of the different types of computing infrastructure resources, which includes attributes that collectively define these different types of computing infrastructure resources. By matching the attributes indicated in the original definition with the attributes in the common definition template, the original definition of a particular computing infrastructure resource is converted into a corresponding common definition to identify the common definition template for each original definition and to insert one or more attributes indicated by each original definition into its corresponding matching common definition template.

[0021] Based on the common definition of the computing infrastructure resources and the applicable policies of the cloud infrastructure, one or more misconfigurations are detected, correct configurations are verified, or both. Remedial actions can be performed, such as but not limited to adding, removing, or modifying the code of the misconfigured computing infrastructure resources in an attempt to correct the configurations of those misconfigured computing infrastructure resources. The deployment of the computing infrastructure resources is managed based on whether each resource is correctly configured. For example, misconfigured computing infrastructure resources are blocked from being deployed, while correctly configured resources (or groups of resources for which no misconfiguration is detected) are allowed to be deployed.

[0022] In a further embodiment, converting the original definition of the computing infrastructure resources into a common definition includes: applying a policy engine to the original definitions. The attributes are identified in the original definitions. A semantic analysis is performed on the identified attributes with respect to known semantic concepts that represent potential attributes of the computing infrastructure resources, which semantic concepts, when combined, can uniquely identify the type of the computing infrastructure resources. Based on the results of the semantic analysis, the attributes are mapped to the attributes indicated in the common definition template of the potential type of computer resources. Based on this mapping, an applicable common definition template can be determined for each computing infrastructure resource represented by one of the original definitions. By inserting one or more attributes indicated by the original definition into the common definition template determined for the computing infrastructure resource, each original definition is converted into a common definition of the computing infrastructure resource.

[0023] The disclosed embodiments can also be used to apply policies to a hybrid environment that utilizes multiple different forms of cloud computing and / or IaC technologies that utilize resource provisioning definitions in different languages. More specifically, policies can be applied to such different language definitions without having to completely re-evaluate and re-format all those policies according to the different languages used.

[0024] In addition, as described herein, converting the definition of computing infrastructure resources to a common definition allows policies to be defined for types of computing infrastructure resources without having to define policies for specific computing infrastructure resources. As a non-limiting example, a policy for unencrypted cloud storage that should not be publicly accessible can be defined relative to a common definition of cloud storage infrastructure resources (i.e., computing infrastructure resources for cloud storage), based on an attribute of the cloud storage infrastructure resource (i.e., an attribute indicating whether each cloud storage is publicly accessible). In contrast, existing solutions require such policies to be defined for specific storage services and the specific cloud storage referred to by those services.

[0025] Figure 1 Example network diagram 100 is shown for describing various disclosed embodiments. Example network diagram 100 illustrates a cloud computing platform 110, a knowledge base 120, and a deployment manager 130. The cloud computing platform 110 can be implemented via one or more networks, such as but not limited to wireless, cellular, or wired networks, local area network (LAN), wide area network (WAN), metro area network (MAN), the Internet, the worldwide web (WWW), similar networks, and any combination thereof.

[0026] The cloud computing platform 110 includes an IaC processor 112 and one or more cloud computing infrastructure resources 115. The IaC processor 112 can be configured to deploy and host web applications uploaded to the cloud computing platform 110 by one or more software developer devices (not shown). To this end, the IaC processor 112 includes an IaC definition file (not shown) that includes the original definition of the cloud computing infrastructure resources 115 and the rules for provisioning the cloud computing infrastructure resources 115. The cloud computing infrastructure resources 115 include computing components implemented as code and can include, but are not limited to, network adapters, software applications, containers, virtual machines, repositories, databases, and combinations thereof.

[0027] The knowledge base 120 stores data for managing the deployment of computing infrastructure resources through misconfiguration detection and / or verification. Such data may include, but is not limited to, a set of universal definition templates (UDT) 121, a semantic concepts dictionary (SCD) 122, and an entity graph (EG) 123.

[0028] The universal definition template 121 represents different types of computing infrastructure resources using attributes in a universal format. Thus, the universal definition can be compared with the original definition of a particular computing infrastructure resource with respect to these attributes to determine the type of each of those computing infrastructure resources, regardless of how the type of those computing infrastructure resources is represented in the original definition. As a non-limiting example, the universal definition template 121 may include definitions of types of computing infrastructure resources such as "network interface", "virtual machine", and "network adapter", each expressed using a corresponding combination of attributes in a universal format. As described herein, the universal definition template 121 can be matched with the attributes indicated in the original definition of a computing infrastructure resource and used to transform the matched original definition.

[0029] The semantic concepts dictionary 122 includes entries defining semantic concepts that indicate attributes of different types of entities, such as, but not limited to, configuration, encryption, backup, connection to an external system, connection to a network, connection to a storage device, memory size, geographical region, and combinations thereof. These semantic concepts can be used to transform the original definition of a computing infrastructure resource into a universal definition as further described below.

[0030] The entity graph 123 is a graph that links nodes representing entity identification values, such as, but not limited to, resource names, unique identifiers, etc. The entities represented by these values may include, but are not limited to, computing infrastructure resources in the computing infrastructure resource 115.

[0031] The entity graph 123 can provide an end-to-end view of all domains of the software infrastructure, including the connections between components of these domains, thereby establishing potential connections between any two given components in the software infrastructure and their respective domains. To this end, the entity graph 123 includes at least nodes representing the cloud computing infrastructure resources 115 and edges representing the connections between those cloud computing infrastructure resources 115. The entity graph 123 includes schematic data that links different domains and shows the links within each domain. In some embodiments, the domains may include domains representing the various layers of the software infrastructure and domains representing event logic components related to network security events (e.g., policies, code defining business logic, queries, etc.).

[0032] In an embodiment, the deployment manager 130 is configured to analyze the original definitions of the cloud computing infrastructure resources 115 stored in the IaC processor 112 and convert these original definitions into general definitions using the general definition template 121. Based on the general definitions and according to one or more applicable policies of the cloud computing infrastructure resources 115, the deployment manager 130 is configured to detect one or more misconfigurations. In a further embodiment, the deployment manager 130 may be configured to remedy such misconfigurations, for example, by removing code, preventing the deployment of one or more cloud computing infrastructure resources 115 (e.g., preventing deployment during production in a continuous integration / continuous deployment pipeline), severing connections between cloud computing infrastructure resources 115, isolating one or more cloud computing infrastructure resources 115, generating alerts, and combinations thereof.

[0033] In another embodiment, the deployment manager 130 is configured to manage the deployment of computing infrastructure resources in the cloud computing platform 110 based on the general definitions. To this end, in some implementations, the deployment manager 130 may communicate with the IaC processor 112 to control which computing infrastructure resources are deployed in the computing infrastructure resources 115, for example, by determining whether these computing infrastructure resources are correctly configured based on their respective general definitions of the computing infrastructure resources 115 and allowing or blocking the deployment according to whether each computing infrastructure resource to be deployed is correctly configured.

[0034] Various example general definition templates are as follows. More specifically, the following non-limiting examples show sets of example attributes for corresponding types of computing infrastructure resources (e.g., virtual machines, cloud storage infrastructure resources, cryptographic keys, firewall rules, and container repositories). Combinations of other types of computing infrastructure resources and / or attributes may be equally utilized without departing from the scope of the present disclosure.

[0035] Example 1: Virtual Machine - Attributes include:

[0036] 1. Does it have access to the Internet (yes / no)?

[0037] 2. List of attached network interfaces

[0038] 3. Geographic region of the virtual machine

[0039] 4. Virtual processor type

[0040] 5. List of attached virtual storage devices.

[0041] 6. Memory size of the virtual machine

[0042] Example 2: Cloud Storage Infrastructure Resource - Attributes include:

[0043] 1. Does it have a backup?

[0044] 2. Is it encrypted?

[0045] 3. Can it be accessed from the Internet?

[0046] 4. Are any accesses to resources logged?

[0047] 5. Is version control enabled?

[0048] Example 3: Password Key - Attributes include:

[0049] 1. Allowed key actions (encryption / decryption / digital signature, etc.)

[0050] 2. Key rotation configuration

[0051] 3. Symmetric or asymmetric key?

[0052] Example 4: Firewall Rules - Attributes include:

[0053] 1. Allowed network protocols

[0054] 2. Destination and source IP addresses

[0055] 3. Destination and source TCP ports

[0056] 4. Action (allow / deny network traffic)

[0057] 5. Direction (inbound / outbound traffic)

[0058] 6. Rule priority (relative to other rules)

[0059] Example 5: Container Repository - Attributes include:

[0060] 1. Is it a public repository?

[0061] 2. Are the containers statically encrypted?

[0062] 3. Are container label mutations allowed?

[0063] It should be noted that Figure 1The example network diagram shown illustrates a particular arrangement of communication components for simplicity purposes only, but the disclosed embodiments are equally applicable to different cloud computing configurations. As a non-limiting example, the knowledge base 120, the deployment manager 130, or both can be deployed in the cloud computing platform 110 without departing from the scope of the present disclosure. Additionally, the computing infrastructure resources 115 can be deployed in an infrastructure other than a cloud computing infrastructure, such as but not limited to an on-premises infrastructure. As another non-limiting example, the IaC processor 112 can be deployed outside of the cloud computing platform 110 and be configured to upload the computing infrastructure resources to the cloud computing platform 110.

[0064] Figure 2 For flowchart 200, it shows a method for managing the deployment of computing infrastructure resources according to an embodiment. In an embodiment, the method is performed by Figure 1 the deployment manager 130.

[0065] In S210, a set of general definition templates is created. The general definition templates are created in a unified format and expressed using respective sets of attributes. Each general definition template represents a corresponding type of computing infrastructure resource, such as but not limited to network interfaces, software applications, virtual machines, software containers, network adapters, and databases, etc. Each general definition template can include one or more fields or other parts into which values representing specific attributes of the computing infrastructure resource can be inserted so as to convert the original definition into a general definition formatted according to the general definition template.

[0066] In some embodiments, the set of general definition templates can be implemented as a tree or a graph, where the attributes included in the general definitions can be inherited between the general definitions. By inheriting attributes in this way, the attributes used in multiple templates do not need to be repeated in each template. This in turn allows for a reduction in the amount of memory used to store the attributes, as well as an increase in the speed of traversal and template matching based on these attributes. For this purpose, in an embodiment, S210 can further include creating such a tree or graph.

[0067] The general definition template represents various types of computing infrastructure resources, which can be represented in their respective IaC languages (e.g., proprietary IaC languages used by different IaC software providers). By using these templates to convert the original definitions into general definitions, policies can be applied based on the types of computing infrastructure resources, regardless of how those types of computing infrastructure resources are expressed in their native IaC languages. To this end, the general definition template can be created based on attributes included in different definitions of the same type of computing infrastructure resource. As a non-limiting example, the original definition can indicate that a given computing infrastructure resource is an EC2 (a proprietary type of computing infrastructure resource) instance, and the applicable general definition (i.e., the non-proprietary interpretation of the computing infrastructure resource type) can be a "virtual machine" created using a general definition template associated with the semantic concept "virtual machine".

[0068] In an embodiment, S210 may further include storing the created general definition template in a knowledge base (e.g., Figure 1 knowledge base 120).

[0069] In S220, an original definition of a computing infrastructure resource is received. The original definitions are all written in an IaC language, which may be a proprietary language or not be common across different IaC technologies.

[0070] In optional S230, non-open-source definitions in the received original definition are reformatted into a standardized format. To this end, S230 may include applying an evaluator tool that is configured to obtain an input definition and output a data interchange format document in a format of a recognizable data interchange language. As a non-limiting example, a JSON file may be output. The evaluator may also be configured to parse the original definition to identify expressions therein and interpret the identified expressions relative to the recognized data interchange language, and output a data interchange format document in the data interchange language (e.g., a text file).

[0071] As described above, some or all of the original definitions may be expressed declaratively, i.e., in a declarative IaC language. When the original definition is expressed in a declarative IaC language, the definition can be reformatted based on control flow analysis performed on the original definition. Commands identified using control flow analysis can be parsed relative to the data interchange language, and the resulting normalized original definition can be defined using the data interchange language. Performing control flow analysis may include, but is not limited to, statically analyzing the IaC file to identify commands therein. Alternatively, the definition can be reformatted based on an analysis of results computed based on the execution of an IaC processor or IaC script associated with the IaC file, without having to provide the IaC file.

[0072] In S240, the original definition is converted into a general definition. In an embodiment, a translator program may be used to convert the original definition, which is configured to map the attributes in the original definition to the attributes of the general definition template through semantic analysis, and use this mapping to classify each original definition into the corresponding type of computing infrastructure resource by association with the matching general definition template. By inserting the values representing the attributes from the original definition into the matching general definition template, the original definition can be converted into a general definition.

[0073] In an embodiment, the conversion of the definition is performed with reference to Figure 3 the further description thereof. Figure 3 FIG. S240 is a flowchart showing a method for converting the definition of cloud resources according to an embodiment.

[0074] In S310, the original definition of the computing infrastructure resource is analyzed. In an embodiment, S310 includes applying a policy engine to each original definition. Each original definition is expressed in an original IaC language.

[0075] In an embodiment, each original definition can be expressed in a declarative IaC language or an imperative IaC language. The declarative IaC language is used to define resources according to the resulting resources to be deployed, while the imperative IaC language is used to define resources according to the commands for the resources that will be used to deploy the resources that will produce the desired resources. The analysis performed in S310 can depend on the type of language (i.e., declarative or imperative) in which each original definition is expressed. More specifically, when the original definition of a resource is expressed in an imperative IaC language, S310 may further include performing a control flow analysis on the imperative IaC language original definition to determine which resources are to be deployed.

[0076] In another embodiment, when the original definition is expressed in an imperative IaC language, S310 may also include instrumenting the IaC processor or IaC script corresponding to the original definition and analyzing the execution result. Instrumenting the IaC processor or IaC script (also referred to as instrumenting the IaC instructions of the IaC processor or IaC script) includes, but is not limited to, instructions for executing the IaC processor or IaC script and monitoring for potential errors or exceptions during execution. The instrumenting instructions can be executed in a controlled environment, for example, an environment where interaction with external systems and code (i.e., outside the controlled environment) is not possible, restricted, or otherwise limited, to minimize the damage that may result from executing untrusted code. In another embodiment, instrumenting the IaC processor or script may also include replacing the backend of such processor or script with mock code and analyzing the output.

[0077] At S320, identify the attributes in the original definition. These attributes include, but are not limited to, attributes related to network security, at least some of which can be used to jointly and uniquely identify a type of computing infrastructure resource. To this end, the attributes can include, but are not limited to, configuration attributes, encryption attributes, backup attributes, attributes indicating connections to external systems, and combinations thereof, etc. These attributes can further include other data that describes or identifies the computing resource, such as, but not limited to, tags.

[0078] The attributes can further include attributes that are not necessarily used to determine the type of computing infrastructure resource, but are related to configurations that may vary even among computing infrastructure resources of the same type. As a non-limiting example, such an attribute of a virtual machine (VM) can be an attribute indicating whether the VM has Internet access, where some VMs may have Internet access while others may not.

[0079] A policy engine configured according to the Open Policy Engine language can be used to identify the attributes. As a non-limiting example, a policy engine defined by the open-source language Rego can be used to identify the attributes. Specifically, the attributes can be identified as configuration attributes, the impact on the computing environment when the resource is deployed in the computing environment (e.g., resources created by the computing infrastructure resource, modifications made to the computing environment by the resource, etc.), both, etc. These configurations and impacts can be encoded into a single unified format to create a general definition of the computing infrastructure resource.

[0080] In addition, as described above, for the original definition expressed in an imperative IaC language analyzed using control flow analysis, identifying the attributes of the corresponding computing infrastructure resource can further include analyzing the commands indicated in the original definition to identify the attributes of the computing infrastructure resource deployed as a result of these commands. Alternatively, identifying the attributes of the original definition in imperative IaC language can include instrumenting the original definition with instructions for the corresponding IaC processor or script and analyzing the results of such execution (e.g., the output obtained from the instrumented instructions and the instrumentation logs).

[0081] At S330, perform a semantic analysis on the identified attributes. In an embodiment, S330 includes comparing the identified attributes with predefined semantic concepts of known potential attributes of the computing infrastructure resource. More specifically, the known potential attributes can be the attributes indicated or otherwise represented in a general definition template. The semantic concepts can be the semantic concepts included in a semantic concept dictionary 122 such as Figure 1 in a semantic concept dictionary.

[0082] At S340, attributes are mapped to a general definition template based on semantic analysis. That is, each attribute identified in one of the original definitions is mapped to a corresponding attribute represented in one or more general definition templates. Thus, based on the combination of identified attributes mapped to the general definition template, this mapping can be used to determine a matching general definition template for the computing infrastructure resource. In an embodiment, when semantic analysis yields an identification of the type of computing resource, the general definition template associated with the identified type of computing resource can be used to map the attributes to the corresponding general definition template.

[0083] At S350, a general definition is output for each computing infrastructure resource based on the mapping. In an embodiment, S350 includes inserting one or more attributes represented in the original definition of each computing infrastructure resource into the corresponding fields of the matching general definition template determined for the computing infrastructure resource at S340. The result of S350 is a general definition for each computing infrastructure resource expressed in a unified format, which allows applications to use policies created in the unified format.

[0084] As a non-limiting example, for the general definition of the cryptographic key computing infrastructure resource described in Example 3 above, the example general definition may include the following attributes represented in a unified format:

[0085] 1. Allowed actions = encrypt, sign

[0086] 2. Key rotation configuration = rotate every 24 hours

[0087] 3. Symmetric? = true

[0088] Return Figure 2 , at optional S250, a graph is created. The graph includes at least a mapping of computing infrastructure resources among the computing infrastructure resources represented by the original definitions. In some embodiments, the graph can be an entity graph (e.g., Figure 1 entity graph 123), which represents entities in various domains of the software infrastructure of a computing environment (e.g., Figure 1 cloud computing environment 110).

[0089] At S260, based on the general definition, one or more misconfigurations regarding the computing infrastructure resources are detected. The detected misconfigurations can indicate potential cybersecurity vulnerabilities through which the computing environment is or will be exposed via its computing infrastructure resources. Additionally or alternatively, the detected misconfigurations may relate to other kinds of undesirable configurations, such as but not limited to, configurations that do not meet compliance requirements or other requirements related to cybersecurity that are not stringent for the computing environment.

[0090] More specifically, one or more policies are applied to the property definitions of the general definition template to determine whether the transformation definitions of the computing infrastructure resources exhibit any misconfigurations. In another embodiment, misconfigurations can be further detected based on the connections between the computing infrastructure resources (e.g., the connections indicated in the graph created in S260). Using such connections can further help detect misconfigurations before provisioning the computing infrastructure resources, thus allowing proactive protection of the computing environment.

[0091] At S270, one or more remediation actions can be performed for the detected misconfigurations. The remediation actions can include, but are not limited to, adding, removing, modifying the code of the misconfigured computing infrastructure resources, changing the provisioning of the computing infrastructure resources, disconnecting the connections between the computing infrastructure resources, stopping the deployment of the computing environment, generating an alert (e.g., an alert warning of the misconfiguration), and combinations thereof. For example, when a misconfigured computing infrastructure resource is configured in an overly permissive manner (e.g., as defined by the security policy), code can be added, and the added code can increase the security of the computing infrastructure resource (e.g., by adding security settings to the computing infrastructure resource).

[0092] At S280, the deployment of the computing infrastructure resources is managed. Managing the deployment of the computing infrastructure resources can include, but is not limited to, controlling the deployment of the computing infrastructure resources by allowing the deployment of the computing infrastructure resources (e.g., by uploading to the computing environment), by preventing the deployment of the computing infrastructure resources, and combinations thereof.

[0093] More specifically, in an embodiment, the deployment of misconfigured computing infrastructure resources (e.g., the misconfigured computing infrastructure resources detected at S260) is prevented, while the deployment of correctly configured computing infrastructure resources is allowed. In another embodiment, if a group of computing infrastructure resources is to be deployed together (e.g., simultaneously or as part of the same deployment), then if a misconfiguration is detected for any of the resources in the group, the deployment of all resources in the group can be blocked. Such a resource group can be a pre-specified resource group for a given deployment.

[0094] In another embodiment, S280 includes validating the configuration of some or all of the computing infrastructure resources based on their respective general definitions. Specifically, the computing infrastructure resources for which misconfigurations were detected and remediated at S260 and S270 can be validated to confirm whether these computing infrastructure resources are now correctly configured. The validation can include, but is not limited to, applying one or more of the policies discussed above with respect to S260. The validated computing infrastructure resources can include those for which no misconfiguration was detected during the validation.

[0095] Optionally or in combination, managing the deployment of computing infrastructure resources may include reconfiguring computing infrastructure resources that have been deployed in a computing environment. As a non-limiting example, reconfiguring computing infrastructure resources may include adding or removing code, disconnecting from certain other computing infrastructure resources, and combinations thereof, among others.

[0096] Figure 4 FIG. 4 is an example schematic diagram of a deployment manager 130 according to an embodiment. The deployment manager 130 includes a processing circuit 410 that is coupled to a memory 420, a storage device 430, and a network interface 440. In an embodiment, the components of the deployment manager 130 may be communicatively connected via a bus 450.

[0097] The processing circuit 410 may be implemented as one or more hardware logic components and circuits. By way of example and not limitation, illustrative types of hardware logic components that may be used include field programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), system-on-a-chip (SOCs), graphics processing units (GPUs), tensor processing units (TPUs), general microprocessors, microcontrollers, digital signal processors (DSPs), and the like, or any other hardware logic component that may perform computational or other information operations.

[0098] The memory 420 may be volatile (e.g., random access memory, etc.), non-volatile (e.g., read-only memory, flash memory, etc.), or a combination thereof.

[0099] In one configuration, software for implementing one or more embodiments disclosed herein may be stored in the storage device 430. In another configuration, the memory 420 is configured to store such software. Software should be construed broadly as any type of instruction, whether referred to as software, firmware, middleware, microcode, hardware description language, or otherwise. The instructions may include code (e.g., source code format, binary code format, executable code format, or any other suitable code format). When executed by the processing circuit 410, the instructions cause the processing circuit 410 to perform the various processes described herein.

[0100] The storage device 430 can be a magnetic storage device, an optical storage device, etc., and can be implemented as, for example, flash memory or other storage technologies, compact disk-read only memory (CD-ROM), Digital Versatile Disk (DVD), or any other medium that can be used to store the required information.

[0101] The network interface 440 allows the deployment manager 130 to communicate with, for example, the knowledge base 120, the IaC processor 112, etc.

[0102] It should be understood that the embodiments described herein are not limited to Figure 4 the specific architecture shown, and other architectures can be used equivalently without departing from the scope of the disclosed embodiments.

[0103] The various embodiments disclosed herein can be implemented as hardware, firmware, software, or any combination thereof. In addition, the software is preferably implemented as an application program tangibly embodied in a program storage unit or a computer-readable medium, which is composed of part or certain devices and / or combinations of devices. The application program can be uploaded to a machine including any suitable architecture and executed by the machine. Preferably, the machine is implemented on a computer platform having hardware such as one or more central processing units (CPUs), a memory, and an input / output interface. The computer platform may also include an operating system and microinstruction code. The various processes and functions described herein can be part of the microinstruction code, part of the application program, or any combination thereof, and they can be executed by the CPU, whether or not such a computer or processor is explicitly shown. In addition, various other peripheral units can be connected to the computer platform, such as additional data storage units and printing units. In addition, a non-transitory computer-readable medium is any computer-readable medium other than a transitory propagation signal.

[0104] All of the examples and conditional language described herein are intended for pedagogical purposes to help the reader understand the principles of the disclosed embodiments and the concepts contributed by the inventors to promote the development of the technology, and should be understood as not limited to such specifically recited examples and conditions. In addition, all statements of the principles, aspects, and embodiments of the disclosed embodiments described herein, as well as their specific examples, are intended to cover their structural and functional equivalents. In addition, it is intended that such equivalents include currently known equivalents as well as equivalents developed in the future, that is, any element developed to perform the same function, regardless of structure.

[0105] It should be understood that any reference to an element using terms such as "first", "second", etc. generally does not limit the number or order of these elements. On the contrary, these terms are generally used herein as a convenient way to distinguish between two or more elements or instances of an element. Thus, a reference to a first and a second element does not mean that only two elements may be used herein, or that the first element must precede the second element in some manner. Additionally, unless otherwise specified, a group of elements includes one or more elements.

[0106] As used herein, the phrase "at least one" followed by a list of items means that any of the listed items can be used individually, or any combination of two or more of the listed items can be used. For example, if a system is described as including "at least one of A, B, and C", the system can include: only A; only B; only C; 2A; 2B; 2C; 3A; a combination of A and B; a combination of B and C; a combination of A and C; a combination of A, B, and C; a combination of 2A and C; a combination of A, 3B, and 2C; and so on.

Claims

1. A method for securely deploying computing infrastructure resources, comprising: identifying a first plurality of attributes in a plurality of original definitions of a plurality of computing infrastructure resources, wherein each original definition is a definition of a corresponding computing infrastructure resource among the plurality of computing infrastructure resources; mapping the first plurality of attributes to a second plurality of attributes of a plurality of general definition templates to determine a matching general definition template for each original definition, wherein each of the plurality of general definitions corresponds to a corresponding type of computing infrastructure resource and is defined in a unified format; converting the plurality of original definitions into a plurality of general definitions using the plurality of general definition templates, wherein converting each original definition further comprises: inserting at least one of the first plurality of attributes into the matching general definition template for the original definition; and managing the deployment of the plurality of computing infrastructure resources based on the plurality of general definitions.

2. The method according to claim 1, further comprising: semantically analyzing the first plurality of attributes, wherein the first plurality of attributes are mapped to the second plurality of attributes based on the semantic analysis.

3. The method according to claim 2, wherein, the first plurality of attributes are semantically analyzed with respect to a plurality of predefined semantic concepts, and the plurality of predefined semantic concepts represent a plurality of potential attributes of the computing infrastructure resources represented in the plurality of general definition templates.

4. The method according to claim 1, further comprising: creating a graph of connections between the plurality of computing infrastructure resources based on the plurality of general definitions, wherein at least one misconfiguration is further detected based on the graph.

5. The method according to claim 1, wherein, detecting the at least one misconfiguration further comprises: applying at least one policy that defines misconfigurations with respect to attributes expressed in the unified format.

6. The method according to claim 1, further comprising: reformatting at least one of the plurality of original definitions into a normalized original definition.

7. The method according to claim 1, wherein, reformatting each of the at least one original definition further comprises: parsing the original definition to identify a plurality of expressions; and interpreting the plurality of expressions with respect to a data interchange language, wherein the normalized original definition is defined using the data interchange language.

8. The method according to claim 1, wherein, reformatting each of the at least one original definition further comprises: performing control flow analysis on the original definition to identify a plurality of commands; and interpreting the plurality of commands with respect to a data interchange language, wherein the normalized original definition is defined using the data interchange language.

9. The method according to claim 1, wherein, reformatting each of the at least one original definition further comprises: instrumenting the infrastructure into code IaC instructions corresponding to each of the at least one original definition; and Analyze the output and instrumentation logs of the execution of the IaC instructions corresponding to each of the at least one original definition, wherein each of the at least one original definition is reformatted based on the analysis of the output and instrumentation logs.

10. The method according to claim 1, further comprising: Prevent at least one of the plurality of computing infrastructure resources from being deployed in a cloud environment based on at least one detected misconfiguration.

11. The method according to claim 1, further comprising: Perform at least one remediation action with respect to at least one of the plurality of computing infrastructure resources based on at least one detected misconfiguration.

12. A non-transitory computer-readable medium having instructions stored thereon for causing a processing circuit to perform a process, the process comprising: Identify a first plurality of attributes in a plurality of original definitions of a plurality of computing infrastructure resources, wherein each original definition is a definition of a corresponding computing infrastructure resource among the plurality of computing infrastructure resources; Map the first plurality of attributes to a second plurality of attributes of a plurality of general definition templates to determine a matching general definition template for each original definition, wherein each of the plurality of general definitions corresponds to a corresponding type of computing infrastructure resource and is defined in a unified format; Convert the plurality of original definitions into a plurality of general definitions using the plurality of general definition templates, wherein converting each original definition further comprises: inserting at least one of the first plurality of attributes into the matching general definition template for the original definition; and Manage the deployment of the plurality of computing infrastructure resources based on the plurality of general definitions.

13. A system for securely deploying computing infrastructure resources, comprising: A processing circuit; and A memory containing instructions that, when executed by the processing circuit, configure the system to: Identify a first plurality of attributes in a plurality of original definitions of a plurality of computing infrastructure resources, wherein each original definition is a definition of a corresponding computing infrastructure resource among the plurality of computing infrastructure resources; Map the first plurality of attributes to a second plurality of attributes of a plurality of general definition templates to determine a matching general definition template for each original definition, wherein each of the plurality of general definitions corresponds to a corresponding type of computing infrastructure resource and is defined in a unified format; Convert the plurality of original definitions into a plurality of general definitions using the plurality of general definition templates, wherein converting each original definition further comprises: inserting at least one of the first plurality of attributes into the matching general definition template for the original definition; and Manage the deployment of the plurality of computing infrastructure resources based on the plurality of general definitions.

14. The system according to claim 13, wherein the system is further configured to: Semantically analyze the first plurality of attributes, wherein the first plurality of attributes are mapped to the second plurality of attributes based on the semantic analysis.

15. The system according to claim 14, wherein The first plurality of attributes are semantically analyzed with respect to a plurality of predefined semantic concepts, which represent a plurality of potential attributes of computing infrastructure resources represented in the plurality of general definition templates.

16. The system according to claim 13, wherein, the system is further configured to: create a graph of connections between the plurality of computing infrastructure resources based on the plurality of general definitions, wherein at least one misconfiguration is further detected based on the graph.

17. The system according to claim 13, wherein, the system is further configured to: apply at least one policy that defines misconfigurations with respect to attributes expressed in the unified format.

18. The system according to claim 13, wherein, the system is further configured to: reformat at least one of the plurality of original definitions into a normalized original definition.

19. The system according to claim 13, wherein, the system is further configured to: parse the original definition to identify a plurality of expressions; and interpret the plurality of expressions with respect to a data interchange language, wherein the normalized original definition is defined using the data interchange language.

20. The system according to claim 13, wherein, the system is further configured to: perform control flow analysis on the original definition to identify a plurality of commands; and interpret the plurality of commands with respect to a data interchange language, wherein the normalized original definition is defined using the data interchange language.

21. The system according to claim 13, wherein, the system is further configured to: execute the infrastructure as code IaC instructions corresponding to each of the at least one original definition; and analyze the output of the execution of the IaC instructions corresponding to each of the at least one original definition, wherein each of the at least one original definition is reformatted based on the analysis of the output of the execution of the IaC instructions corresponding to the original definition.

22. The system according to claim 13, wherein, the system is further configured to: prevent at least one of the plurality of computing infrastructure resources from being deployed in a cloud environment based on the detected at least one misconfiguration.

23. The system according to claim 13, wherein, the system is further configured to: perform at least one remedial action with respect to at least one of the plurality of computing infrastructure resources based on the detected at least one misconfiguration.

Images