Cloud Security Policy Automation for Faster Threat Response

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing cloud-based security systems face delays in responding to new security attacks due to manual intervention in creating and propagating security policies, leading to inefficiencies in defense mechanisms.

Innovation Solution

Implementing a security management automation system that utilizes machine learning to analyze real-time monitoring data from virtual machines and network switches, automatically updating security policies and applying intent-based networking to respond to security attacks through an Interface to Network Security Functions (I2NSF) framework, utilizing a decentralized audit system and blockchain technology for verification.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Loss of time

If manual creation and propagation of security policies is used, then security policy implementation is achieved, but response time to new security attacks is delayed

Engineering Contradiction:

Improveresponse time to new security attacksVSAvoidmanual intervention in security policy creation

Core Design Contradiction:

Loss of timeVSExtent of automation

Solution Approach 1:

The system enables self-service automation where the security management system automatically creates, translates, and propagates security policies without manual intervention. The automated policy translation system receives high-level security policies, translates them into low-level policies, and distributes them to network security functions automatically, eliminating the need for manual security policy management while reducing response time to new threats.

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

The patent replaces the manual mechanical process of security policy creation and propagation with an automated computational system. The automated policy translation system uses computational algorithms to translate high-level security policies into low-level policies and distribute them across the network, substituting human operators with an automated information processing system that operates continuously without delay.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

2Speed

If manual security policy management is used, then security control is maintained, but propagation speed of new security policies to other clouds is reduced

Engineering Contradiction:

Improvepropagation speed of security policiesVSAvoidsecurity management system architecture

Core Design Contradiction:

SpeedVSDevice complexity

Solution Approach 1:

The system segments the security policy management process into distinct functional components: high-level policy definition, automated translation engine, and low-level policy distribution to network security functions. This segmentation allows each component to operate independently and efficiently, enabling rapid propagation of security policies across multiple clouds while maintaining proper control and validation at each stage.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The automated policy translation system acts as an intermediary between high-level security requirements and low-level network security function configurations. This intermediary component translates and adapts policies automatically, enabling fast propagation across different cloud environments while maintaining security control through the translation process.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Productivity

If automated policy translation from high-level to low-level security policies is implemented, then response efficiency to security attacks is improved, but system complexity increases

Engineering Contradiction:

Improvesecurity policy implementation efficiencyVSAvoidautomatic mapping model and translation system

Core Design Contradiction:

ProductivityVSDevice complexity

Solution Approach 1:

The automated policy translation system is designed as a universal platform that can handle multiple types of security policies and translate them into various low-level formats suitable for different network security functions. This multi-functional approach consolidates what would otherwise require multiple separate systems, improving productivity while managing complexity through a unified translation engine.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Data Source

PatentUS12477005B2Method and system for performing security management automation in cloud-based security services

Publication Date: 2025.11.18 RES & BUSINESS FOUND SUNGKYUNKWAN UNIV

AI summary

A method of performing a security management automation in an Interface to Network Security Functions (I2NSF) system is disclosed. The method comprises receiving a high-level security policy via a consumer-facing interface; translating the high-level security policy into a low-level security policy based on an automatic mapping model; transmitting the low-level security policy to a network security function (NSF) via an NSF-facing interface, wherein the low-level security policy is applied to a system of the NSF; receiving monitoring data for a network security from the NSF; reconfiguring a security policy based on the monitoring data; and transmitting the reconfigured security policy to the NSF via the NSF-facing interface. The reconfigured security policy is updated to a system of the NSF.