Cloud service platform full life cycle management method based on DevSecOps

Abstract

The invention discloses a cloud service platform full life cycle management method based on DevSecOps, and the method comprises the steps: setting an IaC template according to the asset type on a cloud service platform in a design stage of the cloud service platform; in the deployment stage of the cloud service platform, an IaC template knowledge graph is constructed for the IaC template of each type of assets, the IaC template knowledge graph is utilized to describe a cloud service event, a data anomaly probability algorithm is adopted to determine whether the IaC template is abnormal, if yes, abnormal cloud service features are extracted from the IaC template knowledge graph, and the abnormal cloud service features are repaired; in the operation stage of the cloud service platform, performing security check on the operation process of the cloud service event by adopting an LLM (Logistics Language Model); in the decommissioning stage of the cloud service platform, the cloud service provider is supervised to thoroughly clear the residual data of the cloud service event. According to the invention, the security is deeply fused with the design, deployment, operation and decommissioning stages of the cloud service platform, so that a safe, efficient and reliable cloud service environment is constructed.

Description

Technical Field

[0001] This invention relates to the field of cloud service platform management technology, and more specifically, to a method for full lifecycle management of cloud service platforms based on DevSecOps. Background Technology

[0002] DevOps (Development, Operations) is a methodology that automates, collaborates, and continuously optimizes the entire software delivery process by breaking down the barriers between development and operations. Its core objectives are to shorten development cycles, improve delivery quality, and rapidly respond to changing business needs. In cloud service platforms, DevOps enables faster and more efficient development, deployment, and operation by automating tasks such as resource provisioning, configuration management, integration testing workflows, and application scaling, supporting continuous improvement of the cloud service platform throughout its lifecycle.

[0003] However, security checks on cloud service platforms under DevOps are typically integrated into later stages, leading to delayed vulnerability discovery and high remediation costs. Furthermore, while DevOps automates development, testing, and deployment through CI / CD pipelines, security processes still rely on manual operations, resulting in inefficiency and a high risk of errors. Additionally, DevOps emphasizes collaboration between development and operations, but security is marginalized, causing a disconnect between security requirements and business objectives. Summary of the Invention

[0004] To address the problems existing in the prior art, this invention provides a DevSecOps-based cloud service platform full lifecycle management method, which deeply integrates security into the design, deployment, operation and decommissioning stages of the cloud service platform, thereby building a secure, efficient and reliable cloud service environment.

[0005] To achieve the above technical objectives, the present invention adopts the following technical solution: a method for full lifecycle management of cloud service platforms based on DevSecOps, the specific process of which is as follows: During the design phase of the cloud service platform, IaC templates are set according to the asset types on the cloud service platform; During the deployment phase of the cloud service platform, an IaC template knowledge graph is constructed for the IaC templates of each type of asset. The IaC template knowledge graph is used to describe cloud service events. A data anomaly probability algorithm is used to determine whether the IaC template is abnormal. If so, abnormal cloud service features are extracted from the IaC template knowledge graph and the abnormal cloud service features are repaired. During the operation phase of the cloud service platform, the LLM large model is used to perform security checks on the operation process of cloud service events; During the decommissioning phase of a cloud service platform, oversee the cloud service provider to thoroughly remove any residual data related to cloud service incidents.

[0006] Furthermore, the specific process for setting up IaC templates based on asset types on the cloud service platform is as follows: Based on the asset types on the cloud service platform, assets are divided into hard assets, virtualized assets, and containerized assets. Hard assets include physical machines, hardware devices, and terminal devices. Virtualized assets include virtual hosts, virtual networks, and virtual storage. Containerized assets include various instances created by Docker containers. Three IaC templates are set up for each type of asset. The IaC templates include: operation and maintenance management code template, security baseline configuration code template, and compliance code template.

[0007] Furthermore, set the minimum execution permissions for each IaC template.

[0008] Furthermore, the process of constructing an IaC template knowledge graph for each type of asset is as follows: constructing an ontology model of the IaC template knowledge graph, including entity classes and relationships, wherein the entity classes include asset classes, IaC template classes and parameter classes, and the relationships include: the association between assets and the IaC template, the dependency relationship of resources within the IaC template, and the association between the IaC template and parameters.

[0009] Furthermore, the process of determining whether the IaC template has anomalies using a data anomaly probability algorithm is as follows: The cloud service events input to the cloud service platform are described using an IaC template knowledge graph. Features are then extracted from the IaC template knowledge graph to construct a feature function. The probability of an anomaly occurring in the IaC template is calculated using the feature function. If the probability of an anomaly occurring in the IaC template exceeds a set threshold, it indicates that the IaC template is abnormal.

[0010] Furthermore, the features extracted from the IaC template knowledge graph include: structural deviation features between the IaC template knowledge graph describing the cloud service event and the IaC template knowledge graph describing the cloud service event, embedding distance features of the cloud service event in the IaC template knowledge graph, semantic rule features and temporal drift features in the IaC template knowledge graph describing the cloud service event.

[0011] Furthermore, the probability of the IaC template malfunctioning. The calculation process is as follows:

[0012] in, i This represents the index of the feature extracted from the IaC template knowledge graph. E This indicates a cloud service event input from the cloud service platform. This represents the corresponding IaC template knowledge graph. This indicates adjusting the parameters of the characteristic function. This represents the first [item] extracted from the IaC template knowledge graph. i The feature function of each feature Indicates the first i The weight coefficients of each feature function.

[0013] Furthermore, the abnormal cloud service characteristics include: insecure cloud resource allocation, unverified cloud service dependencies, lack of container image scanning, and insecure confidentiality management during automation processes.

[0014] Furthermore, during the operation phase of the cloud service platform, the specific process of using the LLM large model to perform security checks on the operation process of cloud service events is as follows: Cloud service events are captured from the cloud service platform's monitoring system and converted into DSL event descriptions; The LLM large model parses the DSL event description, extracts key information, performs DAST, IAST and fuzz tests to determine whether the cloud service event has security vulnerabilities. If so, the LLM large model is used to fix the cloud service event with security vulnerabilities.

[0015] Furthermore, the DSL event description includes: version control information, release review information, process integration parameter information, classification data identification information, resource identification information, and IAM role information for cloud service events.

[0016] Compared with existing technologies, this invention has the following beneficial effects: The DevSecOps-based cloud service platform lifecycle management method integrates security checks into the design, deployment, operation, and decommissioning phases of the cloud service platform, thereby ensuring security checks are performed throughout the entire lifecycle of the cloud service platform, enabling the construction of a secure, efficient, and reliable cloud service environment. Specifically, in the cloud service platform design phase, IaC templates are set according to the asset types on the cloud service platform to ensure the security of code configuration, thus ensuring the security of cloud resource allocation; in the cloud service platform deployment phase, a data anomaly probability algorithm is used to determine whether there are anomalies in the IaC templates describing cloud service events, thereby standardizing the anomaly detection process for cloud service events and improving detection accuracy; in the cloud service platform operation phase, an LLM large model is used to perform security checks on the operation process of cloud service events, thereby promptly identifying problems in the operation process of cloud service events and quickly responding to fixes. Attached Figure Description

[0017] Figure 1 This is a flowchart of the DevSecOps-based cloud service platform full lifecycle management method of the present invention; Figure 2This is a schematic diagram of assets on the cloud service platform in this invention. Detailed Implementation

[0018] The technical solution of the present invention will be further explained and described below with reference to the accompanying drawings.

[0019] like Figure 1 This is a flowchart of the DevSecOps-based cloud service platform lifecycle management method of the present invention, which includes the following processes: During the design phase of the cloud service platform, IaC templates are set according to the asset types on the cloud service platform to ensure the security of code configuration, thereby ensuring the security of cloud resource allocation; specifically: like Figure 2 Based on the asset types on the cloud service platform, assets are divided into hard assets, virtualized assets, and containerized assets. Hard assets include physical machines, hardware devices, and terminal devices; virtualized assets include virtual hosts, virtual networks, and virtual storage; and containerized assets include various instances created by Docker containers. Three types of IaC templates are set up for each type of asset, including: operation and maintenance management code template, security baseline configuration code template, and compliance code template. The operation and maintenance management code template is the code template required to complete the task of maintaining and managing the infrastructure; the security baseline configuration code template is a common template extracted from the code executed to complete the baseline hardening operation; the compliance code template is the code template provided for the implementation strategies that need to be implemented for many enterprises or industries with certain compliance requirements. Setting minimum execution permissions for each IaC template ensures that each component in the cloud platform service is granted only the minimum permissions required to perform its specific tasks, significantly reducing the risk of unauthorized access or abuse.

[0020] Since IaC templates contain a large number of configuration parameters, during the deployment phase of the cloud service platform, an IaC template knowledge graph is constructed for each type of asset. Through the graphical structure of entity classes and relationships, the structured characteristics of the IaC template can be clearly reflected, avoiding information omissions and misunderstandings during manual parsing. The IaC template knowledge graph is used to describe cloud service events, and a data anomaly probability algorithm is used to determine whether the IaC template has anomalies, thereby standardizing the anomaly detection process for cloud service events and improving detection accuracy. If anomalies are found, abnormal cloud service features are extracted from the IaC template knowledge graph, and the abnormal cloud service features are repaired to achieve targeted repair and improve repair efficiency.

[0021] The process of constructing an IaC template knowledge graph for each type of asset is as follows: Construct an ontology model for the IaC template knowledge graph, including entity classes and relationships. Entity classes include asset classes, IaC template classes, and parameter classes. Relationships include the association between assets and IaC templates, the dependency relationships of resources within IaC templates, and the association between IaC templates and parameters.

[0022] The process of determining whether the IaC template has an anomaly using the data anomaly probability algorithm in this invention is as follows: The IaC template knowledge graph is used to describe cloud service events input to the cloud service platform. Features are then extracted from the IaC template knowledge graph, including: structural deviation features between the IaC template knowledge graph after describing the cloud service event and the IaC template knowledge graph before describing the cloud service event; embedding distance features of the cloud service event in the IaC template knowledge graph; semantic rule features in the IaC template knowledge graph describing the cloud service event; and temporal drift features. A feature function is constructed based on the extracted features, and the probability of an anomaly in the IaC template is calculated using the feature function. If the probability of an anomaly in the IaC template exceeds a set threshold, it indicates that the IaC template is abnormal.

[0023] The probability of anomalies occurring in the IaC template in this invention The calculation process is as follows:

[0024] in, i This represents the index of the feature extracted from the IaC template knowledge graph. E This indicates a cloud service event input from the cloud service platform. This represents the corresponding IaC template knowledge graph. This indicates adjusting the parameters of the characteristic function. This represents the first [item] extracted from the IaC template knowledge graph. i The feature function of each feature Indicates the first i The weight coefficients of each feature function.

[0025] The abnormal cloud service characteristics in this invention include: insecure cloud resource allocation, unverified cloud service dependencies, lack of container image scanning, and insecure confidentiality management during automation. Insecure cloud resource allocation is due to improperly configured IaC templates that may lead to security vulnerabilities, such as publicly exposed storage or open ports. Unverified cloud service dependencies are because cloud-native applications often rely on managed services, and if these dependencies are misconfigured or outdated, vulnerabilities can arise. Flawed CICD pipeline security is due to insufficient security controls during pipeline construction and deployment, which may allow malicious code injection or unauthorized access in automated processes. Lack of container image scanning involves deploying container images without thorough security scanning, which may introduce outdated or vulnerable components into the production environment. Insecure confidentiality management during automation is due to improper handling of sensitive data during automated deployment, such as exposing credentials in logs or configuration files, which can lead to credential theft.

[0026] During the operation phase of the cloud service platform, an LLM (Limited Least Metric) model is used to perform security checks on the cloud service event execution process, thereby promptly identifying problems during cloud service event execution and quickly responding to fixes. Specifically: Cloud service events are captured from the cloud service platform's monitoring system and converted into DSL event descriptions, including: version control information, release review information, process integration parameter information, category data identification information, resource identification information, and IAM role information. Version control information is used to maintain and manage code templates and code instances through version control management tools. Release review information ensures that both code templates and code instances specific to infrastructure undergo review before official release to guarantee code availability and reduce unnecessary production incidents. Process integration information reflects the evolution of code template and code instance usage in a DevSecOps environment from manual execution to automated steps; management requires an overall planning approach, considering their integration with CI / CD from a process integration perspective. IAM role information allows for the allocation of appropriate permissions to users, roles, and resources, ensuring granular access permissions aligned with individual responsibilities and minimizing the risk of over-authorization.

[0027] The LLM large model parses DSL event descriptions, extracts key information, performs DAST, IAST, and fuzz tests to determine whether cloud service events have security vulnerabilities, and performs security vulnerability scans. If vulnerabilities are found, they are located, and the LLM large model is used to fix the cloud service events with security vulnerabilities.

[0028] This invention utilizes a monitoring system to continuously monitor cloud service events during the cloud service platform's operational phase, enabling rapid problem detection. The LLM (Large-Scale Management) model can analyze vast amounts of log data and network traffic to promptly identify abnormal behavior and security threats, allowing for a swift response. Upon detecting a security event, the LLM model can trigger a predefined response workflow for automatic repair.

[0029] During the decommissioning phase of a cloud service platform, oversee the cloud service provider to thoroughly remove any residual data related to cloud service incidents.

[0030] DevSecOps (Development, Security, Operations) is a methodology that deeply integrates security practices into the entire software development and operations process. It aims to break down the traditional barriers between security and development / operations, achieving continuous software security through automated tools and a collaborative culture. This invention, based on a DevSecOps-based cloud service platform lifecycle management method, integrates security checks into the design, deployment, operation, and decommissioning phases of the cloud service platform. This reduces security risks, enhances the ability to resist cyber threats, and enables the cloud service platform to provide secure, high-performance services without compromising agility or speed. Furthermore, by leveraging artificial intelligence to drive automated intelligent risk and real-time monitoring, it simplifies workflows, proactively detects potential threats, and improves cloud service efficiency and security.

[0031] In one technical solution of the present invention, a computer-readable storage medium is also provided, storing a computer program that enables a computer to execute the DevSecOps-based cloud service platform full lifecycle management method of the present invention.

[0032] In one technical solution of the present invention, an electronic device is also provided, including: a memory, a processor, and a computer program stored on the memory and executable on the processor. When the processor executes the computer program, it implements the DevSecOps-based cloud service platform full lifecycle management method of the present invention.

[0033] In the embodiments disclosed in this application, a computer storage medium may be a tangible medium that may contain or store programs for use by or in conjunction with an instruction execution system, apparatus, or device. The computer storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of computer storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0034] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed in this application can be implemented in electronic hardware or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0035] The above are merely preferred embodiments of the present invention. The scope of protection of the present invention is not limited to the above embodiments. All technical solutions falling within the scope of the present invention's concept are within the scope of protection of the present invention. It should be noted that for those skilled in the art, any improvements and modifications made without departing from the principles of the present invention should be considered within the scope of protection of the present invention.

Claims

1. A method for full lifecycle management of a cloud service platform based on DevSecOps, characterized in that, The specific process is as follows: During the design phase of the cloud service platform, IaC templates are set according to the asset types on the cloud service platform; During the deployment phase of the cloud service platform, an IaC template knowledge graph is constructed for the IaC templates of each type of asset. The IaC template knowledge graph is used to describe cloud service events. A data anomaly probability algorithm is used to determine whether the IaC template is abnormal. If so, abnormal cloud service features are extracted from the IaC template knowledge graph and the abnormal cloud service features are repaired. During the operation phase of the cloud service platform, the LLM large model is used to perform security checks on the operation process of cloud service events; During the decommissioning phase of a cloud service platform, oversee the cloud service provider to thoroughly remove any residual data related to cloud service incidents.

2. The method for full lifecycle management of a cloud service platform based on DevSecOps according to claim 1, characterized in that, The specific process for setting up an IaC template based on the asset type on the cloud service platform is as follows: Based on the asset types on the cloud service platform, assets are divided into hard assets, virtualized assets, and containerized assets. Hard assets include physical machines, hardware devices, and terminal devices. Virtualized assets include virtual hosts, virtual networks, and virtual storage. Containerized assets include various instances created by Docker containers. Three IaC templates are set up for each type of asset. The IaC templates include: operation and maintenance management code template, security baseline configuration code template, and compliance code template.

3. The method for full lifecycle management of a cloud service platform based on DevSecOps according to claim 1, characterized in that, Set the minimum execution permissions for each IaC template.

4. The method for full lifecycle management of a cloud service platform based on DevSecOps according to claim 1, characterized in that, The process of constructing an IaC template knowledge graph for each type of asset is as follows: Construct the ontology model of the IaC template knowledge graph, including entity classes and relationships. The entity classes include asset classes, IaC template classes, and parameter classes. The relationships include the association between assets and the IaC template, the dependency relationship of resources within the IaC template, and the association between the IaC template and parameters.

5. The method for full lifecycle management of a cloud service platform based on DevSecOps according to claim 1, characterized in that, The process of determining whether the IaC template has an anomaly using the data anomaly probability algorithm is as follows: The cloud service events input to the cloud service platform are described using an IaC template knowledge graph. Features are then extracted from the IaC template knowledge graph to construct a feature function. The probability of an anomaly occurring in the IaC template is calculated using the feature function. If the probability of an anomaly occurring in the IaC template exceeds a set threshold, it indicates that the IaC template is abnormal.

6. The method for full lifecycle management of a cloud service platform based on DevSecOps according to claim 5, characterized in that, The features extracted from the IaC template knowledge graph include: structural deviation features between the IaC template knowledge graph describing the cloud service event and the IaC template knowledge graph describing the cloud service event, embedding distance features of the cloud service event in the IaC template knowledge graph, semantic rule features in the IaC template knowledge graph describing the cloud service event, and temporal drift features.

7. The method for full lifecycle management of a cloud service platform based on DevSecOps according to claim 5, characterized in that, The probability of the IaC template malfunctioning The calculation process is as follows: in, i This represents the index of the feature extracted from the IaC template knowledge graph. E This indicates a cloud service event input from the cloud service platform. This represents the corresponding IaC template knowledge graph. This indicates adjusting the parameters of the characteristic function. This represents the first [item] extracted from the IaC template knowledge graph. i The feature function of each feature Indicates the first i The weight coefficients of each feature function.

8. The method for full lifecycle management of a cloud service platform based on DevSecOps according to claim 1, characterized in that, The abnormal cloud service characteristics include: insecure cloud resource allocation, unverified cloud service dependencies, lack of container image scanning, and insecure confidentiality management during automation.

9. The method for full lifecycle management of a cloud service platform based on DevSecOps according to claim 1, characterized in that, During the operation phase of the cloud service platform, the specific process of using the LLM large model to perform security checks on the operation process of cloud service events is as follows: Cloud service events are captured from the cloud service platform's monitoring system and converted into DSL event descriptions; The LLM large model parses the DSL event description, extracts key information, performs DAST, IAST and fuzz tests to determine whether the cloud service event has security vulnerabilities. If so, the LLM large model is used to fix the cloud service event with security vulnerabilities.

10. A method for full lifecycle management of a cloud service platform based on DevSecOps according to claim 9, characterized in that, The DSL event description includes: version control information, release review information, process integration parameter information, classification data identification information, resource identification information, and IAM role information for cloud service events.

Images