# US 12,003,365 B1 · Configuration change tracking > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,003,365 B1 - Document ID: US12003365B1 - Status: Granted - Kind: B1 - Application number: 16/581,049 - Filed: 2019-09-24 - Granted: 2024-06-04 - Earliest claimed: 2019-09-24 - Assignees: Amazon Technologies, Inc. - Applicants: Amazon Technologies, Inc. - Inventors: Dallas Lamont Willett; Jeremiah C. Wilton; Mostafa Ead; Ming Che Lee - Web page: https://patentgrep.com/patent/US12003365B1 ## CPC - H04L 41/0806: for initial configuration or provisioning, e.g. plug-and-play - G06F 16/9027: {Trees} - H04L 9/0819: {Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) (network architectures or network communication protocols for key distribution in a packet data network H04L63/062)} - H04L 9/0861: {Generation of secret information including derivation or calculation of cryptographic keys or passwords} - H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage} - H04L 9/3247: {involving digital signatures} - H04L 41/0813: characterised by the conditions triggering a change of settings - H04L 67/34: {involving the movement of software or configuration parameters (network booting or remote initial program loading [RIPL] G06F9/4416)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A configuration management system tracks the configuration of a managed computing environment in accordance with a configuration tracking policy. The configuration management system uses the tracking policy to map configuration information from the managed computing environment to a hierarchy of configuration items. Items may be included or excluded from the hierarchy based on relevance to the tracking policy and a predicted amount of dynamism. A signature of the hierarchy is generated. A change to the configuration environment is detected based on a change to the signature, and an action is performed in response to the detected change. ## Claims ### Claim 1 A system, comprising: at least one processor; and a memory comprising computer-executable instructions that, in response to execution by the at least one processor, cause the system at least to: receive configuration data and configuration metadata associated with a computing environment; map the configuration data to items of a hierarchy of configuration items7 based at least in part on the configuration metadata; determine, based at least in part on the configuration metadata and from the items of the hierarchy, a plurality of first items to be relevant to the configuration tracking policy and a plurality of second items to be irrelevant to the configuration tracking policy; generate a plurality of signatures for the plurality of first items of the hierarchy; generate a first signature of the hierarchy based at least in part on the plurality of signatures; identify a change to a configuration of the computing environment, the change detected based at least in part on comparison of the first signature to a second signature; and initiate an action in response to the change to the configuration of the computing environment. ### Claim 2 (depends on 1) The system of claim 1, wherein a configuration item is included in generation of the first signature based at least in part on information indicative of dynamism of the configuration item. ### Claim 3 (depends on 1) The system of claim 1, wherein a configuration item is included in generation of the first signature based at least in part on information indicative of relevance of the configuration item to the configuration tracking policy. ### Claim 4 (depends on 1) The system of claim 1, the memory comprising further computer-executable instructions that, in response to execution by the at least one processor, cause the system at least to: generate a manifest comprising the hierarchy of configuration items and the plurality of signatures. ### Claim 5 (depends on 1) The system of claim 1, wherein an interior node of the hierarchy of configuration items is associated with at least one of an application program, database management system, network, operating system, storage device, or computing device. ### Claim 6 A computer-implemented method, comprising: mapping configuration data associated with a computing environment to a hierarchy of configuration items based at least in part on configuration metadata; determining, using at least the configuration metadata and the configuration items, that a plurality of first configuration items are relevant to a configuration tracking policy and a plurality of second configuration items are irrelevant to the configuration tracking policy; generating a plurality of signatures for the plurality of first configuration items; generating a first signature of the hierarchy of configuration items based at least in part on the plurality of signatures; identifying a change to a configuration of the computing environment, the change detected based at least in part on comparison of the first signature to a second signature; and causing an action to be performed in response to the change to the configuration of the computing environment. ### Claim 7 (depends on 6) The computer-implemented method of claim 6, wherein generating the first signature is based at least in part on information indicative of at least one of dynamism or relevance of one or more of the configuration items. ### Claim 8 (depends on 6) The computer-implemented method of claim 6, further comprising: generating the first signature based at least in part on a cryptographic salt value. ### Claim 9 (depends on 6) The computer-implemented method of claim 6, further comprising: excluding a signature of a configuration item from being generated, the configuration item is indicated by the configuration tracking policy to have at least one of high dynamism or low relevance. ### Claim 10 (depends on 6) The computer-implemented method of claim 6, wherein a configuration item is excluded from the hierarchy of configuration items based at least in part on information indicating that the configuration item has at least one of high dynamism or low relevance. ### Claim 11 (depends on 6) The computer-implemented method of claim 6, further comprising: generating a manifest comprising the hierarchy and the plurality of signatures. ### Claim 12 (depends on 11) The computer-implemented method of claim 11, wherein the manifest is periodically regenerated based at least in part on updated configuration information. ### Claim 13 (depends on 6) The computer-implemented method of claim 6, wherein the action comprises restoring the configuration to be consistent with the configuration tracking policy. ### Claim 14 A non-transitory computer-readable storage medium having stored thereon instructions that, upon execution by one or more computing devices, cause the one or more computing devices at least to: map configuration data associated with a computing environment to a hierarchy of configuration items based at least in part on configuration metadata; determine, based at least in part on the configuration metadata and from the configuration items, a plurality of first configuration items to be relevant to a configuration tracking policy and a plurality of second items to be irrelevant to the configuration tracking policy; compute a plurality of signatures for the plurality of first configuration items; compute a first signature of the hierarchy of configuration items based at least in part on the plurality of signatures; identify a change to a configuration of the computing environment, the change detected based at least in part on comparison of the first signature to a second signature; and initiate an action in response to the change to the configuration of the computing environment. ### Claim 15 (depends on 14) The non-transitory computer-readable storage medium of claim 14, wherein generating the first signature is based at least in part on information indicative of at least one of dynamism or relevance of one or more of the configuration items. ### Claim 16 (depends on 14) The non-transitory computer-readable storage medium of claim 14, wherein the first signature is comparable to another signature based at least in part on the use of a cryptographic salt in the computation of both the first signature and the another signature. ### Claim 17 (depends on 14) The non-transitory computer-readable storage medium of claim 14, comprising further instructions that, upon execution by the one or more computing devices, cause the one or more computing devices to at least: include, in the plurality of signatures, a signature of a configuration item indicated by the configuration tracking policy to have at least one of low dynamism or high relevance to the configuration tracking policy. ### Claim 18 (depends on 14) The non-transitory computer-readable storage medium of claim 14, comprising further instructions that, upon execution by the one or more computing devices, cause the one or more computing devices to at least: generate a manifest comprising the hierarchy and the plurality of signatures. ### Claim 19 (depends on 14) The non-transitory computer-readable storage medium of claim 14, wherein a configuration element is associated with at least one of an application program, database management system, network, operating system, storage device, or computing device. ### Claim 20 (depends on 14) The non-transitory computer-readable storage medium of claim 14, wherein the action comprises restoring the configuration to be consistent with the configuration tracking policy.