Automatic Packetless Network Reachability Analysis

Abstract

A system, method, and computer-readable medium for automated packetless network reachability analysis are provided. A network security assessment device performs an analysis of network configuration data for a network including a host computer. Based at least in part on the analysis, one or more ports on the host computer that are reachable from another computer are determined. Based at least in part on the analysis, one or more routes to the one or more ports are determined. A report describing the one or more ports and the one or more routes is generated.

Description

[Background technology]

[0001] Many businesses and other organizations have co-located computing systems. either (for example as part of a local network), or alternatively multiple different Located in a geographic location (e.g., via one or more private or public intermediate networks) A network is a system that interconnects many computing systems, such as a network connected by a network. Operate a computer network that supports the business operations of a single organization. and private data centers operated for a single organization or that provide computing services to customers. Public data centers operated by companies as a business providing computing resources. Data centers that house a significant number of interconnected computing systems, such as Among public data center operators, there are many datacenters owned by various customers. Some provide network access, power, and secure mounting facilities for the hardware. If the customer requests it, the company may request a "full service" facility that includes hardware resources made available to the customer. Some also offer [Brief description of the drawings]

[0002] [Figure 1] 1 illustrates an example system environment for automated packetless network reachability analysis, according to some embodiments. [Diagram 2] 1 illustrates further aspects of an example system environment for automated packetless network reachability analysis, including interaction with a virtual network validation service to aid in the analysis, according to some embodiments. [Diagram 3]1 illustrates further aspects of an example system environment for automated packetless network reachability analysis, including the use of an agent on the computer that is the subject of the analysis, according to some embodiments. [Figure 4] 1 illustrates further aspects of an example system environment for automated packetless network reachability analysis, including recommending and / or taking corrective action, in accordance with some embodiments. [Diagram 5] 1 illustrates an example of a report generated using automated packetless network reachability analysis, according to some embodiments. [Figure 6] 1 illustrates an example of a report generated using automated packetless network reachability analysis, according to some embodiments, and using an agent on the computer that is the subject of the analysis. [Figure 7] 1 is a flowchart illustrating a method for automated packetless network reachability analysis, according to some embodiments. [Figure 8] 1 illustrates a virtual network validation service in a provider network environment, according to some embodiments. [Figure 9] 1 illustrates components and operation of an example virtual network validation service, according to some embodiments. [Figure 10] 1 is a flowchart of a method for providing information about a virtual network to a client of a provider network, according to some embodiments. [Figure 11] 1 is a flowchart of a method for providing information about a virtual network to a client of a provider network in which the client provides descriptive information and a query to a virtual network validation service, according to some embodiments. [Figure 12] 1 is a flowchart of a method for providing information about a virtual network to a client of a provider network in which the client provides descriptive information and permissions to access the virtual network to a virtual network validation service, according to some embodiments. [Figure 13] 1 illustrates a client virtual network implementation in a provider network environment that includes two or more peered virtual networks, according to some embodiments. [Figure 14] 1 illustrates subnets and security groups in an example virtual network on a provider network, according to some embodiments. [Figure 15] 1 illustrates an example computing device that may be used in some embodiments.

[0003] Embodiments are described herein by way of example in some embodiments and illustrative drawings. However, those skilled in the art will recognize that the embodiments are not limited to the embodiments or drawings described. The drawings and detailed description are not intended to limit the embodiments to the particular forms disclosed. It is not intended that the present invention be limited to the above-mentioned specific embodiments, but rather that the present invention is limited to the above-mentioned specific embodiments, as defined by the appended claims. All modifications, equivalents, and alternatives falling within the spirit and scope of the definition are intended to be included herein. It should be understood that the headings used herein are for organizational convenience only. and are not intended to be used to limit the scope of the specification or claims. As used throughout this application, the word "may" is not mandatory. Not in terms of meaning (i.e., the sense of "must"), but in terms of permissibility. Similarly, "including" is used in the sense of "include," "including," and "including The term "including but not limited to" means "including but not limited to." DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0004] Method, system, and computer for automated packetless network reachability analysis Various embodiments of a computer readable medium are described. Reachability analysis can be done without necessarily performing a traditional port scan. Previous efforts at law have focused on packets sent from external entities (e.g. may be sent to various ports on one or more computers (on a remote network) Such port scans can take days and require a long wait for a response. This could use a large amount of network bandwidth without sending packets to the port. The network reachability analysis described in the specification examines which ports (if any) are on a computer. If there is one, it may be possible to connect to the Internet from, for example, the public Internet or another computer on the same network. Network reachability analysis can determine whether a network is reachable. It can also determine one or more routes to those ports from external entities. Network reachability analysis involves combining data from various sources to reach a conclusion. In one embodiment, the network reachability analysis may include determining whether a computer belongs to a A set of network configuration data can be queried for a given network. In one embodiment, the network reachability analysis includes a The data is obtained from the installed agent software to determine, for example, which processes have open ports Network reachability analysis can determine whether a Aspects of the findings, e.g., which ports are open and reachable, and which routes are ports, the processes listening on those ports, whether the ports are open and reachable, The configuration settings that correspond to the presence of the security security concerns; corrective actions to remedy security concerns (e.g., changing configuration settings) A report may be generated describing the number of connections, the number of connections, and / or any other suitable information. Network reachability analysis may be performed in an automated manner, e.g., on a schedule or This can be done as the user interacts with the application or is triggered by an event, not necessarily by the end user. The techniques described herein can be used to improve port scanning performance by eliminating the need for traditional port scanning techniques. The security of the network is fast, as opposed to the time-consuming and resource-intensive nature of It can be analyzed quickly and efficiently.

[0005] As one skilled in the art will appreciate in light of this disclosure, embodiments may be used to achieve certain technical advantages. Specific technical advantages include: (1) the ability to Improves network reachability by eliminating the need to send packets to a (2) to improve the speed of feasibility analysis, and (3) to send packets to many ports on many computers. Reduces network bandwidth for network reachability analysis by eliminating the need to transmit (3) the ability to see routes by which ports can be reached; (4) improve network security by providing By providing insight into processes listening on reachable ports ,Improve network security; (5) Verify that ports are reachable. It reports configuration settings that may cause security problems and identifies settings that may improve security concerns. Improve the security of your network by reporting changes to your network settings (6 ) A more complete view than traditional port scanning, which only checks reachability from the scanner's location. By providing a secure network, it is possible to improve network security. Some or all of the following may be included:

[0006] FIG. 1 illustrates an example of an automated packetless network reachability analysis system in accordance with some embodiments. In some embodiments, a network security evaluation device Analyze the security of one or more computing devices on a network For example, which ports on those computers are open and reachable The devices analyzed can be computers, , host computer, host, server, instance, or computing resource As shown in FIG. 1, the hosts 170A to 170N and other A set of computing devices may be configured in a private network 180. For purposes of illustration and example, two hosts 170A and 170N are shown, however, any Any suitable number and configuration of hosts may be evaluated by the network security evaluation device 100. The hosts 170A to 170N can be analyzed by their hardware resources, software, and The hardware resources, network configurations, etc. may be the same or different.

[0007] The hosts 170A to 170N use the network resources of the private network 180. Each of the hosts 170A to 170N may be configured to communicate with each other using a would assign port 171A to host 170A, port 171N to host 170N, etc. A network port can be provided. Ports 171A to 171N are A port may represent an endpoint of a network communication and may be identified by a port number. TCP (Transmission Control Protocol) n Control Protocol) and User Datagram Protocol (UDP Transport layer protocols such as the User Datagram Protocol (UDP) By convention, certain port numbers are reserved for certain services. Applications that implement shared services may use reserved port numbers. It "listens" on a port and initiates a one-to-one server-client dialogue upon request. By establishing the protocol, a service request from a client can be received. For example, Implements the Simple Mail Transfer Protocol (SMTP) Applications that use this protocol typically listen on TCP port 25 for incoming requests. Applications that implement the Post Office Protocol (POP) Normally it listens on TCP 110 for incoming requests.

[0008] A private network 180 is owned by a specific business entity or other organization and In one embodiment, the private The owner or operator of the network 180 may determine whether the hosts 170A-170N are normally Inaccessible or accessible only to external entities, such as the public Internet For computers connected via one or more public networks 190 However, it can be expected that there should be a degree of separation between the hosts 170A to 170N. One or more ports may actually be reachable on the public network 190, and It may be reachable in a way that could pose a security concern. For example, For example, to collect confidential data from the hosts 170A to 170N or to control the hosts. Therefore, a particular process listening on a particular open port is vulnerable to malicious attacks from external entities. Using the techniques described herein, Any reachable port on the network 170A-170N can be found, and in some cases can be remediated to eliminate security concerns.

[0009] Packets do not necessarily have to be sent to ports 171A-171N to ensure network security. The reliability assessment device 100 determines which ports, if any, are reachable. In one embodiment, the reachability analysis may include determining whether a port is connected to a public network. 190. In one embodiment, Reachability analysis determines whether a port is reachable through a private network 190, e.g., It can be determined whether another one of the ports 170A to 170N is reachable. In one embodiment, the reachability analysis determines whether a port on a host is reachable. For one or more specific hosts, the analysis can be performed using automated in a way that, for example, is scheduled or triggered by an event , and are not necessarily directly initiated by the end user. Events can be triggered by events related to changes in the host's network configuration. The Company will provide a service or system on a private network 180 that monitors such changes. It may be issued by the system.

[0010] In one embodiment, the network security assessment device 100 is A set of data 110 is used to transmit to one or more of hosts 170A to 170N. Network reachability analysis can be performed. Related to the network to which the host under analysis belongs (e.g., private network 180) The network configuration data may include the hosts 170A to 170N and the network The network configuration or other properties of the working devices (routers, switches, etc.) For example, the data 110 may represent a snapshot of a virtual private cloud. Virtual Private Cloud (VPC), subnets, and instances Access, security groups, and access control lists (ACLs) The data 110 may include information about, for example, A network is created in the network 180 according to a set of virtual networking rules. This can be used to model how a network works. The elements of the network configuration data 110 are provided by the services of the private network 180. For example, the network 180 may be a network for virtual computing instances. Providing network configuration data (e.g., via an API), computing virtualization The network may include a network for a virtual storage instance. Various types of storage virtualization services provide configuration data (e.g., via an API). The data 110 may include, for example, a network 180 and an instance Description of the role assigned to a compute instance, the role given to a resource instance, Permissions granted or not granted, IP addresses assigned to instances It also includes the relationships between instances (e.g., the network between instances) It also describes the path to and from external entities (e.g. entities outside the virtual network) An interface or access to a computation instance that can be accessed by a A network may specify instances of networking primitives that describe a service point. Further aspects of the network configuration data 110 and its acquisition are described below with respect to FIGS. This is discussed below.

[0011] Returning to FIG. 1, in one embodiment, the network security assessment device 100 A query processing component 12 that can query network configuration data 110 0. The network security assessment apparatus 100 generates a query 125 and Query processing component 120 receives query results 126, can be analyzed to determine which ports, if any, are reachable. The query 125 may also include a query aggregation and analysis component 130. In one embodiment, the query language may be expressed as: A constraint problem is a recursive query about a network. About solvers (e.g., Satisfiability Modulo Theory (SMT) By solving queries using the Modulo Theory solver engine. It is a declarative logic programming language that allows a program to provide results for a query. An example of a query is "VNVS query-i Iist:can-s sh(AB)" which means that instance A can SSH into instance B. The virtual network is configured to provide a list of all instance pairs that can be Virtual Network Verification Service (VNVS) The network security evaluation device 100 requests the analysis Depending on your needs, you can dynamically build queries 125 or choose pre-built queries. In one embodiment, the query may be selected by an end user of the analyzer 100. , e.g., network security for one or more hosts under her or his control. It does not have to be written by the network administrator who is analyzing it. Such an embodiment is described below with respect to FIGS.

[0012] Returning to FIG. 1, in one embodiment, the network security assessment device 100 Can work according to the package of rules 135 related to network reachability In one embodiment, the query 125 may be generated according to rules 135. For example, Rule 135 specifies a set of port numbers for common services that are checked for reachability. The analyzer 100 can then determine which port numbers the host under analysis is attempting to reach. A query can be generated to determine whether the destination is reachable. The query 125 is Obtain configuration data affecting network access for one or more hosts under analysis The rule package 135 can be generated to manage security groups, virtual platforms, and Private Cloud (VPC), Subnets, Access Control Lists, Elastic Load Balancer, Internet Gateway, egress-only Internet Gate Way, network address translation, routing table, peered VPC, virtual private VPN (Virtual Private Network), Direct Connection (DX) and other networking components In one embodiment, the query results 126 can be analyzed according to rules 135. Analyze, for example, how different types of networking components work The solution can be used to determine which ports are reachable.

[0013] If any ports are deemed reachable, network security assessment The device 100 determines one or more routes to those ports from external entities. In one embodiment, the route may be determined according to rules 135 and / or queries. For example, the analyzer 10 may determine the number of queries that are generated by the analyzer 10 using one or more queries. 0 is the path or is the route (e.g. the path from the resource to the HTTPS gateway through which External entities can access resources on the virtual network (i.e., there is network connectivity). a direct path across a network that provides network connectivity between the Or, one or more hops along the route have been traversed and there is no network connectivity between the endpoints. It may be a transitive path that leads to a host's network reachability. Query aggregation and analysis by applying a set of predefined rules135 to Component 130 eliminates the guesswork and complexity of manual analysis (e.g., by a network administrator). It may represent an automated solution that removes the complexity.

[0014] In one embodiment, for example, the query aggregation and analysis component 130 may 5 to ensure that your instances are protected from the Internet or from outside your trusted locations. Internet Control Message Protocol (ICMP) l Message Protocol) access can be checked to see if it is allowed. In one embodiment, as another example, query aggregation The analysis component 130 uses rules 135 to determine whether the Install the TCP / UDP ports that are reachable from the network or from outside the trusted location. You can check whether your cabinet has one (if so configured). Specifically, port 135 is a port for insecure servers, administrative servers, database servers, and internet servers. Intranet ports, as well as other types of ports, may be examined. In this case, the query aggregation and analysis component 130 uses the rule 135 to Verify that the application is not accessible from anywhere on any port. In one embodiment, the query aggregation and analysis component 130 may 135 to allow subnets outside the trusted location per security group. You can check whether to allow ICMP or TCP / UDP port access from In one embodiment, the query aggregation and analysis component 130 may use the rules 135 to Use it to determine if there are instances in the subnet that cannot be reached from anywhere. Whether all inbound traffic is blocked or whether elastic Elastic Network Interface (ENI) erface).

[0015] In one embodiment, any reachable ports are identified without performing a traditional port scan. In one embodiment, the evaluation device 100 For example, by performing a limited port scan on only the affected ports. Therefore, you can check the packetless investigation results. For example, if TCP port 22 is If it is found to be reachable on host 170A, the network security evaluation equipment The device 100 may communicate with an external entity (e.g., a host via a public network 190). Send one or more packets to a TCP It can send to port 22, wait for a response from the host, and report back to the analyzer. If no such response is received, the network security evaluation device 100: It may be possible to determine that a port is not actually reachable. For example, if the port is If a response is received, the The security assessment device 100 verifies that the port is open and reachable. Such port scans can be performed on ports that are already assumed to be reachable. By restricting the access to the full port, the network security evaluation device 100 This can significantly reduce the time and network bandwidth required for scanning.

[0016] The network security evaluation device 100 is configured to analyze the hosts 170A to 170N. For one or more of these, network reachability and / or network security As described below with respect to Figure 3, The work security assessment device 100 collects data from various sources (in some cases, We may use this information to conduct such investigations in combination with other data collected by the agent, including on-host data. Returning to FIG. 1, the reporting component 140 can be used to: The network security evaluation device 100 generates a report describing the aspects of the findings. In one embodiment, the reporting component 140 can It can indicate or describe one or more ports 141 that are reachable for the In one embodiment, the reporting component 140 reports whether a particular host is reachable. In one embodiment, one or more ports 141 may be shown or described. The reporting component 140 then generates one or more routes 142 to ports that are reachable. In one embodiment, the reporting component 140 may instead disclose that no ports are reachable for a particular host. An example of such a report is described with respect to FIG.

[0017] In one embodiment, a whitelist can indicate trusted locations, If it is found to be reachable from a location, a specific port or range of ports is reported. In various embodiments, the method may be removed from 140 based on industry standard knowledge, customer input, multiple Using various data sources, including customer-based machine learning, and / or other appropriate sources The contents of the whitelist can be determined by the customer. The contents of the whitelist may change over time. .

[0018] Returning to FIG. 1, the reporting component 140 presents the findings in any suitable manner. In one embodiment, the reporting component 140 may, for example, The network administrator is provided with a Graphical User Interface (GUI). In one embodiment, the results of the survey can be presented in a user interface. The GUI may, for example, receive user input related to the findings, as described below with respect to FIG. Returning to FIG. 1, in one embodiment, The reporting component 140 then stores the findings in a file or other data object. Files or data objects can be stored persistently and managed by the network. In one embodiment, the report may be read by a person or other suitable entity. Component 140 may communicate with the customer using email or another messaging system, e.g. For example, you can send the findings to an account accessible by your network administrator. can.

[0019] The network security evaluation device 100 and the hosts 170A to 170N are The present invention may be implemented using any suitable number and configuration of computing devices. Any of the exemplary computing devices may be used in conjunction with the exemplary computing device 1500 shown in FIG. The computing device may be implemented by any suitable number of data centers. In various embodiments, network security may be provided. At least some of the functionality of the device 100 may be implemented on the same computing device. The network may be provided by, or through, a variety of computing devices. Any of the components of the security assessment apparatus 100 may be implemented on a variety of computing devices. When implemented using The devices may be communicatively coupled via one or more networks, for example. Each of the components of the network security evaluation device 100 has its own functions as described below. Any combination of software and hardware that can be used to perform a particular function The operations performed by the network security evaluation device 100 may correspond to , for example, without requiring user initiation or user intervention after an initial configuration phase, and without requiring programming. According to the system, for example, program instructions are executed on at least one computing device. This can be done automatically by running the Threat Modeler Network Security Assessment The device 100 and network 180 may include additional components not shown. The present invention may include fewer components than those shown in the drawings, or may be configured in a different way from that shown in the drawings. It is contemplated that the embodiment may include any number of components.

[0020] The network security assessment device 100 is a multi-service network that uses a service-oriented architecture. A service can be implemented in a service-oriented system, where multiple services work together. In such an environment, The network security evaluation device 100 provides its functionality as a service to multiple clients. The services can be distributed across one or more networks. The embodiment may be implemented using multiple different instances distributed over a single Access to the functionality of the service can be provided to a variety of clients. An appropriate number and configuration of clients are connected to the network security evaluation device 100. It is considered possible for a client to invoke that functionality. To achieve this, the network security assessment device 100 may include one or more APIs or may be used with other programmatic and / or graphical user interfaces. Any suitable interface may be exposed, such as a graphical user interface (GUI). In one embodiment, the functionality of the network security assessment device 100 is provided in exchange for a fee. may be provided to the client.

[0021] The network security assessment device 100 is a device that assesses the security of a host computer via one or more networks. 170A-170N, a service client, another service, or another entity In various embodiments, the network 190 may be coupled to a network security A network-based communication is established between the reliability evaluation device 100 and the hosts 170A to 170N. Any suitable combination of networking hardware and protocols required to establish For example, a network may include a combination of networks that collectively implement the Internet. The network may include various telecommunications networks and service providers. , Local Area Network (LAN) or Wide Area Network (WAN) and other private networks This may also include public or private wireless networks. For example, both the network security evaluation device 100 and the hosts 170A to 170N may each be housed within an enterprise with its own internal network. In the embodiment, the network includes a network security assessment device 100 and an Internet and between the Internet and hosts 170A to 170N. The hardware required to establish a link (e.g., modems, routers, switches, load balancers, proxy servers, etc.) and software (e.g. protocol stacks , accounting software, firewall / security software, etc. In some embodiments, the network security assessment device 100 is Use a private network instead of the net to communicate with hosts 170A-170N. Note that it is possible to

[0022] In some embodiments, the network security assessment device 100 and / or the host The aspects of 170A to 170N are The provider network may be implemented using the Internet and / or other One or more services that are accessible over a network (various types of networks) Provides a distributed set of clients with a single point of access (such as accessible computing or storage) A network established by an entity such as a company or public sector organization to provide A provider network can be a set of internet services provided by a provider. The physical computers used to implement and distribute infrastructure and services. Data servers and / or virtualized computer servers, storage devices, networking It may include multiple data centers hosting various resource pools, such as collections of equipment, etc. In some embodiments, a computing resource may be a virtual computing instance or a physical computing instance. Virtual computing is a technology that allows a user to access a virtual machine from a virtual storage device, such as a virtual storage device. An instance can be configured with a specific computing capability (type and number of CPUs, main memory size, etc.). etc.) and a specified software stack (e.g. A specific version of an operating system that can run on a hypervisor) A general-purpose or special-purpose computer server, a storage Several different types of computing devices, including The network devices may be used alone or in combination to provide a service to a provider network in various embodiments. The resources of the provider network can be implemented simultaneously. A provider network can be under the control of multiple clients (or tenants). A network is sometimes said to offer multitenancy, and is a multi-tenant provider network. It is also called a network.

[0023] In some embodiments, the operators of the provider network may It implements a flexible set of resource reservation, control, and access interfaces for For example, a resource manager can be implemented as a other components in the provider network) to the provider network. Learn about, select, and purchase access to the compute instances offered by programmatic resource reservation, allowing users to acquire and / or reserve The interface may be implemented (e.g., via a website or a series of web pages). Such an interface would allow browsing of the resource catalog and Different types or sizes of resources that are supported, different reservation types or modes that are supported This may include the ability to provide details and specifications such as model, pricing model, etc.

[0024] FIG. 2 illustrates a virtual network verification service for assisting in the analysis, according to some embodiments. A system for automated packetless network reachability analysis, including interaction with the 1 illustrates further aspects of an example system environment. In one embodiment, the network configuration data 110 is , may be obtained and maintained by the virtual network validation service 230. The verification service 230 also receives the queries 125 and uses the network configuration data 110 to and a query processing component that can use the The virtual network verification service 230 may include a virtual network verification service 120. The work security assessment device 100 may be provided to one or more clients. Further aspects of the virtual network validation service are described below with respect to FIGS. can be done.

[0025] FIG. 3 illustrates an agent on a computer that is the subject of analysis, according to some embodiments. Further examples of system environments for automated packetless network reachability analysis, including the use of In one embodiment, the network security assessment device 100 includes various Data from various sources can be combined to draw conclusions. The network security assessment device 100 may, for example, determine which process is listening on a port. To determine whether the agent software is installed on the computer If a process is listening on a port, the port A process can be considered "open." A process can be a service, application, or server. The example of FIG. 3 may include a daemon, a spyware program, and other forms of executable program code. As shown, an agent 175A may be installed on a host 170A. Agent 175N may be installed on host 170N, and so on. As shown, process 176A may reside on host 170A (and may be running on port 170B). 1A), process 176N resides on host 170N. (and may be listening on port 171N). The agents 175A to 175N may be, for example, hosts 170A to 170N that are the same or different. equivalent to a variety of hardware and operating system software configurations, They may correspond to the same binary file or different binary files.

[0026] Agents 175A to 175N have the ability to see into the configuration of hosts 170A to 170N. In one embodiment, the agents 175A to 175N For example, it is useful to determine when a port is opened and which process is associated with it. In one embodiment, the agent can monitor the operation of the corresponding host to The agents 175A-175N may, for example, determine which ports are open and / or which To inquire whether processes 176A-176N are listening on a port, In one embodiment, the host computer is capable of interacting with the operating system of the corresponding host. In the present embodiment, the agents 175A to 175N are configured to Look for processes listening on a particular port that the analyzer has already deemed reachable. The network security assessment device 10 can instruct the agent to 0. Agents 175A-175N may query the results of their investigations. The data may be configured to be reported to an aggregation and analysis component 130.

[0027] In one embodiment, based on information relayed from agents 175A-175N, The query aggregation and analysis component 130 uses rules 135 to determine whether the process is In one embodiment, the port number of the port number is opened. Based on the information relayed from agents 175A to 175N, the query aggregation and analysis Component 130 uses rule 135 to tell the instance that it is unreachable from anywhere. You can check which processes are listening on which ports. The data collected by agents 175A-175N, such as knowledge of Using the analysis, the reporting component 140 identifies open and reachable ports 14 Creating a report showing or describing the processes 143 that are listening on one In one embodiment, the reporting component 140 may programs that use unauthorized ports and therefore may pose a security threat. The process may be shown or described.

[0028] FIG. 4 illustrates an automated system for detecting and / or detecting a problem, including recommending and / or taking corrective action, according to some embodiments. 1 illustrates further aspects of an example system environment for packetless network reachability analysis. In an embodiment, the query aggregation and analysis 130 determines why a port is reachable. For example, one or more configuration settings may be responsible for the ports that are reachable. Data collected from one or more sources (e.g., network configuration data 110 and By applying rule 135 to the agent 175A to the agent 175N, the network The network configuration analyzer analyzes one or more configuration settings that contribute to the port being reachable. The reporting component 140 can then determine the extent to which such investigations The results can be reported.

[0029] In one embodiment, the network security assessment apparatus 100 also detects if This is expected to eliminate or fix the security concerns associated with reachable ports. For example, a specific security group may be If the port is reachable due to the host's membership in the The security group configuration settings must be changed to prevent external computers from accessing the port. In one embodiment, such corrective action 144 may include modifying the reporting In one embodiment, the Corrective actions are interfaces that automatically correct problems when selected by the user. For example, the reporting component 140 may be presented in a GUI with a reporting element. Describe the modifications that were made and create a button that, when pressed by the user, will implement the changes to the appropriate configuration settings. You can generate screens in the user interface that contain Cut.

[0030] FIG. 5 illustrates an automated packetless network reachability analysis according to some embodiments. 1 shows an example of a report generated using the network security evaluation device 100. Aspects of the findings, e.g., reachable ports, routes to those ports, The process listening on the port, the configuration settings responsible for the port being reachable, security concerns associated with the determination of reachable ports, corrective action to be taken (e.g., changing configuration settings), and / or any other appropriate information Figure 5 shows a report that describes the (referred to as "network reachability report") for a specific port on that host 5 shows an example of a report 500. The report 500 may include, for example, The affected TCP port number and the service ID that is typically associated with that port. In this example, the TCP port number is 2. 2, which is typically used for Secure Shell (SSH) purposes. The report 500 includes an indication of the severity 520 of the problem (e.g., high, medium, or low). The report 500 may also include a more detailed description of the findings 530. As shown in example 5, description 530 indicates that the port is not available from the public Internet. In this case, it may indicate routes that are reachable through a specific Internet gateway. In an embodiment, the description 530 may include, for example, a security group, an access control list, , routing tables, Internet gateways, etc., may cause access problems. Description 530 may indicate the reason why the instance belongs to a particular virtual private The VPC, the ID of the network interface for the instance, The description 530 may also include the ID of a security group for the port. Describe the possible security problems that are caused by the Finally, the Report 500 provides recommendations for remediating security concerns. A recommendation 540 for corrective action may be included. In this example, the recommendation is to edit the security group. This eliminates access to this specific port via the public Internet. As discussed above with respect to FIG. 4, in one embodiment, the report 500 is generated based on user input. A user interface that automatically implements recommendations 540 when enabled by force In one embodiment, the report 500 may include the network topology being analyzed. The visualization may include highlighted findings, color-coded threat severity, , and user interaction.

[0031] FIG. 6 illustrates an automated packetless network reachability analysis according to some embodiments. and the reports generated by the agent on the computer being analyzed. In one embodiment, the above-mentioned report 500 is As shown in the example in Figure 6, such an agent can be generated without using the agent. The use of agents may allow for more detailed reachability reports 600. Thus, the report 600 includes high-level findings 610, severity 620, and detailed A description 630 and a recommendation 640 for correcting the problem may be included. By relying on data collected through the Report 600, the Report 600 is open and reachable. In this example, the process The service is the SSH daemon "sshd". Report 600 corresponds to the sshd process. You can also specify the path of a specific binary file that you want to use to process the process. Diagnose and remediate security issues by adding them to network reachability reports can help.

[0032] FIG. 7 illustrates an example of an automated packetless network reachability analysis according to some embodiments. 7 is a flow chart showing a method for The network configuration data may be collected from the host computer and, in some cases, Depending on the other computers and networking devices (routers, switches, etc.) ) and networks (such as private networks) that have In one embodiment, the analysis may involve the use of one or more queries to The query may include querying network configuration data according to a query language. In network reachability analysis, queries can be dynamically tailored according to the needs of the analysis. A user can input a query or select a pre-built query. In this case, the query may be sent to an end user of the analyzer 100, e.g., a user of a system under her or his control. A network administrator who wishes to analyze the network security of one or more hosts It does not have to be written by

[0033] Based on the analysis, the method further comprises: It can determine which ports on a host computer are reachable. The access is either through the public Internet or through the private network to which the host belongs. Based on the analysis, the method also includes determining whether the port is reachable through the network. It is possible to determine one or more possible routes. For example, a route may be The client is connected to the Internet through the Internet Gateway. From a virtual private network (VPN) via a peer-based virtual private It may indicate that it is reachable, for example from the cloud (VPC).

[0034] As shown at 730, the method includes having an agent access a host computer under analysis. The agent can determine whether the application is installed, for example. To determine which process is listening on a port, an aspect of the host computer's operation is examined. If no agent is present, as shown at 740, In addition, this method identifies reachable ports and the routes by which the ports are reachable. In one embodiment, a report can be generated that shows or describes the Contains one or more properties related to security groups or access control lists (ACLs). It can also indicate or describe why the port is reachable, such as the configuration settings above. In one embodiment, the report also includes a recommendation for corrective action, such as changing one or more configuration settings. One or more recommendations may be stated or described.

[0035] If an agent is present, the method may, as shown at 750, Use the data provided by to determine which process is listening on the port. As shown in 760, this method requires that the port is open and reachable. The routes by which the port is reachable, and the processes listening on the port. In one embodiment, a report can be generated that shows or describes the also indicates why the port is open and reachable, such as one or more configuration settings. In one embodiment, the report may also include one or more One or more recommendations for corrective action, such as changing configuration settings, may be indicated or described.

[0036] Example Rules for Network Reachability As described above, the network security assessment device 100 They can work according to a package of 135 rules with potential consequences. Examples of such rules include The following list of rules is not intended to be exhaustive. The network security evaluation device 100 implements only a part of the following rules: and / or additionally to assess the reachability of the computing device. Rules can be implemented.

[0037] In one embodiment, the first rule includes using an agent to analyze the instance. , a secure server listening on a port that is allowed access from somewhere outside the trusted location. It can be determined whether an instance has a protocol with low security. The severity of the finding is High. The finding is based on the port number, the TCP or UDP associations, and the application (and version) listening on that port , the address range that can reach that port, and the security policy that allows access. Groups, Access Control Lists, Internet Gateways, Virtual Gateways, and The first rule is that recommendations for corrective action must include , edit the access control configuration to restrict access (access from outside trusted locations) access is not required), and shutting down applications (if they are not required for work) ) may be included.

[0038] In one embodiment, the second rule includes using an agent to analyze the instance. , SH listening on a port that is accessible from somewhere outside the trusted location It is possible to determine whether an instance has an S server. The results of this investigation are based on the port number, its TCP or UDP association, It will tell you which application (and version) is listening on that port, The address range that can be reached, and the security groups that allow access, Access Control Lists, Internet Gateways, Virtual Gateways, and Others The first rule is that recommendations for corrective action must include access restrictions. Edit the control configuration to restrict access (requires access from outside trusted locations) This could include shutting down applications (if they are not required for work). do.

[0039] In one embodiment, the third rule comprises using an agent to analyze the instance. , an RD listening on a port that is accessible from somewhere outside the trusted location The importance of this finding is that it is possible to determine whether an instance has a P server. The severity is medium. The results of this investigation are based on the port number, the TCP or UDP It will then display the application (and version) that is listening on that port, The address range that can reach the server and the security groups that allow access. , Access Control Lists, Internet Gateways, Virtual Gateways, and more The third rule requires that recommendations for corrective action must be made through the relevant access channel. Edit the control configuration to restrict access (if access is required from outside a trusted location) This includes shutting down applications (if they are not required for work) and shutting down applications (if they are not required for work). obtain.

[0040] In one embodiment, the fourth rule comprises using an agent to analyze the instance. , a database listening on a port that is accessible from somewhere outside the trusted location. The result of this check can be used to determine whether the instance has a database server. The severity of this finding is Medium. The findings include the port number, the TCP or UDP Associate it with the application (and version) that is listening on that port, The address range that can reach the port, and the security group that allows access Groups, Access Control Lists, Internet Gateways, Virtual Gateways, and Others The fourth rule requires that recommendations for corrective action must include a statement of the action taken, along with other channels. Edit the access control configuration to restrict access (access from outside trusted locations) This includes shutting down applications (if they are not required for your work) and shutting down applications (if they are not required for your work). It can be rare.

[0041] In one embodiment, the fifth rule comprises using an agent to analyze the instance. , an interface listening on a port that is accessible from somewhere outside the trusted location. It can be determined whether an instance has a transnet service. The severity of the result is Medium. This finding is based on the port number, the TCP or UDP traffic on that port, and DP association, the application (and version) listening on that port, The address range that can reach that port, and the security that allows access Groups, Access Control Lists, Internet Gateways, Virtual Gateways, and The fifth rule requires that recommendations for corrective action should include: Edit the access control configuration to restrict access (access outside trusted locations) This includes shutting down applications (if they are not required for your work) and shutting down applications (if they are not required for your work). It can be rare.

[0042] In one embodiment, the sixth rule comprises using an agent to analyze the instance. , the port on which the instance is allowed access from somewhere outside the trusted location This finding has a low severity. The results of this investigation include the port number, the TCP or UDP association of that port, Which application (and version) is listening on that port, and how to reach that port The address range that can be accessed, the security groups that allow access, and the access restrictions Control list, Internet Gateway, Virtual Gateway, and other channels The sixth rule requires that recommendations for corrective action include modifying the access control configuration. Consolidate and restrict access (if access from outside trusted locations is not required) , and stopping applications (if not required for work).

[0043] In one embodiment, the seventh rule comprises using an agent to analyze the instance. Determine if an instance has an application that opens a connection on an unusual port The severity of this finding is low and is considered informational rather than a specific threat. The results of this investigation include the port number, its TCP or UDP association, , which application (and version) is listening on that port, The address range that can be reached, the security groups that allow access, and the access Access Control Lists, Internet Gateways, Virtual Gateways, and Other Controls The seventh rule requires that recommendations for corrective action must include the application This may include verifying that the application is behaving as expected.

[0044] In one embodiment, the eighth rule is to analyze the instance without an agent and Whether the instance allows ICMP access from anywhere outside the trusted location. The severity of this finding is Medium. The address range that can reach that port, and the security group that allows access Loops, Access Control Lists, Internet Gateways, Virtual Gateways, and In addition to other channels, the eighth rule requires that recommendations for corrective action must include This may include editing the access control configuration to restrict access (outside trusted locations) access is not required).

[0045] In one embodiment, the ninth rule is to analyze the instance without using an agent. This allows the instance to access what are typically insecure ports ( For example, determining whether to allow access to ports 20, 21, 23, etc. The severity of this finding is Medium. This finding is based on the port number, port TCP or UDP association, the application that typically uses that port, and the port The address range that can be reached, and the security groups that allow access, Access Control Lists, Internet Gateways, Virtual Gateways, and Others The ninth rule requires that recommendations for corrective action must include access restrictions. This may include editing the control configuration to restrict access (access outside trusted locations). (if no service is required).

[0046] In one embodiment, the tenth rule is to analyze the instance without using an agent. This allows the instance to access administration port number 22 (usually This allows the administrator to determine whether to allow access to the SSH protocol. The severity of the finding is Medium. This finding is based on the port number, the TCP or UDP port number, Port association, the application that normally uses that port, and the port that can be reached The address range that can be accessed, the security groups that allow access, and the access control list along with Internet Gateway, Virtual Gateway, and other channels. The tenth rule states that the corrective action recommendation should include editing the access control configuration. This may include restricting access to the system (administrator access from outside a trusted location) (if no service is required).

[0047] In one embodiment, the eleventh rule is to analyze the instance without using an agent. This allows the instance to access administration port number 3389 (communication) from somewhere outside the trusted location. It is possible to determine whether to allow access to the RDP protocol (usually used for RDP). The severity of this finding is Medium. This finding is based on the port number, the TCP or UDP association, the application that normally uses that port, and the ability to reach that port The address range that can be accessed, the security group that allows access, and the access control Lists, Internet Gateways, Virtual Gateways, and other channels The 11th rule requires that corrective action recommendations include modifying the access control configuration. This could include restricting access to trusted administrators from outside the trusted administrator location. (if access is not required).

[0048] In one embodiment, the twelfth rule is to analyze the instance without using an agent. This allows the instance to access the database port (for example, , ports 1433, 1434, 3306, etc.) The significance of this finding is low. This finding is based on the port number, port The TCP or UDP association of the port, the application that typically uses that port, The address range that can reach the port, and the security group that allows access Groups, Access Control Lists, Internet Gateways, Virtual Gateways, and Others In addition to other channels, the 12th rule requires that recommendations for corrective action must include This may include editing the access control configuration to restrict access (from the Internet) (if database access is not required).

[0049] In one embodiment, the thirteenth rule is to analyze the instance without using an agent. This allows the instance to access intranet ports from somewhere outside the trusted location. The severity of this finding is low. The results of this investigation include port numbers, the TCP or UDP association of the port, and usually the The application that uses the port, the address range that can reach that port, and Security groups, access control lists, and internet gates to allow access The 13th channel may be reported along with the way, virtual gateway, and other channels. The rule recommends a corrective action to restrict access by editing the access control configuration. may be included (if intranet port access from the Internet is not required).

[0050] In one embodiment, the fourteenth rule is to analyze the instance without using an agent. The instance will then be able to access all other ports (such as For example, ports to which rules 8 to 13 do not apply) The significance of this finding is low. This finding is based on the port number, port The TCP or UDP association of that port, the application that typically uses that port, The address range that can reach the port, and the security groups that are allowed access Groups, access control lists, Internet gateways, virtual gateways, and their Along with other channels, the 14th rule requires that recommendations for corrective action must include This may include editing the access control configuration to restrict access (outside trusted locations) (if you do not need access to them).

[0051] In one embodiment, the fifteenth rule includes using an agent to analyze the instance. Check if the instance has open connections to ports that are not accessible from anywhere. The severity of this finding is low and may be considered informational. The findings include port numbers, the application (and version) associated with each port. version), along with any applicable access control lists and security groups. Rule 15 requires that recommendations for corrective action cannot be accessed if they are not needed. This may include terminating certain services.

[0052] In one embodiment, the sixteenth rule is that the instance may be executed with or without an agent. Analyzes all inbound traffic to the instance to see if it is being blocked The severity of this finding is low and is considered informational. The results of this investigation may be combined with the appropriate access control lists and security groups. Rule 16 requires that recommendations for corrective action must include a statement of whether or not shutoff is appropriate. This may include checking whether

[0053] Virtual Network Validation Service In some embodiments, the network configuration analysis uses a virtual network validation service. In some embodiments, the virtual network validation service may be implemented as a declarative logic Using a programming language, the network reachability analyzer analyzes the provider network We express queries, including recursive queries, about virtual networks on the network as constraint problems. , constraint solvers (e.g., Satisfiability Modulo Theory (SMT) Solving queries using the Modulo Theories (MS) solver engine In some embodiments, the method may provide results for a query. An example of a declarative logic programming language that may be used is Datalog. It should be noted that any programming language may be used.

[0054] Equipping and configuring networking primitives within a client virtual network To do this, clients can use various provider network services, Each service has its own Application Programming Interface (API: Application Programming Interface) and Traditionally, code samples and documentation are used to provide working semantics. Although each service can be provided with a different level of networking, There was no formal description of the interactions between networking primitives. The virtual networking semantics and logic for the networking primitives are Represented and encoded as a set of virtual networking rules according to a programming language Virtual networking rules can be implemented in virtual networks and can be Various networking services provided by Ida Network's services and APIs It may contain rules that express common relationships and interactions between primitives. Topology is how virtual networking works in a provider network environment. Have virtual networking rules that describe the logic for a single location or file can be done.

[0055] In some embodiments, the virtual networking rules are based on the Payment Card Industry Data Center. PCI DSS:Payment Card Industry Data Security Standard Security Standard, U.S. Federal Risk and Authorization Management Program FedRAMP:Federal Risk and Authorization Health Insurance Portability and Interoperability Program (HIIP) Standards Health Insurance Portability Act (HIPAA) Security standards such as the Quality and Acoundability Act standards , or may incorporate rules that encode the client's internal security standards. Depending on the form, the virtual network validation service can verify two virtual networking rules: One can provide one or more different sets, each of which corresponds to a particular criterion. Various networking factors that can be selectively used to verify the compliance of a virtual network of In some embodiments, the virtual network verification service encodes a security criterion for the virtual network. The Client's internal security standards, best practices, or other network Add custom rules to clients (network reachability analyzers) that encode the requirements for , etc.) to define their particular virtual network Virtual network, including custom rules defined by the client to apply to A set of working rules may be implemented.

[0056] In some implementations, the virtual network verification service may The description information is, for example, a description of the network implemented in the virtual network. Identify instances of networking primitives and provide a description of the instances (e.g., Roles assigned to an instance, granted or not granted to a resource instance The instance ID, the permissions that are not granted, the IP address that is assigned to the instance, and so on. Describe the relationships between instances (e.g., paths across a network between instances), An interface or access point to an external entity (e.g. a virtual network A service may describe a service instance (a computation instance that can be accessed by entities outside the service). In some embodiments, the client obtains description information from the virtual network and The information can be provided to a virtual network validation service. In other words, the client is responsible for verifying the virtual network by the virtual network verification service. The Virtual Network Verification Service has been granted permission to obtain information directly from the The virtual network verification service is written in a declarative logic programming language. Thus, the descriptive information can be encoded as a logic program.

[0057] An embodiment of the virtual network validation service includes a port scanning method and a syntax checking method. This provides significant advantages over traditional network analysis methods such as Unlike these conventional methods, the virtual networking rules and Through the network description, the virtual network validation service validates all networking About primitives and resource instances and their complex interrelationships It relies on the devices being operational at the time of the scan, and therefore can gain knowledge of the Traditional methods may only be able to identify paths across the network between devices present Descriptive information is different from one or more Use only DESCRIBE calls to the provider network service's API. The data may be obtained by the client or by the service, so that each device Even if the service or instance is not running and listening, The port scanning method can identify the path through which a threat is occurring. However, it may not be possible to be sure that a threat has not occurred. It can check shallow properties of individual network devices, but the attack vector is However, in some embodiments, the virtual network verification service does not check for the presence of a vector. is derived from network policy as expressed in encoded virtual networking rules. It can spot all possible deviations in the In addition, the description information can be used to check both the DESCRIBE command to one or more provider network services that maintain the data. may be obtained by the Client or the Service using only the This makes it possible to exploit the vulnerability by using traditional methods such as port scanning, which requires substantial network and CPU bandwidth. Unlike traditional methods, there is little to no impact on the client's virtual network. ,Also, as in the case of port scanning methods, any device on the provider ,network can be used. Full network access to the network is not required.

[0058] In some embodiments, the virtual network verification service may include a client (network In some embodiments, the query is received from a node (e.g., a reachability analyzer). It can be formulated in an expressive query language similar to QL but applied to network configurations. A non-limiting example of such a query is "VNVSquery -i Iist:ca n-ssh(AB) is an example of a SSH connection between instance A and instance B. The virtual network is configured to provide a list of all instance pairs that can be SHed. Alternatively, in some embodiments, the query A non-limiting example of such a query is "instant List all instance pairs where instance A can SSH to instance B. In some embodiments, at least some A few predefined queries provide a graphical interface to the virtual network validation service. The user can then control the user interface elements (e.g., menus) through the user interface. may be provided to.

[0059] The queries may correspond to theorems on the generated logic program and may represent constraint problems. The Virtual Network Verification Service solves constraint problems according to a declarative logic programming language. Use a constraint solver program (also called a constraint solver engine) that is configured to Then, according to the encoded rules, the queries on the encoded descriptions are represented by The constraint problem can be solved and the results provided to the client. The Virtual Network Validation Service provides an API and interface for submitting queries. In some embodiments, the virtual network validation service may provide A set of standard queries that clients can select through the API and interfaces. In some embodiments, the virtual network verification service may provide a set of ,Clients can create custom queries and submit them via API and interface This may make it possible to

[0060] In an embodiment, through a graphical interface to the service on a console or through the Command Line Interface (CLI). interface), the client uses the virtual network validation service to Questions about client virtual networks on provider networks (with explicit constraints) You can get answers to queries that may be presented. Some examples of questions include, but are not limited to: Which instances in a virtual network are accessible from the Internet? ? Which instances can access a given resource on a virtual network? (e.g. databases, caches, storage endpoints, other instances) chest of drawers, etc.)? The virtual network must adhere to best practice networking security standards. Is it based on? The virtual network is responsible for managing the network according to its own company's best practices, which are encoded in this set of rules. Does it comply with the standards?

[0061] More commonly, a client (such as a network reachability analyzer) may Use the network validation service to verify that resources in a virtual network and The expected pipes between the application and other resources, as well as the expected paths to external entities. Is the pipe open and is the expected pipe the only open pipe (e.g., External entities may identify resources in the virtual network that they should not be allowed to reach. You can verify whether the source can be reached.

[0062] A pipe between one resource and another in a virtual network, or Verifying that a pipe between a resource in your work and an external entity is open is Paths or connections across a network between resources, or between resources and external entities or a route (for example, from a resource through which an external entity Is there a path to an HTTPS gateway that can access the above resource? The path may include verifying that the endpoint has It may be a direct path across the network that provides network connectivity between the or one or more hops along the route, resulting in a network connection between the endpoints It may be a transitive path that provides a mechanism for maintaining metadata that describes the virtual network. A DESCRIBE call to the API of one or more provider network services that Only using the ,network ,description information can be obtained about the virtual network, so that, Even if the respective device or instance is not running and listening In some embodiments, the path can be verified. The information is about the permissions that are granted or not granted to resources (e.g. virtual network A party that grants or denies access to a single resource to an endpoint on the network. Mission or access to a given endpoint (e.g., storage endpoint) IP address ranges or resource instances that can or cannot access In these embodiments, the permissions may include permissions that specify a particular port of the database. Verifying that a path in a virtual network is open ensures that the required This may include verifying that the mission has been given. Verifying that the only open path is the virtual network or external entity. Resources within the security have permission to access resources they should not have access to. The method may include determining that the device does not have a device option.

[0063] A virtual network validation service that has an appropriate set of virtual networking rules Embodiments may include, for example, a customer virtual network that is connected to a payment card industry data center. PCI DSS, Federal Risk and Authorization Management Program (Fed RAMP) Standards, or Health Insurance Portability and Accountability Act (HIPPA) Helps verify compliance with networking security standards such as the or that the customer's virtual network meets or exceeds the client's internal security standards. to verify compliance with other internal networking requirements of It can be used by the Network Reachability Analyzer.

[0064] Another application of the virtual network verification service is network security issues. or to identify the possible impact of software bugs or other vulnerabilities in virtual networks. For example, to stop a service running on a specific instance in a virtual network. If a vulnerability is discovered in a particular software program, the client (network Reachability analyzers, etc., determine whether this instance is connected to other instances in the virtual network. Create and submit a query to determine all the ways that you can communicate with the The result is that the client can identify the possible impact of vulnerabilities and therefore It may enable decisions to be made as to how best to handle a situation. For example, from an instance with a mission-critical database If there is no direct path to recovery, the issue is assigned a low priority that is handled according to the normal maintenance schedule. This gives the vulnerability to the mission-critical data. If the database affects an instance, at least one A decision can be made to shut down the department and immediately address the vulnerability.

[0065] Another application of the virtual network validation service is the provisioning of a provider network environment. During offline testing of virtual networking changes. For example, Virtual networking describes the logic of how virtual networking works in a work environment. Use the networking rules in a test environment to validate changes to virtual networking primitives. Test the changes before they are applied to the provider network and ensure that the changes are applied to the virtual network. It is possible to determine what impact this may have.

[0066] Another application of the virtual network validation service is to verify the virtual network for a client. When integrating automatically, e.g. clients (Network Reachability Analyzers) ) comply with certain networking security standards and are You might want to establish a virtual network that contains a set of networking primitives. Yes. To avoid the need for clients to build and test their own virtual networks, Use the virtual network validation service and virtual networking rules to enforce constraints (classifications). Client-specific primitives, networking security standards, virtual networking A virtual network that describes the logic of how the service works within the provider network environment. Automatically integrate and validate virtual networks that meet all of the following requirements: For example, the constraints imposed by the criteria can be presented as queries: The query can be resolved to determine a virtual network configuration that satisfies the constraints; or It is possible to determine whether the configuration of a virtual network complies with the constraints. In this way, virtual networks that comply with the constraints may be aggregated, or virtual networks that comply with the constraints may be aggregated. may be modified to comply with

[0067] Another application of the virtual network validation service is to verify that configurations or changes are Before being implemented in the network, new clients (such as network reachability analyzers) Allows you to validate a new virtual network configuration or changes to an existing virtual network. For example, the virtual network configuration can be created or modified by the client. Constraints on the composition may be presented as queries, and the composition may Before the configuration is implemented in the provider network, the query must be resolved to ensure that the configuration is consistent with what is presented in the query. It may also verify that the request conforms to the specified client constraints.

[0068] FIG. 8 illustrates a virtual network in a provider network environment, according to some embodiments. A service that provides a provider network 800 to clients. The service provider allows the client to access a virtual network on the provider network 800. Services and applications that enable the network 810 to establish and manage resources A provider may provide an application programming interface (API) 802. The virtual network 810 in the data network 800 environment is A network space including a set of provider network resources of a client a logically isolated section on the provider network 800 for the client's resources and It can be broadly defined as the network space that functions as a (The virtual network 810 is logically defined by the address space.) Private or local Internet Protocol (IP: Internet Protocol) address space, e.g. Version 4 (IPv4: Internet Protocol version 4) It is possible to implement 32-bit IP addresses within a range or subnetwork. Sources on the network 810 (e.g., computing resources, storage resources, servers, The virtual network 810 address space includes the following: A 32-bit IP address (e.g., a 32-bit IPv4 address) may be assigned to the provider. The client virtual network 810 on the imager network 800 on a host device configured as a virtual computing resource instance. Client resources such as virtual machines (VMs) Instances. At least one of the resource instances on the provider network. Some are capable of running multiple operating systems simultaneously on a host computer, i.e. It follows hardware virtualization technology that allows it to run as a VM on the host device. It can be implemented by a hypervisor or virtual machine monitor on the host device. (VMM: Virtual Machine Monitor) on each host It presents a virtual platform to the VMs and monitors the execution of the VMs on the host device. A VM is given one or more IP addresses, and the VMM on each host manages the You may know the IP address of the VM.

[0069] Various network resources, structures, and functionality (networking primitives and 802) to the provider network via various provider network services 802 The client may be provided with at least some of the various 802 , a client on the provider network 800 using the services and APIs 802 . The virtual network 810 of the client can be created, configured, populated, and modified. The following is a list of services that may be provided by the service 802 and is intended to be limiting: Here are some examples of networking primitives: Virtual Network Resource instances (e.g., virtual instances by clients using the service 802) A VM configured as a virtual computing resource instance (for example, an application) application servers, web servers, database servers, access points, gateways, The instance of a particular provider network service, such as a load balancer or logging service. Stance, network monitoring and analysis services, code repository services, containers Management services, etc. Tags - In some embodiments, clients may tag resource instances. This allows you to access a specific resource instance (e.g. For example, a VM may be allowed to be assigned a specific role. Tags may be, for example, PROD or D A tag can be a text string such as EV. Tags may be stored as standard provider network defined tags and / or client An example of a resource instance role is a Secure Socket Shell ( SSH: Secure Socket Shell) access instance, logging server service instances, code repository instances, production resource instances, and and Development Resource Instances. Virtual network endpoints (e.g., compute resources, storage resources, endpoints, such as servers and host devices. Virtual network peering connection In some embodiments, the client You can establish two or more virtual networks on a network. The network traffic flows through the provider network without having to cross an external network such as the Internet. Peering connections are established between virtual networks, allowing secure communication across the network. It can be established. At least one resource in the virtual network is accessible from an entity outside the virtual network. An Internet gateway that provides access to several For example, across a group or cluster of resource instances on a virtual network. A load balancer instance, a virtualized load balancer instance that distributes network traffic. Dobalancer ●Network Address Translation (NAT) lation) instance NAT Gateway ●Network Access Control List (ACL) ●Network interface. Route Table Subnets - A virtual network can contain, but is not necessarily limited to, two or more subnetworks. A network may be subdivided into networks, subnets, or subnets. Security Groups - In some embodiments, the provider network may The client is located within the client's virtual network, within a subnet, or across subnets. This allows the administrator to establish and manage virtual security groups. A resource group is a logical grouping of resource instances, To one or more resource instances in a security group according to the security group rules. It acts as a virtual firewall that controls the traffic that is allowed to reach it. Region - provider network services and resources (e.g. virtual networks) network, VM instances, data storage, gateways, load balancers, etc.) , may be supported in multiple geographic locations or regions. The application supports provider network services where clients can A separate geographic area in which you can launch and configure services and APIs. allows a client to launch or replicate its resources in one or more regions. It may be possible to do so. Zones - Each region may contain multiple isolated locations, referred to herein as zones. A client's resource instance can only have one failed resource instance in one zone. In the event of a disaster, instances in another zone can service requests. The system can be distributed across multiple zones within the system.

[0070] In some embodiments, the client may access each provider network service 8 02 to create an instance of one or more of the networking primitives listed above. A virtual network 810 including: FIG. 8 illustrates an example virtual network 810 on a provider network 800. The examples are not intended to be limiting. 0 represents resource instances 818 (e.g., VMs) that implement the functionality of the virtual network. ), which may include, for example, application servers, web servers, database servers, etc. Resource instance 818 is a group or a set of instances 818A and 818B. For example, instance 818A may represent a production environment, while instance Instance 818B may correspond to a development environment. 8A and 818B may be in different subnets and / or security groups. do.

[0071] The client virtual network 810 also provides Operating system logging services, network monitoring and analysis services, code repositories A specific service within the client virtual network 810, such as a service for managing data, a container management service, etc. A service instance 816 that implements a particular provider network service (e.g., VM).

[0072] The client virtual network 810 also includes a The device 882 and other external entities 890 communicate over an intermediate network, such as the Internet. communicate with resources and endpoints in the virtual network 810 via the The access instance may include an access instance that allows the , load balancers and gateways (Internet Gateway, NAT Gateway As shown in this example, in some embodiments, the access instance may include The instances are HTTPS access instance 814 and SSH access instance 81 2. The HTTPS access instance 814 may include and from external entity 890 to resource instances 818A and 818B, respectively. Instances 814A and 814B for accessing the Using the IP address, a device 882 on a client network 880 can receive service instances. Instance 814C for accessing the store 816. The client can then use SSH, for example, to access the device on the client network 880. A device 882 (e.g., a console) can access a resource instance in the virtual network 810. In some embodiments, SSH is used to access the resource instance. To access the instance, the client needs to know the IP address and key of the instance. The client uses the provided information to SSH directly to the instance. In some embodiments, the SSH access instance 812 can be Ant uses the SSH protocol to communicate with device 88 on client network 880. 2 (e.g., console) to the resource interface of a client on the virtual network 810 For example, an SSH access Access instance 812 is a publicly accessible sub-server of the client's virtual network. At least some of the client's resource instances may be publicly accessible. These resource instances may be in inaccessible subnets. SSH access from the security group attached to H access instance 812 The client may be in a security group that allows You can now connect to SSH access instance 112 to connect to the database instance. Cut.

[0073] As shown in FIG. 8, a provider network 800 includes: A virtual network verification service implemented by one or more computing devices on In some embodiments, the virtual network validation service 830 may include The instance is, for example, SSH access instance 812 as shown in FIG. , may be implemented on the client's virtual network 800. The service 830 utilizes a declarative logic programming language (e.g., Datalog) to The client reconnects to the provider network for the client's virtual network. It may be possible to express queries, including recursive queries, as constraint problems and to use a constraint solver engine. The system provides results for a query by resolving the query using the

[0074] In the virtual network verification service 830, the network provided by the service 802 is The virtual networking semantics and logic for networking primitives are ,represented as a set of virtual networking rules according to a logic programming language; The virtual networking rules may be implemented in the virtual network 810. Rules that express common relationships and interactions between the various networking primitives used The virtual networking rules may include networking security criteria (e.g. PCI, FedRAMP, HIPPA, etc.) or a client's internal security Rules that encode service criteria or other networking requirements can also be incorporated.

[0075] The virtual network verification service 830 performs the following operations on the client's virtual network 810: The description information is, for example, Identify instances of networking primitives and provide descriptions of the various instances (e.g. For example, the role assigned to an instance, the role granted or granted to an instance, The instance ID, permissions that are not granted, and the IP address assigned to the instance. Describes relationships between instances (e.g. paths between instances) and external entities8 90. Therefore, the client obtains description information from the virtual network 810 and can be provided to the virtual network validation service 830. Therefore, the client can check whether the virtual network verification service 830 is valid for the virtual network 8 Permission to obtain descriptive information directly from 10, virtual network verification The virtual network verification service 830 can provide a declarative Descriptive information can be encoded as a logic program according to a logic programming language. do.

[0076] The virtual network verification service 830 uses a declarative logic programming language to The client is connected to a client's virtual network 810 on a provider network 800. You can send queries about, for example, through a graphical or command line interface. Through the Command Line Interface (CLI), 8. The service 830 is presented on a client device 882 in a client network 880. Logic programming may be used in some embodiments. An example language is Datalog. Other declarative logic programming languages ​​may also be used. Note that in some embodiments, the query may be somewhat similar to SQL. may be expressed in an expressive query language that is applied to network configurations, or In some embodiments, the query may be presented in a human-friendly form. Theorem on logic programs is expressed as a constraint problem. The service 830 uses a constraint solver engine to solve the encoded It can solve the constraint problem represented by a query on the given description, and the result is In some embodiments, the virtual network verification service 830 provides , an API and interface for submitting queries may be provided. In some embodiments, the virtual network verification service 830 may include a client using an API and It is possible to provide a set of standard queries that can be selected through the interface. In some embodiments, the virtual network verification service 830 may Allows you to create and submit custom queries via PI and interfaces obtain.

[0077] The following is a summary of the virtual network example shown in Figure 8. This article describes example queries that may be obtained, and the example queries are not intended to be limiting. isn't it.

[0078] In some embodiments of the virtual network 810, resources on the virtual network 810 The client receives SSH access from a designated endpoint on the client network 880. It should only be accessible via SSH through access instance 812. Therefore, the client can access any instance in the virtual network 810 from the intermediate network. Verify that the endpoint is not accessible via SSH from any endpoint on network 850. An example query to verify this can be expressed as follows: All instances: !internet-can-ssh-to-instance(Instance )

[0079] The client also communicates with the virtual network 810 from the client network 880. Verify that the SSH access instance 812 on is accessible via SSH As mentioned above, in some embodiments, You can assign specific roles to at least some of the instances of this client. In this case, the role may be indicated by a tag that is stored in the metadata for the instance. The tag may be included in the description information, thereby forming an encoded Thus, in some embodiments, tags may be used to, for example, assign a particular role. To verify that the assigned instances can actually fulfill those roles, From the client network 880, SSH Access Instance 812 on 810 is accessible via SSH An example query to verify may be expressed as follows: All instances: atom / instance-tag(Instance, tag-key / Nam e, tag-value / SSHAccessInstance) <=>ClientNetwork-can-ssh-to-instance(I instance

[0080] The above equation, when evaluated by the constraint solver, gives all Check for instances tagged as SSHAccessInstance For an instance, the constraint solver checks whether the instance is part of the client network. Determines whether 880 is reachable via SSH and returns TRUE if so. otherwise it returns FALSE.

[0081] In the following, a client submits an appropriate query to the virtual network validation service 830. Some other examples of aspects of the virtual network 810 that can be verified by These are listed but are not intended to be limiting. ●SSH access instance 8 from client network 880 via SSH Only 12 are accessible. Resource instances 818A and 818B are connected to an intermediate network 850B (e.g. Each HTTPS access is provided by an external entity 890 via The WAN 200 is reachable through process instances 814A and 814B. Resource instances 818A and 818B communicate with the intermediate network to authenticate the request. Workpiece 850B can be reached. Resource instances 818A and 818B are the designated service instances 816 can be written to. The designated service instance 816 is accessed via the HTTPS access instance 814C. 8. The IP address can be reached from the client network 880 via the IP address. The designated service instance 816 is a designated endpoint on the virtual network 810. It is possible to reach the target. ● Every instance is tagged with one of a specified set of tags.

[0082] FIG. 9 illustrates components of an example virtual network validation service, according to some embodiments. The virtual network verification service 930 performs the following operations: In some embodiments, the method may be implemented by one or more computing devices. For example, an instance of the virtual network verification service 930 may be configured as shown in FIG. SSH access instance 812 is used to access the virtual network of the client. As shown in FIG. 9, in some embodiments, a virtual network verification service may be implemented. The service 930 includes a service engine 934, a constraint solver 936 engine, and an API 932. The service engine 934 may include, but is not limited to, rule codes: Implements the coding 950 logic, the query processing 960 logic, and the description coding 970 logic. The constraint solver 936 may be based on encoded virtual networking rules 938. 9, a recursive analysis of the virtual network as represented by the coded description 940 is performed. A declarative logic programming language engine configured to resolve queries that include the query The API 932 may correspond to an external entity, including but not limited to a client. The service 910 exposes the functionality of the service 910 to the service.

[0083] In FIG. 9(1A) and (1B), the rule encoding 950 logic of the service 930 The network obtains virtual networking rules 938 to be applied to the virtual network (1 The rules to be encoded are provided by the service provider. The information may be obtained from the source, from the client, or from other external entities or sources. Example encoded rules 938 are presented later in this specification.

[0084] In an embodiment, for the networking primitives used in the virtual network, The virtual networking semantics and logic for this are governed by a logical programming language. The virtual networking rules 938 may be obtained and encoded as a set of virtual networking rules 938. The networking rules 938 may be implemented in the virtual network and in the provider network. Various networking primitives provided by the network services and APIs The system may include rules that express common relationships and interactions between the processes. Describes the logic of how virtual networking works in a provider network environment. You can have the virtual networking rules 938 described below in one location or file. Cut.

[0085] In some embodiments, the virtual network validation service 930 is a payment card industry PCI DSS, US Federal Risk and Authorization Management Program (FedRAMP) standards, or the Health Insurance Portability and Accountability Act (HIP Obtain and code rules for network security standards such as the PA standard This allows the creation of rules for validating networking security standards. In some embodiments, a set of virtual networking rules 938 may be implemented that includes: The virtual network validation service 930 verifies that the client's virtual network conforms to a particular standard. Various Virtual networking rules, each of which encodes various networking security criteria. In some embodiments, two or more different sets of rules 938 may be provided. The Virtual Network Verification Service 930 is responsible for verifying the internal security standards, best practices, and You can write custom rules to encode your Ractis or other networking requirements to the client. It is possible to allow clients to define their own specific virtual networks. Virtual network, including custom rules defined by the client to apply to the network. A set of working rules 938 may be implemented.

[0086] In FIG. 9(2), the query processing 960 logic of the service 930 is The client sends queries to be resolved about the virtual network according to query rule 938. In some embodiments, the client may receive the graphical Through the interface or command line interface (CLI), Query the client's virtual network on the datacenter network using the service API In some embodiments, the query may be provided to 932. may be presented in expressive language that is applied to the network configuration. In this case, the query may be presented in a human-friendly form. Example queries are described above in conjunction with FIG. It is explained.

[0087] In (3A) and (3B) of FIG. 9, description encoding 970 logic for service 930 A description of the virtual network can be obtained (3A) and encoded (3B). In some embodiments, the description encoding 970 logic of the service 930 may include 3A, for each query received by the description encoding 970 logic, Encoding the descriptive information as an encoded description 940 (3B) and using the encoded description 940 when resolving the query. In some embodiments, however, the description 940 may be updated. The encoding logic obtains, encodes, and encodes descriptive information about the virtual network. The resulting description 940 can be used to process more than one query. In the embodiment, the description encoding 970 logic of the service 930 is The description information is obtained by, for example, Identify instances of networking primitives that are available and provide descriptions of the various instances ( For example, the role assigned to an instance, the role given or granted to an instance The instance ID, the permissions that are not granted, the IP address that is assigned to the instance, and so on. Describes relationships between instances (e.g. paths between instances) and external entities In some embodiments, the interface or access point to the network can be described. Therefore, the client obtains description information from the virtual network and stores the description information in the virtual Alternatively, in some embodiments, the information may be provided to a network verification service. The client receives a response from the virtual network verification service 930 to verify the virtual network. The Virtual Network Verification Service provides a version that allows descriptive information to be obtained directly from the network. In FIG. 9B, a description encoding of the service 930 is provided. 970Logic converts the descriptive information obtained into a logical program according to a declarative logic programming language. The data can be encoded as a program.

[0088] In FIG. 9(4), the query processing 960 logic of the service 930 constrains the query The constraint solver 936 can provide the encoded rules 938 to the constraint solver 936. solving the constraint problem represented by a query on the encoded description 940 according to In (5A), the results (e.g., answers to the questions posed by the queries) are collected as and (5B) providing the formatted result to a query process 960 which formats the result. The results are provided to the client via API932. The formatted results are Character format result (for example, "YES", "NO", "TRUE", or "FALSE" A text that represents the answer to the constraints posed by the query a list of instances that satisfy the given constraints), and / or graphical results (e.g. A graph of relationships between two or more instances determined by resolving a query. kal expression, the virtual network specific instance identified by resolving the query The information may include a graphical representation of the

[0089] FIG. 10 illustrates a method for providing information about a virtual network in accordance with some embodiments. 1 is a flowchart of a method for providing a network client. As shown, the virtual networking rules can be obtained and encoded. The rules can be generated by the service provider, by the client, or by other external entities. Virtual networking rules can be obtained from the provider network or from a source. Virtual Network for networking primitives used in virtual networks on the network In some embodiments, the virtual network can express working semantics and logic. The Networking Rule is a Payment Card Industry Data Security Standard (PCI DS S), Federal Risk and Authorization Management Program (FedPAMP) standards, or health insurance Networking security requirements such as the Insurance Portability and Accountability Act (HIPAA) In some embodiments, virtual networking rules may represent rules for security criteria. represents the client's internal security standards or other networking requirements. The rules may include ant definition rules. Example encoded rules are provided later in this specification. .

[0090] As shown in 1010, the virtual network verification service network reachability analyzer, etc.) about the virtual network. In an embodiment, a graphical interface to the service on a console is provided. or via the command line interface (CLI) Use the virtual network validation service to verify the virtual network for clients on the provider network. For questions about virtual networks (posed as queries, including recursive queries), In some embodiments, the query is similar to SQL but uses a network-based query. Alternatively, in some embodiments, the network configuration may be expressed in an expressive language. The query may be presented in a human-friendly form. An example query is described above in connection with FIG. It has been done.

[0091] As shown in 1020, the virtual network verification service The description information can be obtained and encoded for each virtual network. Identify instances of networking primitives implemented in the network and Description of the service (e.g., roles assigned to a compute instance, Permissions granted or not granted, IP addresses assigned to instances It contains the names of instances (e.g., addresses) and describes the relationships between instances (e.g., paths between instances). and that it cannot be accessed by external entities (e.g. entities outside the virtual network). Describes the interface or access point to a compute instance that can be accessed by a In some embodiments, the client may receive descriptive information from the virtual network. and provide that description to a virtual network validation service. In some embodiments, the client may include a virtual network verification service that verifies the virtual network. The permissions that allow descriptive information to be obtained directly from the network are The virtual network verification service can be provided to a declarative logic program. Descriptive information is encoded as a logic program according to a programming language (e.g., Datalog). It can be made into

[0092] As shown in 1030, the virtual network verification service may include a declarative logic programming A constraint solver engine is used to solve the coded virtual According to the networking rules, queries against the encoded descriptions may be resolved. As shown in FIG. 40, the results of the query resolution (e.g., the answer to the question posed by the query) The formatted result (the answer to the question) can then be formatted and provided to the client. Returns a character result (for example, "YES", "NO", "TRUE", or "FALSE"). ", text that represents the answer to the constraints posed by the query, a list of instances that satisfy the stated constraints), and / or a graphical result ( For example, a graph of the relationships between two or more instances determined by resolving a query. A graphical representation of the virtual network specific instances identified by resolving the query. The information may include a graphical representation of a chest of drawers, etc.

[0093] As shown by the arrow from element 1040 back to element 1010, elements 1010-1 040 to provide multiple queries about the client's virtual network. In some embodiments, for example, a client may present and resolve a series of queries. Write a script that contains the fields and then run the script to query the virtual network. The authentication service can then be used to provide the authentication result to the authentication service and receive the result from the authentication service. As shown in Figure 10, In some embodiments, the virtual network validation service includes: The virtual network verification service obtains the description information and assigns the description information to each query it receives. The method encodes the description as a encrypted description to ensure that the description is up-to-date when resolving queries. However, in some embodiments, the virtual network verification service may Take the description of the virtual network, encode it, and use the encoded description to More than one query can be processed.

[0094] FIG. 11 illustrates an example of a client sending descriptive information and queries to a virtual network in accordance with some embodiments. The virtual network is provided to the network verification service by the client of the provider network. 11 is a flowchart of a method for providing information about a network. To achieve this, a client (such as a network reachability analyzer) can, for example, Using the DESCRIBE call provided by the IDER Network Services API , obtain description information from the virtual network. As shown in 1110, the client Query and description information to the virtual network verification service. The validation service encodes descriptive information about the virtual network, such as: As shown in Fig. 1, the verification service uses a constraint solver engine to Resolve queries against the encoded descriptions according to the network rules. As shown, the virtual network validation service returns the results of the query resolution to the client. provide.

[0095] FIG. 12 illustrates a method for a client to retrieve descriptive information and a virtual network according to some embodiments. Provide the Virtual Network Verification Service with permission to access the network. A method for providing information about virtual networks to clients of a provider network 12 is a flowchart of the method. As shown in 1200, the client (network arrival Reachability Analyzers, etc., allow services to obtain descriptive information from virtual networks. The permissions that enable it, e.g., maintaining the metadata that describes the virtual network. Use a DESCRIBE call to one or more provider network services to The virtual network validation service grants permission to obtain information about virtual networks. As shown in 1210, the client provides the virtual network verification service. As shown in 1220, the virtual network verification service However, for example, one or more provider networks may maintain metadata that describes the virtual network. Describe the virtual network using a DESCRIBE call to the Network service. As shown in 1230, the virtual network verification service obtains information about the virtual network. As shown in 1240, the virtual network verification sub-system 1220 encodes descriptive information about the virtual network verification sub-system 1220. The service uses a constraint solver engine to solve the problem of solving problems against the encoded description according to the rules. As shown in 1250, the virtual network validation service resolves the query. Provide the client with the results of the resolution.

[0096] FIG. 13 illustrates a network that includes two or more peered virtual networks, according to some embodiments. 1 illustrates a virtual network implementation of a client in a provider network environment. 13 is used in the virtual network verification service 1330 described herein. The following is provided to partially illustrate example virtual networking rules that may be used. The virtual network implementation of the client on the provider network 1300 is The implementation 1310 may include two or more virtual networks 1320. Two virtual networks 1320A in Ant's virtual network implementation 1310 In some embodiments, virtual networks 1320A and 1320B are shown. 20B may each include one or more subnets, and the security group may include a virtual network. The network endpoints 1320A and 1320B may be established in the networks 1320A and 1320B. 22A and 1322B are connected to the respective virtual networks 1320A and 1320B. Various instances of networking primitives in a network (e.g., resource instances) The virtual networks 1320A and 13 20B instances need to traverse external networks 1350 such as the Internet. 1300. A peering connection 1324 is provided between virtual networks 1320A and 1320B. It may be established across the network 1300.

[0097] Examples of "Private Routing" rules are shown below. These examples are non-exclusive. "Routing" as used in these examples refers to IP packets flow from one endpoint to another without walls This means that two ends in the virtual network implementation 1310 can Point-to-point routing is sometimes called "private routing". In a virtual network implementation 1310, both endpoints are in the same virtual network. Depending on whether the virtual network 1320 is in the same virtual network 1320 or in a different virtual network 1320, this In the following, the packet transfer rate is calculated based on the virtual network implementation 1310. A descriptive logic program to determine whether a packet can flow between two endpoints. Describe example rules that follow the programming language. routable-private:endpoint->endpoint->ty p.e. -:routable-private Endpoint1 Endpoint2 <-routable-private-one-way Endpoint1 E Index2 <-routable-private-one-way Endpoint2 E ndpoint1

[0098] The first line defines the type of endpoint: Endpoint1 and Endp oint2 is a variable. (routable-private-one-way E Endpoint1 Endpoint2) and (routable-private- one-way Endpoint2 Endpoint1) are both true, Routeable-private Endpoint1 and Endpoint2 are , evaluates to true (otherwise it is false). For routing between, the rule routable-private-one-way It can be defined as follows: routable-private-one-way:endpoint->endp oint ->type -:routable-private-one-way Endpoint1 En dpoint2 <-endpoint-has-virtual-network Endpoint t1 Vnetwork <-endpoint-has-virtual-network Endpoint t2 Vnetwork

[0099] Endpoint1 and Endpoint2 are variables. Vnetwork is The same variables (i.e., they represent the same virtual network 1320). Both Endpoint1 and Endpoint2 are in the same virtual network 1320. Evaluates to true if it is (false otherwise).

[0100] Endpoints in various virtual networks 1320 through peering connections 1324 For routing between 2022 and 2023, the rule routable-private-one- A way can be defined as follows: Text that begins with " / / " is a comment. -:routable-private-one-way Endpoint1 En dpoint2 / / Check the endpoint IP <-endpoint-has-private-ip Endpoint1 Ip 1 <-endpoint-has-private-ip Endpoint1 Ip 2 / / Check the virtual network of the endpoint <-endpoint-has-virtual-network Endpoint t1 Vnetwork1 <-endpoint-has-virtual-network Endpoint t2 Vnetwork2 / / Check the peering CIDR (Classless Inter-Domain Routing) <-peered-cidrs Pcx Vnetwork1 Cidr1 Vne twork2 Cidr2 / / Check the route table for the source endpoint <-endpoint-has-rtb Endpoint1 Rtb1 / / Check the CIDR of the route in the table and see if the route is valid <-atom / pcx-route Rtb1 Pcx Cidr3 route- state / active / / Make sure all three CIDRs match their respective IPs <-cidr-matches-private-ip Cidr1 Ip1 <-cidr-matches-private-ip Cidr2 Ip2 <-cidr-matches-private-ip Cidr3 Ip2

[0101] FIG. 14 illustrates a virtual network on a provider network, according to some embodiments. Here are the subnets and security groups in the example. As mentioned above, the network Reachability analyzer will close ports, including making changes to security groups. and / or recommend and / or take corrective action to remove the port and / or make the port unreachable In some embodiments, the provider network may provide a 14, within the client's virtual network 1410, within the subnetwork 1414, or within the 1414, allowing the establishment and management of virtual security groups 1416. In one embodiment, the security group 1416 can be A logical grouping of 1418 services that are managed by security groups according to security group rules. The resource group 1416 may be configured to reach one or more resource instances 1418 in the resource group 1416. It acts as a virtual firewall that controls the traffic allowed. Establish one or more security groups 1416 within the virtual network 1410, Each resource instance 1418 in the virtual network 1410 is assigned to security group 1 416. In some embodiments, the client reaches a resource instance 1418 associated with a security group 1416. Each security group controls the inbound traffic allowed to reach Rules for 16 may be established and / or amended.

[0102] In the example virtual network 1410 shown in FIG. 14, the virtual network 1410 includes: The virtual network 1410 is divided into two subnets 1414A and 1414B. Access to the subnetworks is controlled by a gateway 1430. Traffic to and from resource instances 1418 on each subnet 1414 The system may include at least one router 1412 that serves to route traffic. In this case, a network access control list (ACL) is used to restrict access to the router 1412. In the example shown in FIG. 14, Resource instances 1418A-1418E are on subnet 1414A, and Client instances 1418F-1418J are on subnet 1414B. The system establishes four security groups 1416A to 1416D. The security group is configured to allow resource instances on subnet 1414A to 1418A and 1418B and resource instance 1418 on subnet 1414B F and security group 1416A are included in subnet 1414. The resource instance 1418 may extend across security groups 1418 and 1418. As is the case for resource instance 1418A contained in 416A and 1416B. In addition, a security group 1416 may be included in more than one security group.

[0103] Exemplary Computer System In at least some embodiments, one or more of the techniques described herein may be A computer system in which the present invention is implemented or may be implemented includes one or more computer readable media. or a computer system configured to access it. 15 illustrates such a computing device 1500. In the illustrated embodiment, The computing device 1500 includes an input / output (I / O) interface 15 One or more processors 1510A-1 coupled to a system memory 1520 via The computing device 1500 includes an I / O interface 15 30 further includes a network interface 1540 coupled thereto.

[0104] In various embodiments, the computing device 1500 includes one processor. A single processor system including several processors 1510A to 1510N ( For example, a multiprocessor system may include 2, 4, 8, or another suitable number of The processors 1510A-1510N may be any suitable processor capable of executing instructions. For example, in various embodiments, processors 1510A-1510B may include 0N supports a variety of ISAs, including x86, PowerPC, SPARC, or MIPS. Instruction Set Architecture (ISA) It may be a processor implementing either the Intel ISA or any other ISA. In a multiprocessor system, each of the processors 1510A to 1510N communicates Although it is possible for multiple programs to implement the same ISA, this is not always the case.

[0105] System memory 1520 is accessible by processors 1510A-1510N. In various embodiments, the memory device may be configured to store various program instructions and data. The system memory 1520 is a static random access memory (SRAM). tic Random Access Memory), Synchronous Dynamic RA M (SDRAM: Synchronous Dynamic RAM), non-volatile / fla Any suitable memory technology, such as flash memory, or any other type of memory. In the illustrated embodiment, these methods, techniques, and data Program instructions and data that implement one or more desired functions, such as program data, are called code ( That is, the system memory 152 as program instructions 1525 and data 1526 In the illustrated embodiment, the system memory 1520 is shown stored in Program code and methods for implementing aspects of the network security assessment device 100 described herein. It also stores the data.

[0106] In one embodiment, the I / O interface 1530 is 10N, a system memory 1520, a network interface 1540 or other I / O traffic between any peripheral device in the device that contains the peripheral interface In some embodiments, the I / O interface 1 may be configured to adjust the 530 transmits data signals from one component (e.g., system memory 1520) to another component. A format suitable for use by a component (e.g., processors 1510A-1510N) performs any protocol, timing, or other data conversion necessary to convert In some embodiments, the I / O interface 1530 may include, for example, Peripheral Component Interconnect (PCI) terconnect) bus standard or Universal Serial Bus (USB:Universal Serial Serial Bus (SMA) and other types of peripheral buses. In some embodiments, the I / O interface may include support for The 1530's functions consist of two or more separate bridges, such as a north bridge and a south bridge. In some embodiments, the system memory 1520 may be divided into various components. Some or all of the functionality of the I / O interface 1530, such as the It may be directly incorporated into the processors 1510A to 1510N.

[0107] The network interface 1540 is connected to the computing device 1500. 15. The network 1550 may include a network for transmitting data to and from other devices 1560 attached to the network 1550. In various embodiments, the network may be configured to allow the The network interface 1540 may be any suitable network interface, for example an Ethernet network type. The present invention can accommodate communication over any common data network, whether wired or wireless. Additionally, the network interface 1540 may be connected to an analog voice network or Telecommunications / telephone networks such as digital fiber communications networks, fiber channel a storage area network, such as a distributed SAN, or any other suitable type of network The system may support communication via a network and / or protocol.

[0108] In some embodiments, the system memory 1520 may include a corresponding method and apparatus embodiment. configured to store program instructions and data as described above for implementing the The present invention may be an embodiment of a computer-readable (i.e., computer-accessible) medium. For example, the system memory 1520 may store information related to the network security evaluation device 100. In some embodiments, the program code and data associated with the program may be stored in the The program instructions and / or data may be received on various types of computer readable media. Generally speaking, a computer-readable medium may be any medium that is capable of being read, transmitted, or stored. A magnetic field coupled to the computing device 1500 via an interface 1530 Non-transitory storage media such as electrical or optical media, e.g. disks or DVD / CDs Non-transitory computer readable storage media may include the system memory 1520 or In some embodiments of the computing device 1500, the memory may be a RAM (e.g., SDRAM, DDR SDRAM, RDRAM, SR The present invention may also include any volatile or non-volatile medium, such as a programmable read only memory (RAM), a read only read only memory (ROM), etc. The computer readable medium may be a transmission medium or a computer readable medium that may be transmitted through the network interface 1540. via a communications medium such as a network and / or wireless links, such as may be implemented in a The transmitted signal may include an electrical signal, an electromagnetic signal, or a digital signal. Using some or all of multiple computing devices such as those shown in Various embodiments may implement the described functionality, for example in a variety of different ways. Software components running on devices and servers work together to provide functionality In some embodiments, some of the described functionality may be implemented in a storage device, a network, The present disclosure may be implemented using a variety of computer devices or computer systems. As used in this document, "computing device" means The term "Devices" refers to at least all of these types of devices, but The present invention is not limited to any particular type of device.

[0109] The various methods illustrated in the drawings and described herein represent example embodiments of the methods. The method may be implemented in software, hardware, or a combination thereof. The order of steps can be changed in a variety of ways, and various elements can be added, rearranged, or combined. Various steps of the steps can be automated (e.g. without being prompted directly by user input) and / or programmatically (e.g. For example, according to program instructions.

[0110] Embodiments of the present disclosure may be described by the following clauses. 1. A system comprising: One or more computers configured to implement a network security assessment device a network security evaluation device, For the network that contains the host computer, one or more pieces of network configuration data generating a query on the one or more queries, wherein the one or more queries are expressed in a query language; One or more queries are generated based, at least in part, on a set of rules. And, The host computer is open and reachable from outside the network. determining one or more ports in the data set, said one or more ports being determining, the determination being based at least in part on results of the one or more queries; determining one or more processes that are listening on said one or more ports. The one or more processes are executed by an agent installed on the host computer. determining whether the marker is a positive or negative marker, Generate a report describing the one or more ports and the one or more processes. and a system configured to: 2. The network security evaluation device, determining one or more routes from outside the network to the one or more ports; and reporting. 3. The network security assessor: The one or more ports are open and reachable from outside the network. and further configured to determine and report one or more configuration settings. 3. A system according to any one of clauses 1 or 2. 4. The network security evaluation device, If so, one or more of the ports may be closed or one of the ports may be closed. determine one or more corrective actions to render one or more of the 4. The system of any one of clauses 1 to 3, further configured to report. 5. A computer-implemented method performed by one or more computing devices There was, Providing network configuration data for a network including a computing device To carry out the analysis and A computing device that is reachable from another computing device determining one or more ports in said one or more ports that are at least partially affected by said analysis; determining whether the determination is based at least in part on the determining one or more routes to the one or more ports, determining, wherein a route is determined based at least in part on the analysis; generating a report describing said one or more ports and said one or more routes; , a computer-implemented method comprising: 6. determining and reporting one or more processes that are listening on said one or more ports; and wherein the one or more processes are installed on the computing device. 5, further including that the determination is made using agent software installed in the The method described. 7. determining one or more configuration settings that cause the one or more ports to be reachable; and 7. The method of any one of clauses 5 or 6, further comprising reporting. 8. If so, one or more corrective actions are taken that render one or more of said ports unreachable. 8. The method of any one of clauses 5 to 7, further comprising determining and reporting. 9. a user interface that, when selected, displays at least one of the corrective actions; and displaying one or more interface elements that cause the The method described in clause 8. 10. The analysis is at least in part based on one or more queries of the network configuration data. the one or more queries are based on a query language, Any of clauses 5 to 9, in which the class is generated at least in part based on a set of rules. The method according to any one of claims 1 to 5. 11. The one or more ports are determined without sending a packet to the one or more ports. 11. The method according to any one of clauses 5 to 10, 12. transmitting one or more packets from an additional computing device to the one or more ports; and verifying that the one or more ports are reachable by sending 12. The method according to any one of clauses 5 to 11, comprising: 13. A computer-readable storage medium storing program instructions, the program The command, Performs analysis of network configuration data for a network that contains a host computer. And, A host computer that is open and reachable from another computer. determining one or more ports that are determining, based in part on results of the analysis; determining one or more processes listening on said one or more ports; The one or more processes are executed by an agent installed on the host computer. The method is performed using a method for determining whether or not a generating a report describing said one or more ports and said one or more processes; and a computer-readable storage medium that is computer-executable to perform the steps of: 14. The program instructions: determining and reporting one or more processes that are listening on said one or more ports; and wherein the one or more processes are executed by an agent installed on a host computer. The agent software is used to determine, determine and report on the 14. The computer-readable storage medium of claim 13, further comprising a computer executable program. 15. The program instructions: One or more configurations that ensure the one or more ports are open and reachable. determining and reporting the setting. 15. A computer-readable storage medium according to any one of claims 13 or 14. 16. The program instructions: If so, one or more of the ports may be closed or one of the ports may be closed. and to determine and report one or more corrective actions to render one or more of the 16. The computer program according to any one of clauses 13 to 15, further comprising a computer executable program. A computer-readable storage medium. 17. The program instructions: a user interface that, when selected, displays at least one of the corrective actions; and displaying one or more interface elements that cause the The method described in clause 16. 18. The analysis is at least in part based on one or more queries of the network configuration data. the one or more queries are based on a query language, Clauses 13 to 17, where the elimination is generated at least in part based on a set of rules. 2. A computer-readable storage medium according to any one of claims 1 to 11. 19. The previous The one or more ports of the computer according to any one of clauses 13 to 18 are determined. A data-readable storage medium. 20. Based at least in part on a whitelist of trusted locations, Then, one or more open and reachable ports are excluded from the report. 20. A computer-readable storage medium according to any one of clauses 13 to 19.

[0111] The terminology used in the description of the invention herein is intended to describe particular embodiments only. The present specification and the accompanying drawings are provided for illustrative purposes only and are not intended to limit the invention. As used in the claims, the singular forms "a," "an," and "the" are used where the context requires. Unless expressly indicated otherwise, the plural forms are intended to be included. When used, the term "and / or" refers to the associated listed items. It will also be understood to refer to and include any and all possible combinations of one or more As used herein, the terms "includes" and "include "comprises" and / or "compr ising) refers to the stated features, integers, steps, operations, elements, and / or configurations. Specifies the presence of an element but not one or more other features, integers, steps, operations, elements, or components. It is further understood that this does not preclude the existence or addition of It will be understood.

[0112] As used herein, the term "if" can be used interchangeably with "when" or "whenever," depending on the context. may be interpreted to mean "at" or "in response to determining" or "in response to detecting" Similarly, "when it is determined" or "when (a specified condition or event) is detected" " may be used to mean "in the determination" or "in response to the determination" or "( "Upon detection of a specified condition or event" or "Upon detection of a specified condition or event" "in response to an application for a waiver of a waiver" may be interpreted as meaning "in response to an application for a waiver of ...."

[0113] In this specification, terms such as first, second, etc. may be used to describe various elements. However, it should also be understood that these elements should not be limited by these terms. These terms are only used to distinguish one element from another. For example, However, the first contact may be referred to as the second contact without departing from the scope of the present invention. Similarly, the second contact can be referred to as the first contact. The first contact and the second contact are both contacts, but they are not the same contact.

[0114] Numerous specific details are set forth in this specification to provide a thorough understanding of the claimed subject matter. However, it is understood that claimed subject matter can be practiced without these specific details. In other examples, it will be appreciated by those skilled in the art that the claimed subject matter may be For the avoidance of doubt, any method, apparatus, or system believed to be known to those skilled in the art is As will be apparent to those skilled in the art having the benefit of this disclosure, various Modifications and changes may be made to this product. You agree to accept all such modifications and changes and therefore It is intended that the above description be viewed in an illustrative and not a limiting sense. do.

Claims

1. 1. A computer-implemented method executed by one or more computing devices, comprising: receiving a query for a virtual network from a client, the query requesting identification of ports of the virtual network that are reachable from outside the virtual network; obtaining descriptive information about the virtual network; encoding the descriptive information about the virtual network as an encoded description of the virtual network; resolving the query against the encoded description of the virtual network according to virtual network rules using a constraint solver engine; providing results of the resolution of the query to the client, the results including a report identifying: (a) one or more ports in a virtual network that are reachable from outside the virtual network and a respective host for said one or more ports; (b) one or more routes for reaching the one or more ports from outside the virtual network; (c) one or more configuration settings that allow the one or more ports to be reachable from outside the virtual network, the one or more configuration settings relating to security groups or access control lists (ACLs) that allow access; (d) one or more corrective actions that, if implemented, cause the one or more ports to be unreachable from outside the virtual network. A method comprising:

2. encoding the virtual network rules; resolving the query against the encoded description of the virtual network according to the virtual network rules using the constraint solver engine, The method of claim 1 , further comprising: resolving the query against the coded description of a virtual network according to the coded virtual network rules using the constraint solver engine.

3. the query for the virtual network received from the client is expressed in a declarative logic programming language; The step of encoding the descriptive information about the virtual network further comprises: encoding the descriptive information about the virtual network as a logic program in accordance with the declarative logic programming language; resolving the query against the encoded description of the virtual network according to the virtual network rules using the constraint solver engine, 2. The method of claim 1, further comprising: resolving the query against the encoded description of a virtual network according to the virtual network rules using the constraint solver engine of the declarative logic programming language.

4. providing an API to clients for creating and submitting custom queries; The step of receiving the query for the virtual network from the client comprises: The method of claim 1 , further comprising: receiving a custom query about the virtual network from the client via the provided API.

5. the virtual network rules comprising two or more different sets of virtual network rules, each encoding a different networking security criterion that is selectively used to verify that the virtual network complies with a respective networking security criterion; resolving the query against the encoded description of the virtual network according to the virtual network rules using the constraint solver engine, 2. The method of claim 1, further comprising: resolving the query against the encoded description of the virtual network according to at least one of the two or more different sets of virtual network rules with the constraint solver engine.

6. The descriptive information about the virtual network comprises:

2. The method of claim 1, wherein the virtual network is one or more of: identifying instances of networking primitives implemented in the virtual network; describing the instances; describing relationships between the instances; and describing interfaces or access points to external entities.

7. The step of obtaining descriptive information about the virtual network comprises: The method of claim 1 , further comprising the step of receiving the description information about the virtual network from the client.

8. The method of claim 1 , wherein the virtual network rules comprise networking security standards or custom rules defined by the client for application to the virtual network.

9. The method of claim 1 , wherein the query for the virtual network is posed in an expressive query language.

10. receiving from the client a permission that enables the network security assessment device to obtain the descriptive information about the virtual network from the virtual network; obtaining the description information about the virtual network from the virtual network according to the permissions received from the client; The method of claim 1 further comprising:

11. The method of claim 1 , wherein the virtual network rules comprise rules that express common relationships and interactions between various networking primitives implemented in the virtual network.

12. The method of claim 1 , wherein resolving the query further comprises determining one or more ports in the virtual computing device that are reachable from other computing devices in the virtual network.

13. The method of claim 12 , further comprising determining and reporting one or more routes to the one or more ports from outside the virtual network.

14. 14. The method of claim 13, further comprising determining and reporting one or more corrective actions to close the one or more ports or make the one or more ports unreachable from outside the network.

15. A system comprising a network security assessor implemented by one or more computing devices and configured to perform the method of any one of claims 1 to 14.

Images