US 12,003,517 B2 · Enhanced cloud infrastructure security through runtime visibility into deployed software

Abstract

A system retrieves from cloud storage a packet(s) sampled from network traffic detected for software deployed on a cloud instance within a cloud environment. Each packet is inspected with deep packet inspection (DPI) to determine characteristics of the packet from which the identity/type of the corresponding software are determined. The system correlates the data/metadata generated from DPI with data/metadata of other cloud resources of the cloud environment based on determining the cloud resources to which the cloud instance is related or which also support deployment/execution of the software. The correlated data/metadata are evaluated based on security policies which include criteria for characteristics of software running on the cloud infrastructure rather than criteria for cloud infrastructure configuration alone. The system thus determines whether a cloud resource complies with the security policies based at least partly on the types/characteristics of software with which it is correlated.

Claims20

Dependent claims

A method comprising:

determining a first characteristic of software from results of deep packet inspection for a first cloud instance on which the software is deployed within a cloud environment, wherein the deep packet inspection is performed for a first packet destined for the software;
determining other cloud resources of the cloud environment to which the first cloud instance is related;
correlating an indication of the first characteristic of the software with an indication of the first cloud instance and indications of the other cloud resources to generate a set of correlated cloud data;
and
performing cloud infrastructure security monitoring for the cloud environment based on the set of correlated cloud data.

2 more elements

One or more non-transitory machine-readable media having program code stored thereon, the program code comprising instructions to:

indicate a packet detected for a first cloud resource in a cloud environment for deep packet inspection, wherein a cloud application or server software executes on the first cloud resource, and wherein the first cloud resource is a cloud instance;
determine a first characteristic of the cloud application or server software executing on the first cloud resource from results of the deep packet inspection;
determine a second cloud resource in the cloud environment to which the first cloud resource is related;
correlate an indication of the first characteristic with indications of the first and second cloud resources to generate a set of correlated cloud data;
and
perform security monitoring for infrastructure of the cloud environment based on the set of correlated cloud data.

3 more elements

An apparatus comprising:

a processor;
and
a computer-readable medium having instructions stored thereon that are executable by the processor to cause the apparatus to,
determine a first characteristic of software from results of deep packet inspection of at least a first packet sampled from network traffic for a first cloud resource on which the software is deployed within a cloud environment, wherein the first packet is destined for the software, and wherein the first cloud resource is a cloud instance;
determine others of a plurality of cloud resources of the cloud environment to which the first cloud resource is related,
generate a set of correlated cloud data based on correlation of an indication of the first characteristic of the software with an indication of the first cloud resource and indications of the other cloud resources;
and
monitor security of infrastructure of the cloud environment based on the set of correlated cloud data.

5 more elements

Dependencies are inferred from the claim text.

Enhanced cloud infrastructure security through runtime visibility into deployed software

Life of this patent

Enhanced cloud infrastructure security through runtime visibility into deployed software

Life of this patent

Abstract

Claims20