Cloud Network Topology Analysis for Security Policy Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for analyzing cloud service security settings are time-consuming and labor-intensive, requiring manual access to cloud consoles to check communication paths and policies, which are not efficient in addressing growing security concerns and potential data breaches.
Innovation Solution
A network analysis apparatus and method that automatically receive information on cloud resources and network environments, derive network topology, and identify communication possible paths and allow policies by analyzing firewall and routing configurations, enabling efficient identification of security vulnerabilities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If manual analysis of cloud service security settings is performed by accessing cloud consoles, then security analysis can be conducted, but the process becomes time-consuming and labor-intensive
Solution Approach 1:
The patent creates a virtual copy of the cloud service network environment by constructing a network topology model that replicates the actual cloud infrastructure, including virtual private clouds, subnets, security groups, and network paths. This model allows security analysis to be performed on the copy rather than requiring direct manual inspection of the live system, significantly reducing analysis time while maintaining accuracy.
Solution Approach 2:
The patent introduces an intermediary network topology construction module that acts as a mediator between the cloud service provider's infrastructure and the security analysis process. This module automatically gathers configuration information from the cloud environment and builds a structured topology model, serving as an intermediary that eliminates the need for manual console access while preserving the ability to conduct thorough security analysis.
2Measurement precision
If manual analysis of cloud service security settings is performed by accessing cloud consoles, then security analysis can be conducted, but the process requires significant manpower
Solution Approach 1:
The patent implements a self-service mechanism where the network topology construction module automatically collects configuration data from the cloud environment, identifies network paths, and builds the topology model without human intervention. The system autonomously queries cloud service APIs, extracts security group configurations, and constructs the analysis model, eliminating the need for manual labor while maintaining high analysis accuracy.
Solution Approach 2:
The patent replaces the mechanical manual process of accessing cloud consoles and analyzing security settings with an automated computational system. The network topology construction module uses programmatic interfaces to gather configuration information and construct the topology model, substituting human manual operations with automated software processes that improve productivity while maintaining analysis precision.
3Productivity
If automated network topology construction is performed by gathering configuration information, then analysis efficiency is improved, but the device complexity increases
Solution Approach 1:
The patent divides the security analysis system into distinct functional modules: a network topology construction module that gathers configuration information and builds the topology model, and a network path analysis module that performs security analysis on the constructed model. This segmentation allows each module to specialize in specific tasks, improving overall efficiency while managing complexity through modular design where each component has a defined responsibility.
Solution Approach 2:
The patent transforms the complex cloud infrastructure configuration data into a structured network topology model representation, changing the dimensionality of the data from raw configuration files and API responses into a standardized graph structure with nodes and edges. This dimensional transformation simplifies the data structure, making it easier to process and analyze while maintaining comprehensive security analysis capabilities.
Data Source
AI summary
An apparatus for analyzing a network according to an embodiment includes a receiving module configured to receive, from a cloud service, information on one or more resources included in the cloud service and information on a network environment of the one or more resources, a topology generation module configured to derive a network topology of the cloud service by using the information on the resources and the information on the network environment, and an analysis module configured to derive, from the network topology, a communication possible path of each of the one or more resources and one or more communication allow policies in the communication possible path.