Method for constructing infrastructure as code by using language model, and system therefor

Abstract

A method for constructing an infrastructure as code is provided. The method comprises: inputting security information about a target service into a language model; using information output from the language model, so as to generate a security policy corresponding to the security information; inputting the security policy into the language model; using information output from the language model, so as to acquire attribute information about the target service and a first code script corresponding to the security policy; inputting the attribute information and the first code script into the language model; using information output from the language model, so as to generate a second code script for constructing an infrastructure of the target service; and using the second code script so as to automatically construct the infrastructure for providing the target service.

Description

Method for building a code-type infrastructure using a language model and its system

[0001] The present disclosure relates to a method for constructing a code-type infrastructure using a language model and a system thereof.

[0002] Quantum vulnerability is one of the important issues to consider in computing systems that build infrastructure while taking data security into account in network environments.

[0003] As quantum computing technology develops, the need to transition encryption systems to post-quantum cryptography (PQC) systems to address quantum vulnerabilities is emerging.

[0004] When switching encryption systems, it is necessary to understand the encryption policy and encryption setting method for each application, as the encryption policy and encryption setting method may differ for each application.

[0005] However, for applications configured via Infrastructure as Code (IaC) scripts, it is difficult to determine whether the encryption policy defined in Policy as Code (PaC) is applied to the application. Furthermore, if the encryption policy defined in PaC is not applied to the application, it is difficult to identify the encryption policy and encryption settings. For example, the encryption policy may be hard-coded within the IaC script.

[0006] Therefore, in building IaC, a new method is required to centrally manage encryption policies for the transition of encryption systems.

[0007] The technical problem to be solved through the embodiments of the present disclosure is to provide a method for automatically constructing an infrastructure for providing a target service through automated linking of information and a computing system for performing the method.

[0008] Another technical problem to be solved through embodiments of the present disclosure is to provide a method for centrally managing a security policy and a computing system for performing the method.

[0009] Another technical problem to be solved through the embodiments of the present disclosure is to provide a method for constructing infrastructure as code (IaC) that reflects policy as code (PaC) using a language model, and a computing system for performing the method.

[0010] The technical problems to be solved by the present disclosure are not limited to the technical problems mentioned above, and other technical problems not mentioned can be clearly understood by a person having ordinary skill in the art related to the present disclosure based on the detailed description below.

[0011] According to an embodiment of the present disclosure, a method is provided, which is performed by a computing system that provides a code-based construction service for an infrastructure for servicing a target service. The method may include the steps of: obtaining security information for the target service; inputting the security information into a language model and generating a security policy corresponding to the security information using information output from the language model; inputting the security policy into the language model and generating attribute information for the target service using information output from the language model; inputting the security policy into the language model and obtaining a first code script corresponding to the security policy using information output from the language model; inputting the attribute information and the first code script into the language model and generating a second code script for constructing the infrastructure for the target service using information output from the language model; and automatically constructing the infrastructure for servicing the target service using the second code script.

[0012] In one embodiment of the present disclosure, the step of obtaining security information for the target service may include the step of inputting a query for the target service into the language model and generating the security information using information output from the language model.

[0013] In one embodiment of the present disclosure, the step of inputting the security policy into the language model and obtaining the first code script corresponding to the security policy using information output from the language model may include the step of inputting the security policy into the language model and determining whether the security policy is included in a first repository using information output from the language model, and if the security policy is not included in the first repository, the step of inputting the security policy into the language model and generating the first code script using information output from the language model.

[0014] In one embodiment of the present disclosure, the first code script may include a comment section including the security policy and a code section including code corresponding to the security policy.

[0015] In one embodiment of the present disclosure, the target service may be an open service currently in service.

[0016] In one embodiment of the present disclosure, the step of automatically constructing the infrastructure for servicing the target service using the second code script may include the step of inputting the second code script into the language model and outputting reference information for the first code script included in the second code script, and the step of setting the security policy for the target service using the first code script based on the reference information.

[0017] In one embodiment of the present disclosure, the method may further include a step of modifying the second code script in response to a user input including a request for modification to the second code script.

[0018] According to another embodiment of the present disclosure, a system for building a code-type infrastructure is provided. The system may include at least one processor and at least one memory storing instructions that, when executed by the at least one processor, cause the at least one processor to perform operations, wherein the operations may include: obtaining security information for a target service; inputting the security information into a language model and generating a security policy corresponding to the security information using information output from the language model; inputting the security policy into the language model and generating attribute information for the target service using information output from the language model; inputting the security policy into the language model and obtaining a first code script corresponding to the security policy using information output from the language model; inputting the attribute information and the first code script into the language model and generating a second code script for constructing the infrastructure of the target service using information output from the language model; and automatically constructing the infrastructure for servicing the target service using the second code script.

[0019] In one embodiment of the present disclosure, the operation of obtaining security information for the target service may include an operation of inputting a query for the target service into the language model and generating the security information using information output from the language model.

[0020] In one embodiment of the present disclosure, the operation of inputting the security policy into the language model and obtaining the first code script corresponding to the security policy using information output from the language model may include the operation of inputting the security policy into the language model and determining whether the security policy is included in a first repository using information output from the language model, and if the security policy is not included in the first repository, the operation of inputting the security policy into the language model and generating the first code script using information output from the language model.

[0021] In one embodiment of the present disclosure, the operation of automatically constructing the infrastructure for servicing the target service using the second code script may include an operation of inputting the second code script into the language model and outputting reference information for the first code script included in the second code script, and an operation of setting the security policy for the target service using the first code script based on the reference information.

[0022] According to another embodiment of the present disclosure, a computer program is provided, stored in a computer-readable recording medium, for executing a step of obtaining security information for a target service, a step of inputting the security information into a language model and generating a security policy corresponding to the security information using information output from the language model, a step of inputting the security policy into the language model and generating attribute information for the target service using information output from the language model, a step of inputting the security policy into the language model and obtaining a first code script corresponding to the security policy using information output from the language model, a step of inputting the attribute information and the first code script into the language model and generating a second code script for constructing the infrastructure of the target service using information output from the language model, and a step of automatically constructing the infrastructure for servicing the target service using the second code script, in combination with a computing device.

[0023] In one embodiment of a computer program according to the present disclosure, the step of obtaining security information for the target service may include the step of inputting a query for the target service into the language model and generating the security information using information output from the language model.

[0024] In one embodiment related to a computer program according to the present disclosure, the step of inputting the security policy into the language model and obtaining the first code script corresponding to the security policy using information output from the language model may include the step of inputting the security policy into the language model and determining whether the security policy is included in a first repository using information output from the language model, and if the security policy is not included in the first repository, the step of inputting the security policy into the language model and generating the first code script using information output from the language model.

[0025] In one embodiment related to a computer program according to the present disclosure, the step of automatically constructing the infrastructure for servicing the target service using the second code script may include the step of inputting the second code script into the language model and outputting reference information for the first code script included in the second code script, and the step of setting the security policy for the target service using the first code script based on the reference information.

[0026] The above-described problem solving means are only some of the examples of the present disclosure, and various examples reflecting the technical features of the present disclosure can be clearly understood by a person having ordinary skill in the art related to the present disclosure based on the detailed description below.

[0027] FIG. 1 is a schematic diagram illustrating an example of a service system according to one embodiment of the present disclosure.

[0028] FIG. 2 is a flowchart illustrating the operation of a code-type infrastructure construction system according to one embodiment of the present disclosure.

[0029] FIG. 3 is a flowchart illustrating a process of constructing a code-type infrastructure reflecting a code-type policy according to some embodiments of the present disclosure.

[0030] FIG. 4 is a flowchart illustrating an example of a method for constructing a code-type infrastructure according to one embodiment of the present disclosure.

[0031] FIG. 5 is a flowchart illustrating a specific example of a code-type infrastructure script generation process according to some embodiments of the present disclosure.

[0032] FIG. 6 is a flowchart illustrating an example of the overall operation of a code-type infrastructure construction system according to some embodiments of the present disclosure.

[0033] FIG. 7 is a block diagram illustrating an example of a computing device for performing some embodiments of the present disclosure.

[0034] Hereinafter, preferred embodiments of the present disclosure will be described in detail with reference to the attached drawings. The advantages and features of the present disclosure, and methods for achieving them, will become clearer with reference to the embodiments described in detail below together with the attached drawings. However, the present disclosure is not limited to the embodiments described below and may be implemented in various different forms. These embodiments are provided only to ensure that the present disclosure is complete and to fully inform those skilled in the art of the present disclosure of the scope of the invention, and the embodiments of the present disclosure are defined only by the scope of the claims.

[0035] To avoid ambiguity in the concepts of this disclosure, the known components may be omitted or illustrated in block diagram form focusing on the core functions of each component. Throughout this disclosure, identical components are described using the same reference numerals, even if they appear on different drawings.

[0036] Unless otherwise defined, all terms (including technical and scientific terms) used herein may be used in the same sense as commonly understood by those of ordinary skill in the art to which this disclosure pertains. Furthermore, terms defined in commonly used dictionaries are not to be interpreted ideally or excessively unless explicitly and specifically defined otherwise. The terminology used herein is for the purpose of describing embodiments and is not intended to limit the present invention. In this disclosure, singular forms also include plural forms, unless specifically stated otherwise.

[0037] In addition, the terminology used in this disclosure is only used to describe specific embodiments, and is not intended to limit the features, components, order, etc. described in the specification. The terms "comprises" and / or "comprising" used in this disclosure express the presence of features, components, steps, operations, and / or combinations thereof described in the specification, but do not exclude the presence or addition of one or more other features, components, steps, operations, and / or combinations thereof.

[0038] Additionally, terms such as first, second, A, B, (a), (b), etc. used in the following embodiments are only used to distinguish certain components from other components, and the nature, order, or sequence of the components are not limited by the terms. For example, without departing from the scope of the present disclosure, the first component may be referred to as the second component, and similarly, the second component may be referred to as the first component.

[0039] Additionally, in this disclosure, " / " and "," should be interpreted as indicating "and / or". For example, "A / B" and "A, B" may mean "A and / or B".

[0040] FIG. 1 is a schematic diagram illustrating an example of a service system according to one embodiment of the present disclosure.

[0041] The service system of FIG. 1 may provide a framework for servicing a target service according to embodiments of the present disclosure. For example, the service system may provide a code-based construction service for infrastructure for servicing a target service according to some embodiments of the present disclosure.

[0042] Referring to FIG. 1, the service system may include a user device (100), a code-type infrastructure construction system (200), and / or a database (300).

[0043] The user device (100) may include various devices that a user uses to communicate and transmit and receive various data and / or information with other devices. The user device (100) may include, but is not limited to, a smartphone, a tablet PC, a laptop, etc. For example, the user device (100) may include various computing devices equipped with wireless communication means and / or computing means. The user device (100) may be referred to as a user terminal, a wireless device, a mobile terminal, a portable device, etc.

[0044] In this disclosure, a "user" may refer to a developer who builds infrastructure for a target service (e.g., an application) according to embodiments of the present disclosure. For example, a developer may write code for application design and / or development, create a security policy for the application, and build a code-based infrastructure with applied security policies using a code-based infrastructure building system (200) according to some embodiments of the present disclosure.

[0045] Additionally, in the present disclosure, a user may mean a service user who uses a target service provided through a code-type infrastructure constructed according to embodiments of the present disclosure.

[0046] In the embodiments of the present disclosure, developers and service users are all referred to as users without distinction, and users may be classified as developers or service users depending on the implementation form of each embodiment.

[0047] A user device (100) may be used to utilize a code-type infrastructure construction system (200) according to embodiments of the present disclosure. For example, the user device (100) may display functions of the code-type infrastructure construction system (200) or information and / or data generated by the code-type infrastructure construction system (200) (e.g., Infrastructure as Code (IaC) scripts, Policy as Code (PaC) scripts, etc.) as a user interface. As another example, the user device (100) may display a user interface for a target service provided through an infrastructure constructed by the code-type infrastructure construction system (200).

[0048] A code-based infrastructure construction system (200) may refer to a computing system capable of providing a code-based construction service for an infrastructure for servicing a target service by performing steps and / or operations according to embodiments of the present disclosure.

[0049] For reference, in this disclosure, "infra" refers to infrastructure, and the code-type infrastructure construction system (200) may be referred to as a code-type infrastructure construction system (200). Hereinafter, for convenience of explanation, "infrastructure" is referred to as "infrastructure."

[0050] Referring to FIG. 1, the code-type infrastructure construction system (200) may include a security policy module (210), a large-scale language model (220), and / or an infrastructure construction module (230).

[0051] Each module (e.g., security policy module (210), infrastructure construction module (230)) included in the code-type infrastructure construction system (200) may mean a component that performs steps and / or operations according to some embodiments of the present disclosure, and the function of each module may be implemented on one or more computing devices.

[0052] Additionally, it is noted that each module included in the code-type infrastructure construction system (200) may be implemented on different computing devices or may be implemented on the same computing device.

[0053] The security policy module (210) may generate a security policy for a target service using a large-scale language model (220) according to some embodiments of the present disclosure.

[0054] For example, the security policy module (210) can obtain security information about a target service, input the security information into a large-scale language model (220), and use information output from the large-scale language model (220) to generate a security policy corresponding to the security information.

[0055] For another example, the security policy module (210) may generate a security policy in response to receiving user input that includes a security policy for a target service.

[0056] The security policy module (210) can generate a policy as code (PaC) corresponding to a security policy for a target service using a large-scale language model (220) according to some embodiments of the present disclosure.

[0057] For example, the security policy module (210) can input a security policy for a target service into a large-scale language model (220) and obtain a PaC script corresponding to the security policy using information output from the large-scale language model.

[0058] A large language model (LLM) (220) can refer to a generative artificial intelligence (AI)-based language model constructed by learning various types of text. A large language model can also be referred to as a generative AI, a generative AI model, a question-answering model, or a conversational model. In the following description, unless otherwise specified, the term "language model" is assumed to refer to a large language model.

[0059] The infrastructure building module (230) can build a code-based infrastructure for servicing a target service using a large-scale language model (220) according to some embodiments of the present disclosure.

[0060] For example, the infrastructure construction module (230) can obtain a security policy for the target service, input the security policy into a large-scale language model (220), and generate attribute information for the target service using information output from the large-scale language model (220). In addition, the attribute information and a PaC script generated by the security policy module (210) according to some embodiments of the present disclosure can be input into the large-scale language model (220), and an Infrastructure as Code (IaC) script for constructing the infrastructure of the target service can be generated using information output from the large-scale language model (220).

[0061] The code-type infrastructure construction system (200) can automatically construct an infrastructure for servicing a target service using an IaC script reflecting PaC generated according to some embodiments of the present disclosure.

[0062] The code-type infrastructure construction system (200) may be implemented on at least one computing device as described above. For example, all functions of the code-type infrastructure construction system (200) may be implemented on a single computing device. In another example, some functions of the code-type infrastructure construction system (200) may be implemented on a first computing device, and the remaining functions may be implemented on a second computing device. Furthermore, specific functions of the code-type infrastructure construction system (200) may be implemented on one or more computing devices.

[0063] The database (300) may include various data and / or information obtained / generated according to some embodiments of the present disclosure, and may include one or more repositories.

[0064] For example, the database (300) may include a repository for storing PaC scripts for each target service, a repository for storing IaC scripts for each target service, etc.

[0065] As another example, the database (300) may include security information for generating a security policy for each target service.

[0066] The code-type infrastructure construction system (200) can automatically construct an infrastructure for servicing a target service using data included in a database (300), and the database (300) can be included in the code-type infrastructure construction system (200).

[0067] The components illustrated in FIG. 1 can communicate via various types of wired / wireless networks. The device and / or system according to the present disclosure can be applied to a local area network (LAN), a wide area network (WAN), a mobile radio communication network, Wibro (Wireless Broadband Internet), etc., and is not limited thereto, and can also be applied to any other communication system.

[0068] Next, with reference to FIG. 2, an embodiment related to a code-type infrastructure construction system (200) will be specifically described.

[0069] FIG. 2 is a flowchart illustrating the operation of a code-type infrastructure construction system (200) according to one embodiment of the present disclosure.

[0070] Referring to FIG. 2, the security policy module (210) can generate a security policy for the target service using a large-scale language model (220) to set a security policy for the target service, and can generate a PaC script corresponding to the security policy generated using the large-scale language model (220) to generate a code-based security policy (S1000).

[0071] Referring to FIG. 2, the code-type infrastructure construction system (200) may further include a Retrieval-Augmented Generation (RAG) system (240).

[0072] The RAG system (240) can input security information about a target service and, in response, generate enhanced security information. The large-scale language model (220) can input the enhanced security information about the target service generated by the RAG system (240) and generate a corresponding security policy.

[0073] Although not shown in FIG. 2, the security policy module (210) may receive user input including a security policy for a target service, input the received security policy into a large-scale language model (220), and generate a PaC script based on information output from the large-scale language model (220).

[0074] For example, user input may be received for a document containing a security policy, and a large-scale language model (220) may generate a corresponding PaC script.

[0075] The security policy module (210) may store PaC scripts generated according to some embodiments of the present disclosure in a first repository (310), and the code-type infrastructure construction system (200) may further include a first repository (310) for storing PaC scripts corresponding to security policies for each service.

[0076] The infrastructure construction module (230) can generate attribute information for a target service using a large-scale language model (220) and generate an IaC script for constructing the infrastructure of the target service using the large-scale language model (220) (S2000).

[0077] In S2000, the attribute information may include configuration information for setting a security policy for the target service, and may further include information required for configuring the operating server for servicing the target service (e.g., connection URL, port information, etc.).

[0078] The infrastructure building module (230) can store the IaC scripts generated according to some embodiments of the present disclosure in a second repository (320), and the code-type infrastructure building system (200) can further include a second repository (320) for storing IaC scripts for building service-specific infrastructure.

[0079] A large-scale language model (220) may refer to a model that learns a process for generating security information, IaC, and / or PaC for a target service. In the present disclosure, the target service may refer to an open service currently in service and open to an unspecified number of people.

[0080] Additionally, although not shown in FIG. 2, the code-type infrastructure building system (200) may not include a RAG system (240) to generate security information, security policies, attribute information, IaC / PaC scripts according to some embodiments of the present disclosure, and may fine-tune a large-scale language model (220).

[0081] The code-based infrastructure construction system (200) according to embodiments of the present disclosure can be applied to cloud environments and / or on-premise environments. In other words, the code-based infrastructure construction system (200) can automatically construct the infrastructure of an operating server operating to support a target service in a cloud environment and / or on-premise environment according to some embodiments of the present disclosure.

[0082] As illustrated in FIG. 2, the code-type infrastructure construction system (200) may further include a build server (250) for constructing the infrastructure of a target service using an IaC / PaC script generated according to some embodiments of the present disclosure.

[0083] For example, the build server (250) can automatically build the infrastructure of an application using source code for designing and / or developing an application stored in a third repository (330), a PaC script including a security policy corresponding to the application stored in a first repository (310), and an IaC script reflecting the property information and / or security policy of the application stored in a second repository (320) (S3000).

[0084] In S3000, PaC scripts referenced in IaC scripts can be identified through a large-scale language model (220), and based on reference information about PaC scripts included in the IaC scripts, code-based infrastructure for target services can be built by executing the IaC scripts and PaC scripts.

[0085] Next, referring to FIG. 3, an embodiment of a process in which an infrastructure reflecting a code-based security policy is built based on code according to some embodiments of the present disclosure is specifically described.

[0086] FIG. 3 is a flowchart illustrating a process of constructing a code-type infrastructure reflecting a code-type policy according to some embodiments of the present disclosure.

[0087] For reference, in the embodiments described with reference to FIG. 3, if the subject of a specific step / action is omitted, it can be understood that the step / action is performed in the code-type infrastructure construction system (200) of FIG. 1.

[0088] According to one embodiment of the present disclosure, as illustrated in FIG. 3, it can be determined whether a security policy is defined and managed as PaC in an IaC script for building an infrastructure for a target service using a large-scale language model (220), and PaC can be automatically set in IaC using the large-scale language model (220).

[0089] Additionally, according to some embodiments of the present disclosure, the IaC / PaC script may be modified in response to user input that includes a request for modification to the IaC / PaC script generated by the large-scale language model (220).

[0090] As described with reference to FIGS. 2 and 3, according to embodiments of the present disclosure, the code-type infrastructure construction system (200) can automatically construct the infrastructure of an operating server for servicing a target service through automated linking of information related to the target service (e.g., security information, attribute information, etc.).

[0091] Hereinafter, with reference to FIGS. 4 to 6, embodiments for automatically constructing an infrastructure for servicing a target service by a computing device according to embodiments of the present disclosure will be described in detail. For reference, FIGS. 4 to 6 illustrate steps / operations performed in the code-type infrastructure construction system (200) of FIG. 1. Therefore, in the following description, if the subject of a specific step / operation is omitted, it can be understood that the step / operation is performed in the code-type infrastructure construction system (200) of FIG. 1. The following description will be made with reference to FIGS. 1 to 3, along with FIGS. 4 to 6.

[0092] In addition, it is noted that the technical ideas that can be understood from the embodiments described with reference to FIGS. 1 to 3 can be obviously applied to the methods according to the embodiments described with reference to FIGS. 4 to 6 even without separate mention.

[0093] FIG. 4 is a flowchart illustrating an example of a method for constructing a code-type infrastructure according to one embodiment of the present disclosure.

[0094] S100 to S600 of FIG. 4 can correspond to S1000 to S3000 of FIG. 2.

[0095] Referring to FIG. 4, security information for a target service can be obtained (S100), the security information can be input into a language model, and a security policy corresponding to the security information can be generated using information output from the language model (S200).

[0096] In S100, security information may refer to security information applicable to the target service. For example, the security information may include encryption information, and may include information about security algorithm types and encryption protocols (e.g., Transport Layer Socket (TLS) / Secure Sockets Layer (SSL)).

[0097] In S200, the security policy may refer to a security policy to be set for the target service in response to the security information obtained in S100. For example, encryption protocol versions applicable to the target service may be obtained in S100, and one of the encryption protocol versions obtained in S200 may be included in the security policy to be set for the target service.

[0098] In S100, security information can be acquired based on user input. For example, security information about a target service can be acquired in response to user input, such as a document containing security information and / or a security policy for the target service. For another example, security information can be stored in a database for each target service.

[0099] Additionally, in S100, security information can also be generated using a language model.

[0100] In S100, a query for a target service is input to a language model, and security information can be generated using information output from the language model.

[0101] A security policy can be input into a language model, and attribute information for a target service can be generated using information output from the language model (S300).

[0102] In S300, the attribute information may include configuration information for setting a security policy for the target service. Furthermore, in S300, the attribute information may include information necessary for configuring the operating server for servicing the target service, such as a connection URL and port information for connecting to the operating server.

[0103] Additionally, a security policy is input into a language model, and a first code script corresponding to the security policy can be obtained using information output from the language model (S400).

[0104] In S400, a security policy is input into a language model, and information output from the language model can be used to determine whether the security policy is included in a first repository, and if the security policy is not included in the first repository, the security policy is input into the language model, and a first code script can be generated using information output from the language model.

[0105] In S400, the first code script may mean a PaC script, and the first repository may correspond to the first repository (310) containing a PaC script for each service as described with reference to FIG. 2.

[0106] In other words, in S400, it can be determined using a language model whether there is a PaC script in the first repository that contains a policy corresponding to the security policy of the target service.

[0107] In S400, the first code script generated when the first repository does not contain the security policy of the target service may also be stored in the first repository.

[0108] The PaC scripts included in the first repository, including the first code script, may include a comment section for the language model according to the present disclosure to recognize a service-specific security policy corresponding to each script.

[0109] For example, the first code script may include a comment section formed in natural language that includes the security policy of the target service and a code section that includes code corresponding to the security policy. Furthermore, for example, the comment section included in the first code script may be located at the top of the code section.

[0110] Note that the comment section may also be called the comment section, and the comment section and the code section may differ depending on the code script writing tool, compiler, interpreter, etc.

[0111] Attribute information and a first code script are input into a language model, and a second code script for constructing the infrastructure of a target service can be generated using information output from the language model (S500).

[0112] In S500, the second code script may refer to an IaC script and may include property information and / or reference information to the first code script.

[0113] Using the second code script generated in S500, the infrastructure for servicing the target service can be automatically built (S600).

[0114] In S600, a second code script may be input into a language model, and reference information for a first code script included in the second code script may be output, and a security policy for a target service may be set using the first code script based on the output reference information.

[0115] In S100 to S600, the target service is an open service currently in service, which may mean a service open to an unspecified number of people.

[0116] Additionally, in S100 to S600, the language model may correspond to a large-scale language model in the embodiments described with reference to FIGS. 1 to 3, and may be a model that has learned the process for generating security information of the target service, and attribute information and / or IaC / PaC.

[0117] According to embodiments of the present disclosure, as illustrated in S100 to S600, automated linking of information about a target service can be supported, through which a code-based structure for servicing the target service can be automatically constructed.

[0118] Additionally, according to some embodiments of the present disclosure, security policies, IaC / PaC scripts, etc. generated by the language model may be modified based on user input.

[0119] In other words, the first code script may mean a code script output as a result of inputting a security policy into the first code script language model, and the second code script may mean a code script output as a result of inputting attribute information and the first code script into the language model, but the first code script and / or the second code script may each be a code script that includes code modified based on user input from a code script obtained as an output result of the language model.

[0120] FIG. 5 is a flowchart illustrating a specific example of a code-type infrastructure script generation process according to some embodiments of the present disclosure.

[0121] Specifically, FIG. 5 illustrates an example of a process in which the second code script in S500 of FIG. 4 is modified based on user input.

[0122] S500 and S600 of FIG. 5 can correspond to S500 and S600 of FIG. 4.

[0123] Referring to FIG. 5, generating a second code script for constructing the infrastructure of a target service using information output from a language model in S500 may mean that attribute information and a first code script are input into a language model, a second code script is output, and in response to a user input including a request for modification to the output second code script, the output second code script is modified (S510).

[0124] Next, referring to FIG. 6, an embodiment for automatically constructing the infrastructure of an operating server for servicing an application according to the embodiments described with reference to FIGS. 4 and 5 is described.

[0125] FIG. 6 is a flowchart illustrating an example of the overall operation of a code-type infrastructure construction system (200) according to some embodiments of the present disclosure.

[0126] S1 to S2 may correspond to S100 to S200 of FIG. 4, S3 may correspond to S300 of FIG. 4, S4 to S6 may correspond to S400 of FIG. 4, S7 to S8 may correspond to S500 of FIG. 4, and S10 may correspond to S600 of FIG. 4.

[0127] Additionally, S1 to S9 may correspond to S1000 to S2000 of FIG. 2, and S10 may correspond to S3000 of FIG. 2.

[0128] For reference, while the following examples illustrate web applications as target services, the target services and / or operating servers supporting the target services to which the embodiments of the present disclosure may be applied are not limited thereto. The target services to which the embodiments of the present disclosure may be applied may include web applications, native applications, hybrid applications, and the like, and the operating servers may include servers supporting web applications, native applications, hybrid applications, and the like.

[0129] In addition, although the following examples illustrate an encryption policy for the target service as a security policy, the security policies to which the embodiments according to the present disclosure can be applied are not limited thereto.

[0130] Referring to Figure 6, a list of applications to be installed can first be obtained.

[0131] And, in order to obtain security information about a target application for configuring infrastructure among the list of applications, a query about security functions supported by the target application can be input into a large-scale language model (220) (S1).

[0132] In S1, queries about, for example, the type of security algorithm for the target application, information about the encryption protocol (e.g., TLS / SSL version), etc. can be input into the large-scale language model (220).

[0133] As a result, the large-scale language model (220) can output security information for the target application as shown in the following table.

[0134] (...)The target application supports SSL / TLS encryption using the TLS protocol. As of OpenSSL version 1.1.1, the target application supports TLS version 1.3. Previous versions, such as OpenSSL 1.0.2, supported up to TLS 1.2, while OpenSSL 0.9.8 only supported up to TLS 1.0. (...) The target application supports most symmetric key (AES, ChaCha20, etc.) and asymmetric key (RSA, ECDSA, etc.) encryption algorithms provided by OpenSSL. (...)

[0135] A query regarding a security policy for a security feature obtained from S1 can be input into a large-scale language model (220) (S2).

[0136] For example, a large-scale language model (220) that receives security information as exemplified in Table 1 can output a security policy as shown in the following table.

[0137] (...)- Servers published on the Internet must communicate through encrypted connections- Use TLS 1.3 for encrypted connections- Apply PQC-based TLS to respond to security threats caused by quantum computers- Use x25519_kyber768 for KEM settings for PQC-based TLS(...)

[0138] A request to generate attribute information of a target application can be input to a large-scale language model (220) (S3).

[0139] In S3, the attribute information may include information for setting the security policy of the target application and / or information required for configuring the operating server for servicing the target application (e.g., connection URL, port information, etc.), and the security policy for the target application may be input into a large-scale language model (220) along with a generation request.

[0140] At this time, the attribute information can be generated in a file format, but is not limited thereto.

[0141] For example, a request for generating attribute information for a target application along with an example security policy as shown in Table 2 may be input to a large-scale language model (220), and as a result, attribute information as shown in the following table may be output.

[0142] server {listen 6070;location / {proxy_pass http: / 127.0.0.1:80;}}server {listen 8443 ssl;ssl_certificate / etc / target_app / ssl / target_app-ssl.crt;ssl_certificate_key / etc / target_app / ssl / target_app-ssl.key;location / {proxy_pass https: / / 127.0.0.1:7070 / customers;}}

[0143] It can be determined whether a PaC corresponding to the target application exists in the PaC repository (S4).

[0144] In S4, the PaC repository can correspond to the first repository (310) described with reference to FIG. 2.

[0145] In S4, whether a PaC / PaC script corresponding to the target application exists in the PaC repository can be determined using a large-scale language model (220). For example, the large-scale language model (220) can recognize a security policy corresponding to each script through the comment section of the scripts included in the PaC repository, and through this, can output information on whether a PaC script including a security policy corresponding to the target application exists in the PaC repository.

[0146] In S4, if it is determined that a PaC / PaC script corresponding to the target application exists in the PaC repository, the PaC / PaC script can be obtained from the PaC repository.

[0147] In S4, if it is determined that there is no PaC / PaC script corresponding to the target application in the PaC repository, a request for PaC generation corresponding to the security policy of the target application can be input to the large-scale language model (220) (S5).

[0148] A PaC script generated based on information output by a large-scale language model (220) can be added / stored in a PaC repository (S6).

[0149] For example, a request to generate PaC for a target application along with an example security policy as shown in Table 2 can be input to a large-scale language model (220), and as a result, a PaC script as shown in the following table can be generated.

[0150] The following table shows an example of a PaC script generated using Open Policy Agent (OPA), a tool for generating PaC scripts.

[0151] (...)#IAC_SSL_SETTINGS_POLICY#Set fixed ssl_protocols and ssl_ecdh_curve valuesssl_protocols := “TLSv1.3”ssl_ecdh_curve := “x25519_kyber768:X25519”#Rules that return the set valuesssl_settings := {“ssl_protocols”:ssl_protocols,“ssl_ecdh_curve”:ssl_ecdh_curve}(...)

[0152] A request for generating IaC reflecting a property file and / or PaC for the target application can be input into a large-scale language model (220) (S7).

[0153] The IaC script for the target application generated by the large-scale language model (220) can be added / stored in the IaC repository (S8).

[0154] In S8, the IaC repository can correspond to the second repository (320) described with reference to FIG. 2.

[0155] For example, a request to generate IaC for a target application, together with the property information illustrated in Table 3 and the PaC script illustrated in Table 4, can be input into a large-scale language model (220), and as a result, an IaC script as shown in the following table can be generated.

[0156] Referring to Table 5, the IaC script may include reference information for the PaC script of the target application, such as a security policy path, a security policy attribute value, and a code value for applying the referenced security policy attribute value.

[0157] (...)tasks:- name: Get SSL settings from OPAuri:url: http: / localhost:8181 / v1 / data / target_app / ssl_settingsmethod: GET(...)- name: Parse OPA responseset_fact:ssl_protocols:"{{opa_response.json.result.ssl_protocols}}"ssl_ecdh_curve:"{{opa_response.json.result.ssl_ecdh_curve}}"- name: Add Kyber Configs(...)line: |{{' '}}ssl_protocols {{ssl_protocols}};{{' '}}ssl_ecdh_curve {{ssl_ecdh_curve}};state: present(...)

[0158] According to some embodiments of the present disclosure, when PaC and IaC for a target application are obtained, it can be evaluated whether the obtained PaC / IaC is applicable to the target application (S9).

[0159] In S9, in response to a user input including a request for modification to PaC / IaC, PaC / IaC for a target application may be modified according to some embodiments of the present disclosure, and the modified PaC / IaC may be stored in a PaC repository / IaC repository, thereby constructing an infrastructure of an operating server for servicing the target application.

[0160] According to some embodiments of the present disclosure, an infrastructure for a target application can be automatically built using IaC scripts and PaC scripts for the target application acquired / generated (S10).

[0161] For example, an IaC script for a target application stored in an IaC repository is acquired, reference information (e.g., a security policy path, an attribute value of the security policy) for a PaC script included in the IaC script is acquired, and the PaC script is applied based on the acquired reference information, thereby constructing an IaC to which an attribute value of the security policy for the target application is applied. At this time, reference information for the PaC script referenced in the IaC script can be acquired through a large-scale language model (220) according to the present disclosure.

[0162] FIG. 7 is a block diagram illustrating an example of a computing device for performing some embodiments of the present disclosure.

[0163] Referring to FIG. 7, a computing device (1) may include one or more processors (101), a bus (103), a communication interface (104), a memory (102) for loading a computer program executed by the processor (101), and a storage (105) for storing a computer program (106). However, only components related to the embodiment of the present disclosure are illustrated in FIG. 7. Therefore, a person skilled in the art to which the present disclosure pertains will appreciate that other general components may be included in addition to the components illustrated in FIG. 7. That is, the computing device (1) may further include various components in addition to the components illustrated in FIG. 7. In addition, in some cases, the computing device (1) may be configured in a form in which some of the components illustrated in FIG. 7 are omitted. Hereinafter, each component of the computing device (1) will be described.

[0164] The processor (101) can control the overall operation of each component of the computing device (1). The processor (101) can be configured to include at least one of a CPU (Central Processing Unit), an MPU (Micro Processor Unit), an MCU (Micro Controller Unit), a GPU (Graphics Processing Unit), or any other type of processor well known in the technical field of the present disclosure. In addition, the processor (101) can perform operations for at least one application or program for executing a method and / or operation according to embodiments of the present disclosure. The computing device (1) can be equipped with one or more processors.

[0165] In addition, the system and / or computing device (1) according to embodiments of the present disclosure may further include a database, and the processor (101) may store data and / or information generated / output according to some embodiments of the present disclosure in the memory (102) and / or the database. Here, the database in which the data and / or information is stored is not limited to a database within the system and / or computing device (1) according to the present disclosure, and may include, for example, a database of an external server.

[0166] The memory (102) can store various data, commands, and / or information. The memory (102) can load a computer program (106) from the storage (105) to execute methods and / or operations according to embodiments of the present disclosure. The memory (102) may be implemented as a volatile memory such as RAM, but the present disclosure is not limited thereto.

[0167] The bus (103) can provide a communication function between components of the computing device (1). The bus (103) can be implemented as various types of buses such as an address bus, a data bus, and a control bus.

[0168] The communication interface (104) can support wired / wireless Internet communication of the computing device (1). Furthermore, the communication interface (104) can also support various communication methods other than Internet communication. To this end, the communication interface (104) can be configured to include a communication module well known in the technical field of the present disclosure.

[0169] Storage (105) can non-temporarily store one or more computer programs (106). Storage (105) can be configured to include non-volatile memory such as Read Only Memory (ROM), Erasable Programmable ROM (EPROM), Electrically Erasable Programmable ROM (EEPROM), flash memory, a hard disk, a removable disk, or any form of computer-readable recording medium well known in the art to which the present disclosure pertains.

[0170] The computer program (106) may include one or more instructions that, when loaded into the memory (102), cause the processor (101) to perform methods and / or operations according to various embodiments of the present disclosure. That is, the processor (101) may perform the methods / implementations / operations according to various embodiments of the present disclosure by executing the one or more loaded instructions.

[0171] In the present disclosure, a computer-readable (non-volatile) storage medium can store at least one instruction or computer program, which when executed by at least one processor can cause the at least one processor to perform a method and / or operation according to some embodiments of the present disclosure.

[0172] For example, the computer program (106) may include instructions for obtaining security information for the target service, inputting the security information into a language model, generating a security policy corresponding to the security information using information output from the language model, inputting the security policy into the language model, generating attribute information for the target service using information output from the language model, inputting the security policy into the language model, obtaining a first code script corresponding to the security policy using information output from the language model, inputting the attribute information and the first code script into the language model, generating a second code script for constructing the infrastructure of the target service using information output from the language model, and automatically constructing the infrastructure for servicing the target service using the second code script.

[0173] According to embodiments of the present disclosure, an infrastructure for providing a service can be automatically constructed through automated linking of information (e.g., security information, attribute information, etc.) about the target service.

[0174] Accordingly, security policies for applications can be centrally managed, enabling efficient transition of encryption systems for each application.

[0175] Various embodiments of the present disclosure and effects according to the embodiments have been described with reference to FIGS. 1 through 7. The effects according to the technical concept of the present disclosure are not limited to the effects described above, and other effects not mentioned will be clearly understood by those skilled in the art from the contents of the present disclosure.

[0176] Although the components constituting the embodiments of the present disclosure have been described as being combined or operating in combination as one, the present disclosure is not necessarily limited to such embodiments. That is, within the scope of the present disclosure, the components may be selectively combined and operated in one or more combinations.

[0177] Although operations are depicted in the drawings in a specific order, this should not be construed as requiring that the operations be performed in the specific order depicted, or in a sequential order, or that all depicted operations be performed to achieve the desired results. In certain circumstances, multitasking and parallel processing may be advantageous. Furthermore, the separation of various components in the embodiments described above should not be construed as requiring such separation, and it should be understood that the program components and systems described may generally be integrated together into a single software product or packaged into multiple software products.

[0178] Although the embodiments of the present disclosure have been described with reference to the attached drawings, those skilled in the art will appreciate that the present disclosure can be implemented in other specific forms without altering the technical spirit or essential features thereof. Therefore, it should be understood that the embodiments described above are exemplary in all respects and not restrictive. The scope of protection of the present disclosure should be interpreted by the claims below, and all technical ideas within a scope equivalent thereto should be interpreted as being included within the scope of the rights of the present disclosure.

Claims

1. A method performed by a computing system that provides a code-based construction service to an infrastructure for servicing a target service, A step of obtaining security information for the above target service; A step of inputting the above security information into a language model and generating a security policy corresponding to the security information using information output from the language model; A step of inputting the security policy into the language model and generating attribute information for the target service using information output from the language model; A step of inputting the security policy into the language model and obtaining a first code script corresponding to the security policy using information output from the language model; A step of inputting the above attribute information and the first code script into the language model, and generating a second code script for constructing the infrastructure of the target service using information output from the language model; and A step of automatically constructing the infrastructure for servicing the target service using the second code script, How to build code-based infrastructure.

2. In paragraph 1, The steps for obtaining security information for the above target service are: A step of inputting a query for the target service into the language model and generating the security information using information output from the language model, How to build code-based infrastructure.

3. In paragraph 1, The step of inputting the above security policy into the language model and obtaining the first code script corresponding to the security policy using information output from the language model is: A step of inputting the security policy into the language model and using information output from the language model to determine whether the security policy is included in the first repository; and If the security policy is not included in the first repository, a step of inputting the security policy into the language model and generating the first code script using information output from the language model is included. How to build code-based infrastructure.

4. In paragraph 1, The above first code script includes a comment section including the security policy and a code section including code corresponding to the security policy. How to build code-based infrastructure.

5. In paragraph 1, The above target service is an open service currently in service. How to build code-based infrastructure.

6. In paragraph 1, The step of automatically constructing the infrastructure for servicing the target service using the second code script is: A step of inputting the second code script into the language model and outputting reference information about the first code script included in the second code script; and A step of setting the security policy for the target service using the first code script based on the above reference information, How to build code-based infrastructure.

7. In paragraph 1, Further comprising a step of modifying the second code script in response to a user input including a request for modification to the second code script. How to build code-based infrastructure.

8. At least one processor; and At least one memory storing instructions that, when executed by at least one processor, cause the at least one processor to perform operations, The above actions are, The act of obtaining security information about the target service; An operation of inputting the above security information into a language model and generating a security policy corresponding to the security information using information output from the language model; An operation of inputting the above security policy into the language model and generating attribute information for the target service using information output from the language model; An operation of inputting the above security policy into the language model and obtaining a first code script corresponding to the security policy using information output from the language model; An operation of inputting the above attribute information and the first code script into the language model, and generating a second code script for constructing the infrastructure of the target service using information output from the language model; and An operation for automatically constructing the infrastructure for servicing the target service using the second code script, A system for building code-type infrastructure.

9. In paragraph 8, The action to obtain security information for the above target service is: An operation including inputting a query for the target service into the language model and generating the security information using information output from the language model. A system for building code-type infrastructure.

10. In paragraph 8, The operation of inputting the above security policy into the language model and obtaining the first code script corresponding to the security policy using information output from the language model is: An operation of inputting the security policy into the language model and using information output from the language model to determine whether the security policy is included in the first repository; and If the security policy is not included in the first repository, an operation of inputting the security policy into the language model and generating the first code script using information output from the language model is included. A system for building code-type infrastructure.

11. In paragraph 8, The operation of automatically constructing the infrastructure for servicing the target service using the second code script is: An operation of inputting the second code script into the language model and outputting reference information about the first code script included in the second code script; and Based on the above reference information, an operation of setting the security policy for the target service using the first code script is included. A system for building code-type infrastructure.

12. In combination with computing devices to provide code-based construction services for infrastructure to service the target service, A step of obtaining security information for the above target service; A step of inputting the above security information into a language model and generating a security policy corresponding to the security information using information output from the language model; A step of inputting the security policy into the language model and generating attribute information for the target service using information output from the language model; A step of inputting the security policy into the language model and obtaining a first code script corresponding to the security policy using information output from the language model; A step of inputting the above attribute information and the first code script into the language model, and generating a second code script for constructing the infrastructure of the target service using information output from the language model; and In order to execute a step of automatically constructing the infrastructure for servicing the target service using the second code script, stored in a computer-readable recording medium, Computer program.

13. In paragraph 12, The steps for obtaining security information for the above target service are: A step of inputting a query for the target service into the language model and generating the security information using information output from the language model, Computer program.

14. In paragraph 12, The step of inputting the above security policy into the language model and obtaining the first code script corresponding to the security policy using information output from the language model is: A step of inputting the security policy into the language model and using information output from the language model to determine whether the security policy is included in the first repository; and If the security policy is not included in the first repository, a step of inputting the security policy into the language model and generating the first code script using information output from the language model is included. Computer program.

15. In paragraph 12, The step of automatically constructing the infrastructure for servicing the target service using the second code script is: A step of inputting the second code script into the language model and outputting reference information about the first code script included in the second code script; and A step of setting the security policy for the target service using the first code script based on the above reference information, Computer program.

Images