# US 12,015,647 B2 · System and method for securing computer infrastructure and devices that depend on cloud platforms > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,015,647 B2 - Document ID: US12015647B2 - Status: Granted - Kind: B2 - Application number: 17/522,412 - Filed: 2021-11-09 - Published: 2022-05-12 - Granted: 2024-06-18 - Earliest claimed: 2020-11-10 - Assignees: Tala Secure, Inc. - Applicants: Tala Secure Inc. - Inventors: Rajesh Kanungo; Raman Rampura Venkatachar; Benjamin R Loomis; Saurav Roy - Web page: https://patentgrep.com/patent/US12015647B2 ## CPC - G06F 16/9024: {Graphs; Linked lists (G06F16/9027 takes precedence)} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - G06F 16/2455: Query execution - G06F 16/9027: {Trees} - G06F 16/906: Clustering; Classification - G06N 20/00: Machine learning - H04L 63/14: {for detecting or protecting against malicious traffic} - H04L 63/0272: {Virtual private networks} - H04L 2463/082: applying multi-factor authentication - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract The embodiment herein provides a system for securing computer infrastructure and one or more devices that depend on one or more cloud platforms. The system includes a memory, and a processor that stores and executes a set of instructions. The processor is configured to (i) extract one or more information data from at least one of the cloud platforms or the devices that depends on the one or more cloud platforms, (ii) execute compliance tests to identify compliance and non-compliance in the one or more information data, (iii) generate a network topology map by querying the one or more information data, (iv) classify a connectivity between the one or more devices and their nature, (v) compute risk metrics, (vi) re-execute the compliance tests to detect changes, and (vii) implement security compliances without impacting a production or operational environment of the one or more cloud platforms. ## Claims ### Claim 1 A system for securing computer infrastructure and one or more devices that depend on one or more cloud platforms, wherein the system comprises, a memory that stores a set of instructions; and a processor that executes the set of instructions, wherein the processor is configured to: extract one or more information data from at least one of the cloud platforms or the one or more devices that depend on the one or more cloud platforms, wherein the one or more information data comprises at least one of system information from the one or more cloud platforms, configuration information, system information from cloud platform associated services, non-cloud infrastructure information, or asset information, wherein the system information from the one or more cloud platforms comprises users, an access right associated with the users, an authentication method associated with the users, groups associated with the users, VPC configuration information and assets contained in the VPC configuration information, wherein the configuration information comprises the VPC configuration information and the assets contained in the VPC configuration, wherein the non-cloud infrastructure information comprises endpoint configuration security information comprising at least one of use of encrypted storage, Virtual Private Network (VPN), 2FA, antivirus checkers, whitelist of applications or traffic monitoring, from the one or more devices, wherein the asset information comprises physical security information using management asset systems; execute compliance tests to identify compliance and non-compliance in the one or more information data; generate a network topology map of the one or more cloud platforms by querying the one or more information data, wherein the querying of the one or more information data comprises (i) identifying an environment with the one or more information data, (ii) creating a tree for the identified environment, and (iii) converting the tree into a directed graph, wherein the directed graph generates the network topology map using a rendering engine; classify, using a machine learning model, a connectivity between the one or more devices and their nature with at least one of logs, fire-wall rules, Virtual Private Cloud (VPC) accesses, or a cloud storage level logs and object level access logs, extracted from the one or more information data, wherein the machine learning model is configured to (i) record the connectivity between the one or more devices that are consolidated under the one or more cloud platforms and (ii) analyse the records to determine which endpoints of the one or more devices that are in connectivity with each other; compute, using the machine learning model, risk metrics based on at least one of the network topology map, software running on the computer infrastructure or the one or more devices that depend on the one or more cloud platforms, the connectivity between the one or more devices or criticality of the asset information; re-execute the compliance tests to detect changes in the identified compliance in the one or more information data; and implement security compliances without impacting a production or operational environment of the one or more cloud platforms when there is a change in the compliance in the one or more information data, for securing the computer infrastructure and the one or more devices that depend on the one or more cloud platforms. ### Claim 2 (depends on 1) The system of claim 1, wherein the processor is configured to: determine at least one of logging systems, monitoring systems, protections systems, virus checkers, incidence response systems, backup systems, recovery systems that are present for each and every asset in the one or more cloud platforms before executing the compliance tests. ### Claim 3 (depends on 1) The system of claim 1, wherein the compliance tests comprise executing of compliance rules in the one or more information data, wherein the compliance rules comprise at least one of AWS security rules or third-party security rules. ### Claim 4 (depends on 1) The system of claim 1, wherein the processor is configured to: identify missing controls in the one or more cloud platforms, wherein the missing controls comprise at least one of a missing 2-factor authentication or a use of VPN for management; and provide information of the missing controls to a user. ### Claim 5 (depends on 1) The system of claim 1, wherein the processor is configured to enable addition of meta-information that enables the user to include the meta-information after generating the network topology map of the one or more cloud platforms, wherein the meta-information comprises at least one of criticality of resources, links to disaster recovery plans, incidence response plans, business continuity importance, or results of penetration tests. ### Claim 6 (depends on 1) The system of claim 1, wherein the processor is configured to: implement the security compliances as a regular scheduled check for the compliance and security; and generate reports when there is the regular scheduled check or when there is the change in the compliance. ### Claim 7 (depends on 1) The system of claim 1, wherein the processor is configured to: generate the report in a machine-readable report format that enables exchange of information between the one or more devices with verification of compliance between different devices. ### Claim 8 A method for securing computer infrastructure and one or more devices that depend on one or more cloud platforms, wherein the method comprises, extracting one or more information data from at least one of the cloud platforms or the one or more devices that depend on the one or more cloud platforms, wherein the one or more information data comprises at least one of system information from the one or more cloud platforms, configuration information, system information from cloud platform associated services, non-cloud infrastructure information or asset information, wherein the system information from the one or more cloud platforms comprises users, an access right associated with the users, an authentication method associated with the users, groups associated with the users, VPC configuration information and assets contained in the VPC configuration information, wherein the configuration information comprises the VPC configuration information and the assets contained in the VPC configuration, wherein the non-cloud infrastructure information comprises endpoint configuration security information comprising at least one of use of encrypted storage, Virtual Private Network (VPN), 2FA, antivirus checkers, whitelist of applications or traffic monitoring, from the one or more devices, wherein the asset information comprises physical security information using management asset systems; executing compliance tests to identify compliance and non-compliance in the one or more information data; generating a network topology map of the one or more cloud platforms by querying the one or more information data, wherein the querying of the one or more information data comprises (i) identifying an environment with the one or more information data, (ii) creating a tree for the identified environment, and (iii) converting the tree into a directed graph, wherein the directed graph generates the network topology map using a rendering engine; classifying, using a machine learning model, a connectivity between the one or more devices and their nature with at least one of logs, fire-wall rules, Virtual Private Cloud (VPC) accesses, or a cloud storage level logs and object level access logs, extracted from the one or more information data, wherein the machine learning model is configured to (i) record the connectivity between the one or more devices that are consolidated under the one or more cloud platforms and (ii) analyse the records to determine which endpoints of the one or more devices that are in connectivity with each other; computing, using the machine learning model, risk metrics based on at least one of the network topology map, software running on the computer infrastructure or the one or more devices that depend on the one or more cloud platforms, the connectivity between the one or more devices or criticality of the asset information; re-executing the compliance tests to detect changes in the identified compliance in the one or more information data; and implementing security compliances without impacting a production or operational environment of the one or more cloud platforms when there is a change in the compliance in the one or more information data, for securing the computer infrastructure and the one or more devices that depend on the one or more cloud platforms. ### Claim 9 (depends on 8) The method of claim 8, wherein the method comprises determining any logging, monitoring, protections, virus checkers, incidence response systems, backup, recovery system for each and every asset in the one or more cloud platforms before executing the compliance tests. ### Claim 10 (depends on 8) The method of claim 8, wherein the compliance tests comprise executing of compliance rules in the one or more information data, wherein the compliance rules comprise at least one of AWS security rules or third-party security rules. ### Claim 11 (depends on 8) The method of claim 8, wherein the method comprises identifying missing controls in the one or more cloud platforms, wherein the missing controls comprise at least one of a missing 2-factor authentication or a use of VPN for management; and providing information of the missing controls to a user. ### Claim 12 (depends on 8) The method of claim 8, wherein the method comprises enabling addition of meta-information that enables the user to include the meta-information after generating the network topology map of the one or more cloud platforms, wherein the meta-information comprises at least one of criticality of resources, links to disaster recovery plans, incidence response plans, business continuity importance, or results of penetration tests. ### Claim 13 (depends on 8) The method of claim 8, wherein the method comprises implementing the security compliances as a regular scheduled check for the compliance and security; and generating reports when there is the regular scheduled check or when there is the change in the compliance. ### Claim 14 (depends on 8) The method of claim 8, wherein the method comprises generating the report in a machine-readable report format that enables exchange of information between the one or more devices with verification of compliance between different devices.