# US 11,310,284 B2 · Validation of cloud security policies > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,310,284 B2 - Document ID: US11310284B2 - Status: Granted - Kind: B2 - Application number: 16/428,849 - Filed: 2019-05-31 - Published: 2020-12-03 - Granted: 2022-04-19 - Earliest claimed: 2019-05-31 - Assignees: vArmour Networks, Inc. - Applicants: vArmour Networks, Inc. - Inventors: Marc Woolward; Meng Xu; Hong Xiao; Keith Stewart; Matthew M. Williamson - Web page: https://patentgrep.com/patent/US11310284B2 ## CPC - H04L 63/205: {involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24)} - G06F 16/9024: {Graphs; Linked lists (G06F16/9027 takes precedence)} - H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)} - H04L 63/0263: {Rule management} - H04L 67/1097: for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS] - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Methods and systems for validating security policy in a cloud computing environment are provided. An example method includes providing a graph database, the graph database representing workloads of the cloud computing environment as nodes and relationships between the workloads as edges, receiving a security policy, the security policy logically describing rules for the relationships between the workloads, determining, based on the security policy and the graph database, a list of violations, the list of violations including at least one relationship from the relationships between the workloads in the graph database, the at least one relationship being not allowed by at least one of the rules in the security policy, and providing the list of violations to a user. ## Claims ### Claim 1 A computer-implemented method for validating security policy in a cloud computing environment, the method comprising: providing a graph database, the graph database representing workloads of the cloud computing environment as nodes and relationships between the workloads as edges; determining a level of entropy in the cloud computing environment based on the workloads; determining a reliability score and at least one recommendation for a security policy based on the level of entropy; receiving the security policy, the security policy logically describing rules for the relationships between the workloads; determining, based on the security policy and the graph database, a list of violations, the list of violations including at least one relationship from the relationships between the workloads in the graph database, the at least one relationship being not allowed by at least one of the rules in the security policy; and providing the list of violations to a user. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, wherein the graph database is created and updated based on a data concerning the cloud computing environment, the data including at least one of streaming telemetry from network logs, events from a cloud control plane, and inventory from a configuration management database. ### Claim 3 (depends on 1) The computer-implemented method of claim 1, wherein the security policy is a programmatically readable document including one or more of the following: a JavaScript Object Notation document, a Language (YAML) document, and an Open Policy Agent (OPA) rules document. ### Claim 4 (depends on 1) The computer-implemented method of claim 1, wherein the security policy is generated based on a security template, the security template including protected workloads in the cloud computing environment. ### Claim 5 (depends on 1) The computer-implemented method of claim 1, wherein the security policy is created by the user based upon manually declared requirements. ### Claim 6 (depends on 1) The computer-implemented method of claim 1, wherein the determining the list of violations includes: traversing the nodes and the edges of the graph database; and while traversing: determining a type of connection between at least two nodes; and determining that the type of connection between the at least two nodes is not permitted by the rules of the security policy. ### Claim 7 (depends on 1) The computer-implemented method of claim 1, wherein the providing the list of violations to the user includes: displaying a visual representation of the nodes and the edges of the graph database, wherein the edges correspond to connections not allowed by the at least one of the rules in the security policy; or a tabular representation using JSON. ### Claim 8 (depends on 7) The computer-implemented method of claim 7, further comprising: receiving, from the user, a user input indicative of allowing or disallowing the at the least one relationship not allowed by the at least one of the rules of the security policy; and modifying the security policy based on the user input. ### Claim 9 (depends on 8) The computer-implemented method of claim 8, further comprising: deploying the security policy to the cloud computing environment. ### Claim 10 (depends on 1) The computer-implemented method of claim 1, wherein the cloud computing environment is hosted by a plurality of different cloud services. ### Claim 11 A system for managing security in a cloud computing environment, the system comprising: a processor; and a memory communicatively coupled to the processor, the memory storing instructions executable by the processor to perform a method comprising: providing a graph database, the graph database representing workloads of the cloud computing environment as nodes and relationships between the workloads as edges; determining a level of entropy in the cloud computing environment based on the workloads; determining a reliability score and at least one recommendation for a security policy based on the level of entropy; receiving the security policy, the security policy logically describing rules for the relationships between the workloads; determining, based on the security policy and the graph database, a list of violations, the list of violations including at least one relationship from the relationships between the workloads in the graph database, the at least one relationship being not allowed by at least one of the rules in the security policy; and providing the list of violations to a user. ### Claim 12 (depends on 11) The system of claim 11, wherein the graph database is created and updated based on a data concerning the cloud computing environment, the data including at least one of streaming telemetry from network logs, events from a cloud control plane, and inventory from a configuration management database. ### Claim 13 (depends on 11) The system of claim 11, wherein the security policy is a JavaScript Object Notation document. ### Claim 14 (depends on 11) The system of claim 11, wherein the security policy is generated based on a security template, the security template including protected workloads in the cloud computing environment. ### Claim 15 (depends on 11) The system of claim 11, wherein the security policy is created by the user. ### Claim 16 (depends on 11) The system of claim 11, wherein the determining the list of violations includes: traversing the nodes and the edges of the graph database; and while traversing: determining a type of connection between at least two nodes; and determining that the type of connection between the at least two nodes is not permitted by the rules of the security policy. ### Claim 17 (depends on 11) The system of claim 11, wherein the providing the list of violations to the user includes: displaying a visual representation of the nodes and the edges of the graph database, wherein the edges correspond to connections not allowed by the at least one of the rules in the security policy. ### Claim 18 (depends on 17) The system of claim 17, wherein the processor performs the method further comprising: receiving, from the user, a user input indicative of allowing or disallowing the at the least one relationship not allowed by the at least one of the rules of the security policy; and modifying the security policy based on the user input. ### Claim 19 (depends on 18) The system of claim 18, wherein the processor performs the method further comprising: deploying the security policy to the cloud computing environment. ### Claim 20 A non-transitory processor-readable medium having embodied thereon a program being executable by at least one processor to perform a method for validating security policy in a cloud computing environment, the method comprising: providing a graph database, the graph database representing workloads of the cloud computing environment as nodes and relationships between the workloads as edges; determining a level of entropy in the cloud computing environment based on the workloads; determining a reliability score and at least one recommendation for a security policy based on the level of entropy; receiving the security policy, the security policy logically describing rules for the relationships between the workloads; determining, based on the security policy and the graph database, a list of violations, the list of violations including at least one relationship from the relationships between the workloads in the graph database, the at least one relationship being not allowed by at least one of the rules in the security policy; and providing the list of violations to a user.