KR102164915B1 - System for generating security topology of cloud computing - Google Patents

Abstract

The present invention relates to a cloud security topology generation system, which includes: an API communication unit for collecting an application programming interface (API) for one virtual private cloud (VPC) corresponding to a first user account by collecting API communication with a cloud service provider system; an information classification unit that analyzes an API for one VPC collected through the API communication unit and classifies information included in the API into VPC configuration information and security policy information; a VPC configuration analysis unit that analyzes the VPC configuration information to identify objects constituting a corresponding VPC, and determines a relationship between the objects; a basic topology configuration unit that generates a basic security topology expressing objects constituting a VPC and a relationship between the objects by using information on the relationship between the objects analyzed by the VPC configuration analysis unit; a security policy analysis unit that interworks with the VPC configuration analysis unit to identify objects constituting the corresponding VPC, and analyzes the security policy information applied to the corresponding VPC to determine a network connection state between objects, and whether security policies collide each other and policies are duplicated for each virtual server; a connection topology construction unit that processes and resolves collision of security policies and duplication of policies for each virtual server according to set priorities of security policies, and generates a final security topology by displaying the network connection state between objects on the basic security topology; and an output unit that transmits the final security topology to the outside.

Description

Cloud security topology creation system {SYSTEM FOR GENERATING SECURITY TOPOLOGY OF CLOUD COMPUTING}

The present invention relates to a system for generating a security topology for a VPC (Virtual Private Cloud) in a cloud computing environment and displaying it on a computer or mobile device.

Cloud computing is in the spotlight because it allows companies to secure as many IT resources as they want without additional investment. Currently, representative companies that provide cloud computing include Amazon, Microsoft, Google, and Oracle.Amazon is AWS (Amazon Web Services), Google is GCP (Google Cloud Platform), Microsoft is Azure, and Oracle is OCI (Oracle Cloud). Infrastructure), it provides a cloud computing service.

Such cloud computing is a very flexible logical system or service that can be created with just a click through a computer by an administrator by developing and providing most of the existing physical environments as logical environments. Therefore, anyone can easily access it, and it is easy to create, modify, or delete virtual servers.

However, if this environment is reversed by sudden creation, deletion, or modification of a virtual server, and security or operational problems occur, it is difficult for an administrator to check and respond in real time, and it contains several security vulnerabilities.

In addition, cloud computing requires complex settings due to the nature of the logical infrastructure, and it is difficult for administrators to operate easily because the contents are organized using text and tables, and thus, it is difficult to operate. It occurs and can also cause security incidents.

In order to solve this problem, companies that have built a Virtual Private Cloud (VPC) through cloud computing have created a topology for the VPC to prevent configuration errors or security incidents.

However, currently, the topology for the VPC is manually created by experts, so it takes a long time to work, it is difficult to verify the created topology, and it is difficult to modify the created topology when objects or security policies in the VPC are changed. there is a problem.

The problem to be solved by the present invention is a cloud security topology generation system that allows administrators to intuitively recognize the situation and respond quickly and accurately by visualizing connectivity and policies between security devices such as cloud virtual servers, virtual network devices, and firewalls, and showing them in topology. Is to provide.

The technical problem to be achieved by this embodiment is not limited to the technical problem as described above, and other technical problems may be inferred from the following embodiments.

The present invention according to an embodiment for solving the above problem is an API communication unit that collects an API for one VPC (Virtual Private Cloud) corresponding to a first user account by collecting API (Application Programming Interface) communication with a cloud provider system , An information classification unit that analyzes the API for one VPC collected through the API communication unit and classifies the information included in the API into VPC configuration information and security policy information, and an object constituting the VPC by analyzing the VPC configuration information A basic security topology that expresses the objects constituting the VPC and the relationship between the objects using information on the relationship between the objects and the VPC configuration analysis unit that identifies them and understands the relationship between objects, and the relationship between the objects analyzed by the VPC configuration analysis unit. By interworking with the topology configuration unit and the VPC configuration analysis unit, the objects constituting the VPC are identified, and the security policy information applied to the corresponding VPC is analyzed to determine whether the network connection status between the objects and the security policy for each virtual server conflict and whether or not there is a policy overlap. Receives the security policy analysis unit to be identified, the analysis result analyzed by the security policy analysis unit, and information on the collision of security policies for each virtual server and whether or not the policy is overlapped, and uses this to refer to one virtual server for each virtual server. By verifying whether or not to allow/deny inbound and outbound traffic with all other virtual servers, the individual network connection information of each virtual server is identified, and the final security topology by displaying the individual network connection information for each virtual server on the basic security topology. It provides a cloud security topology generation system including a connection topology configuration unit to generate and an output unit for transmitting the final security topology to the outside.

The security policy analysis unit analyzes each network ACL included in the VPC to determine the network connection information for each subnet connected to the corresponding network ACL, and participates as a member of each security group by analyzing the security policy of each security group. An SG analysis unit that checks the network connection information for each of all virtual servers, and an error analysis that identifies the conflict of security policies for each virtual server and whether the policy overlaps by comparing the analysis result of the NACL analysis unit with the analysis result of the SG analysis unit May contain wealth.

The security policy analysis unit may further include a HFW (Host FireWall) analysis unit that analyzes the security policy set in each virtual server to determine network connection information for the corresponding virtual server. In this case, the error analysis unit is the NACL By comparing the analysis results of the analysis unit, the SG analysis unit, and the HFW analysis unit, it is possible to determine whether or not there is a conflict of a security policy for each virtual server and a policy overlap.

The connection topology configuration unit can resolve the conflict of security policy and overlapping of security policy by making the security policy of the network ACL the highest priority when receiving information about the conflict of security policy for each virtual server and whether or not the policy is duplicated. .

The connection topology configuration unit sets the security policy of the network ACL as the highest priority and the security policy set in the virtual server itself as the lowest priority when receiving information on the collision of each virtual server security policy and whether or not the policy is duplicated. Thus, the conflict of the security policy and the overlapping of the security policy can be solved.

According to an embodiment of the present invention, the present invention automatically creates a security topology for a VPC of a specific company, and when a security policy or a new object is created/deleted, it is immediately reflected in the security topology so that a new security topology can be created. .

In addition, according to an embodiment of the present invention, it is possible to check network connection information through a security topology, and to check connection (blocking, permission) from a security point of view.

1 and 2 are diagrams showing the configuration of a general cloud computing network.
3 is a diagram showing a network environment of a cloud security topology generation system according to an embodiment of the present invention.
4 is a block diagram of a cloud security topology generation system according to an embodiment of the present invention.
5 is an internal block diagram of a security policy analysis unit in a cloud security topology generation system according to an embodiment of the present invention.
6 is a flow chart showing a method of generating a cloud security topology according to an embodiment of the present invention.
7 is a view for explaining a verification operation for identifying individual network connection information according to an embodiment of the present invention.
8 is a flow chart showing a verification operation performed in the traffic environment of FIG. 7.
9 is a diagram of a basic security topology showing a VPC structure according to an embodiment of the present invention.
10 is a diagram of a security topology in which a VPC structure and a network connection are displayed together according to an embodiment of the present invention.

In the following, some embodiments will be described clearly and in detail with reference to the accompanying drawings so that those with ordinary knowledge in the technical field to which the present invention pertains (hereinafter, ordinary technicians) can easily implement the present invention. will be. In addition, the term "unit" used in the specification may mean a hardware component or circuit.

Hereinafter, a cloud security topology generation system according to an embodiment of the present invention will be described with reference to the accompanying drawings.

1 and 2 are diagrams showing the configuration of a general cloud computing network, taking Amazon's cloud network as an example. In addition, the cloud network of FIG. 2 is a single Availability Zone (AZ) VPC as an example.

1 and 2, a cloud computing network provided by a cloud provider is divided into a plurality of regions 10, and each of the plurality of regions 10 includes a plurality of Availability Zones (AZs) ( 20). Here, the number of available areas 20 currently included in one area 10 is about three at most.

In addition, each of the plurality of available service areas 20 includes a plurality of VPCs 30.

Each VPC 30 has a gateway 31 for communication with the outside, a network access control list (ACL) 32, a plurality of subnets 33 having a plurality of virtual servers 331, and the same security policy. The branch includes a plurality of security groups (SG) 34 for managing the virtual server as a group. Here, the network ACL (NACL) is a firewall in charge of security for a subnet, and the security group is a firewall applied to virtual servers having the same security policy.

Each of the plurality of VPCs 30 may have the same structure, but most of them have a different structure. Here, the structure of the VPC 30 means the number of objects constituting the VPC 30, a relationship between the objects, and the like.

Objects in the VPC 30 structure are devices and security policies that make up the VPC 30, such as gateways, network ACLs, subnets, virtual servers, and security groups, and the relationship between the objects is a subnet held by one VPC 30 ( 33), the number of virtual servers 331 in each subnet 33, the number of security groups 34, identification of what security groups each virtual server participates in, different objects based on each subnet Network connection relationship with and, network connection relationship with other objects based on each virtual server.

Here, in general, a member of a cloud provider, that is, a company creates and uses at least one VPC. In the present invention, a security topology is created based on one VPC, and if a company has two VPCs, a security topology for each of the two VPCs is created.

Hereinafter, a cloud security topology generation system according to an embodiment of the present invention will be described with reference to FIGS. 3 to 8.

3 is a diagram showing a network environment of a cloud security topology generation system according to an embodiment of the present invention. Referring to FIG. 3, a cloud security topology generation system 100 according to an embodiment of the present invention includes a cloud operator system 200 and an API (Application Programming Interface) operated for cloud computing services by Amazon, Google, Microsoft, or Oracle. ) Collects API information for one VPC by performing communication. Here, API communication is a generic term for a communication method for obtaining API information.

The cloud security topology creation system 100 according to an embodiment of the present invention creates a security topology for a corresponding VPC by using the collected API information of the VPC, and uses the generated security topology into a user terminal 300 equipped with a web browser. To provide. The user terminal 300 may be a desktop, a laptop computer, or a mobile device.

The cloud security topology generation system will be described in more detail with reference to FIG. 4. 4 is a block diagram of a cloud security topology generation system according to an embodiment of the present invention.

Referring to FIG. 4, the cloud security topology generation system 100 according to an embodiment of the present invention includes an API communication unit 110, an information classification unit 120, a VPC configuration analysis unit 130, and a security policy analysis unit 140. , A basic topology configuration unit 140, a connection topology configuration unit 160, and an output unit 170. In addition, the cloud security topology generation system 100 according to an exemplary embodiment of the present invention has a memory for storing data, but is omitted for convenience of description.

The API communication unit 110 performs API communication with the cloud service provider system 200 to collect an API for one VPC corresponding to the first user account. The first user account is identification information for access and authentication provided to a member from the cloud service provider system 200. The API for one VPC includes cloud account information, cloud server information, asset information including network affiliation information, cloud firewall type and policy information of each firewall, and policy information including policy information of each security group, belonging to the VPC. Auto, network information including region and availability zone, VPC identification information, identification information of each subnet included in the VPC, identification information of virtual servers included in each subnet, and information about automatically generated virtual servers. It includes scaling information and the like.

The information classification unit 120 analyzes the API for one VPC collected through the API communication unit 110 and converts the information included in the API into information on the VPC configuration (hereinafter referred to as'VPC configuration information') and security policy. Information (hereinafter referred to as'security policy information'). VPC configuration information is network information including cloud account information, asset information including cloud server information and network belonging information, identification information of each subnet included in the VPC, identification information of virtual servers included in each subnet, etc. And auto-scaling information, which is information on automatically generated virtual servers.

The security policy information is information on the security policy of the firewall applied to the corresponding VPC, and includes policy information of network ACLs and policy information including policy information of each security group. In addition, the security policy information may further include a security policy of HFW (Host FireWall). HFW is a firewall applied to one virtual server, and it is a firewall held for each virtual server.

The VPC configuration analysis unit 130 analyzes the VPC configuration information to identify objects constituting the corresponding VPC, and determines the relationship between the objects. By the VPC configuration analysis unit 130, the number of subnets 33 owned by the VPC, the number of virtual servers 331 in each subnet 33, the number of security groups 34, security in which each virtual server participates Identification of what the group is, etc. are identified.

The security policy analysis unit 140 interlocks with the VPC configuration analysis unit 130 to identify objects constituting a corresponding VPC, and analyzes security policy information to determine a network connection state between the objects.

A detailed operation of the security policy analysis unit 140 will be described with reference to FIG. 5.

5 is an internal block diagram of the security policy analysis unit 140 in the cloud security topology generation system according to an embodiment of the present invention. Referring to FIG. 5, the security policy analysis unit 140 includes a network access control list (NACL) analysis unit 141, a security group (SG) analysis unit 142, an HFW analysis unit 143, and an error analysis. Includes part 144.

The NACL analysis unit 141 analyzes each network ACL included in the VPC (refer to Fig. 5 (a)) to determine network connection information for each of all subnets, that is, inbound and outbound traffic allow or/and denial rules. , Provides the determined network connection information to the error analysis unit 144 and the connection topology configuration unit 160. Here, the network ACL includes ordered rules that allow or deny traffic according to IP protocol, service port, and/or source/destination IP address.

The SG analysis unit 142 analyzes the security policy of each security group (SG) (see Fig. 5(b)), and network connection information for each of all virtual servers participating as members of each security group (SG), that is, Inbound and outbound traffic allow or/and reject rules are identified, and the determined network connection information is provided to the error analysis unit 144 and the connection topology configuration unit 160. The security policy of the security group (SG) includes sorted rules that allow or deny traffic according to IP protocol, service port, and/or source/destination IP address.

The HFW analysis unit 143 analyzes the HFW security policy of each virtual server (see Fig. 5(c)) to identify network connection information for the virtual server, that is, inbound and outbound traffic allow or/and reject rules And, the determined network connection information is provided to the error analysis unit 144 and the connection topology configuration unit 160. Each virtual server's HFW security policy includes sorted rules that allow or deny traffic according to IP protocol, service port, and/or source/destination IP address. HFW analysis unit 143 can be omitted by the manufacturer.

The error analysis unit 144 allows inbound and outbound traffic of each subnet determined by the NACL analysis unit 141 or/and rejection rules and inbound and outbound traffic of each virtual server analyzed by the SG analysis unit 142 or Analyzes / and rejection rules to determine whether security policy conflicts and policy overlaps for each subnet and virtual server. In addition, when additionally using the HFW security policy, the error analysis unit 144 provides security for each subnet and virtual server through the analysis results of the NACL analysis unit 141, SG analysis unit 142, and HFW analysis unit 143. Conflicts of policies and policy duplication are identified, and the result of the determination is provided to the connection topology configuration unit 160. Meanwhile, the error analysis unit 144 may display a result of the identified collision and overlap on the screen at the request of the user.

The basic topology configuration unit 140 constructs and creates a basic topology using information on the relationship between objects constituting the VPC analyzed by the VPC configuration analysis unit 130 and stores it in memory. An example of a basic topology generated by the basic topology construction unit 140 is shown in FIG. 9.

9 is a diagram for a basic security topology showing a VPC structure according to an exemplary embodiment of the present invention, taking a multi-availability zone VPC as an example. Referring to FIG. 7, a basic security topology is created for one VPC 30 and displays a plurality of subnets 33 included in one VPC 30. In addition, among the plurality of subnets 33, the weighted area 20 is divided and displayed.

In addition, the number of virtual servers 331 included in each subnet 33 is displayed. Of course, when the number of virtual servers 331 included in one subnet 33 is large, an enlargement function may be added so that when the corresponding subnet 33 is clicked, it is enlarged and displayed on the full screen. In addition, the box areas marked A, B, and C in each subnet 33 represent virtual servers of the same security group. In addition, the box area marked AS in the subnet 33 indicates that the virtual server 331 included in the corresponding box area AS is a virtual server group created by autoscaling.

Next, the connection topology configuration unit 160 receives the basic security topology generated by the basic topology configuration unit 150, and the analysis result analyzed by the security policy analysis unit 140 and the security policy for each virtual server 331 are It receives information on collision and policy duplication, and uses it to verify whether inbound and outbound traffic is allowed/denied with all other virtual servers on the basis of one virtual server for each virtual server. In addition, the connection topology configuration unit 160 stores network connection information (hereinafter referred to as'individual network connection information') of each virtual server including whether to allow/reject inbound and outbound traffic to one virtual server through the verification. It identifies and creates a final security topology that displays individual network connection information for each virtual server on the basic security topology. The resulting security topology is stored in the memory and provided to the user terminal 300 through the output unit 180.

Here, when the connection topology configuration unit 160 receives information on the collision of the security policy for each virtual server 331 and information on whether or not the policy is duplicated, the security policy of the network ACL is the highest priority for inbound traffic. Conflicts and duplication of policies are resolved, and conflicts and duplication of security policies of the security policy security group are resolved by making HFW's security policy the highest priority for outbound traffic. Of course, if HFW's security policy is not used, the security group's security policy is the highest priority for outbound traffic.

Meanwhile, when an error in a security policy is found when determining network connection information for each virtual server, the connection portal configuration unit 160 may inform the error analysis unit 144 of the found error.

An example of the final security topology generated by the connection topology construction unit 160 is shown in FIG. 10. 10 is a diagram of a security topology in which a VPC structure and a network connection are displayed together according to an embodiment of the present invention. 10 shows the same basic security topology as the basic security topology shown in FIG. 9, and accordingly, reference numerals are omitted.

Referring to FIG. 10, when one virtual server 331 is clicked, a network connection information screen window A10 in which individual network connection information for the corresponding virtual server 331 is displayed is displayed. In the network connection information window (A10), individual network connection information for the virtual server 331, that is, the number of inbound and outbound traffic, allow or deny for each traffic, protocol, port, source, and check mark are displayed. have. Four traffics including No. 1, No. 2, and No. 3 are displayed on the screen A10 of FIG. 10.

And if you click the'check' mark for No. 1 in the screen window, screen No. 4 is displayed, and the verification of traffic No. 1 starts, and the HFW, security group, and network ACL related to the virtual server 331 are set to the security policy. Is verified, and if all security policies of the selected virtual server 331 are normal, the network connection line 1-1 is displayed. Here, the traffic verification operation according to the click of the check mark may be omitted.

In the 4th screen,'Result' is displayed as'normal' if any one of several interfaces is successful according to the policy verification logic, and'blocked' if the set security policy is not able to communicate, and various ports and sources (targets) If some of them are successful, they are marked as'partial', and if the policy is for an IP that does not exist in the VPC (if the policy is meaningless because communication is impossible), it is marked as'review.

If the'Result' item is displayed as'Blocked' on screen 4, the reason is described in the'Blocked Reason' item.

Finally, the output unit 180 is a means for transmitting the final security topology to the user terminal 300, and may be, for example, a wired or wireless communication module.

Hereinafter, a cloud security topology generation method according to an embodiment of the present invention will be described with reference to FIGS. 6 to 8. 6 is a flow chart showing a method of generating a cloud security topology according to an embodiment of the present invention.

The security topology generation system 100 accesses the cloud operator system 200 (S601), provides account information of the A operator (S602), and receives an API corresponding to the account information of the A operator (S603).

The security topology creation system 100 classifies the information on the VPC of the first provider included in the API into VPC configuration information and security policy information (S604), and uses the VPC configuration information to form objects and each object. The relationship between them is determined (S605).

In addition, the security topology creation system 100 generates a basic security topology by using the objects constituting the VPC and the relationship between the objects (S606).

The security topology generation system 100 analyzes the security policy of the network ACL to determine the network connection information of the subnet, and analyzes the security policy of the security group to determine the network connection information of each virtual server for each security group (S607).

In addition, the security topology generation system 100 compares and analyzes the security policy of the ACL and the network connection information of the security group of the security group to identify traffic collisions or overlaps (S608).

The security topology generation system 100 verifies whether to allow or block traffic with all other virtual servers based on one virtual server by using the information identified through the S607 process and S608 process to connect an individual network to one virtual server. The information is grasped (S609).

Then, the security topology generation system 100 generates a final security topology by reflecting the individual network connection information to the basic security topology (S610).

Hereinafter, a verification operation for generating individual network connection information performed by the connection topology configuration unit 160 will be described with reference to FIGS. 7 and 8.

7 is a diagram for explaining a verification operation for identifying individual network connection information according to an embodiment of the present invention, and is a diagram illustrating an example of identifying individual network connection information of a first virtual server.

The connection topology configuration unit 160 identifies individual network connection information for all virtual servers in one VPC, and reflects the identified individual network connection information to the basic security topology.

The method of identifying (verifying) individual network connection information is to determine whether traffic between the target virtual server (referred to as the target virtual server) and the other virtual server is allowed or blocked, and then the target virtual server and the other Whether or not traffic is allowed or blocked between virtual servers of is determined, and this process is repeated until it is determined whether or not traffic is allowed to be blocked between the target virtual server and all other virtual servers.

And when the identification of individual network connection information for one target virtual server is completed, another virtual server is set as the target virtual server and the verification process is repeated. This verification process is repeated until all virtual servers are configured as target servers.

An example of such a verification process will be described with reference to FIGS. 7 and 8.

Referring to FIG. 7, in the process of whether to block or allow traffic from the first virtual server to the second virtual server, the first virtual server becomes the target virtual server. At this time, the traffic from the first virtual server to the second virtual server reflects the outbound entry to the first virtual server and the inbound entry to the second virtual server at the same time.

Referring to FIG. 8, the connection topology configuration unit 160 sets a first virtual server as a target virtual server and starts verifying individual network connection information for the first virtual server (S801).

First, the connection topology configuration unit 160 determines the security policy of the first security group to which the first virtual server belongs (S802), and determines whether outbound traffic to the second virtual server is allowed (S803). If the traffic is blocked, the connection topology configuration unit 160 determines that the traffic from the first virtual server to the second virtual server is blocked, and ends verification of the second virtual server.

On the other hand, if traffic is allowed, the connection topology configuration unit 160 determines the security policy of the first NACL (network ACL) having the security policy of the first subnet to which the first virtual server belongs (S804), and the second virtual server It is determined whether outbound traffic to the second subnet belongs to is allowed (S805).

If the traffic to the second subnet is blocked, the connection topology configuration unit 160 terminates the verification, and if the traffic to the second subnet is allowed, it determines the security policy of the second NACL having the security policy of the second subnet ( S806). In addition, the connection topology configuration unit 160 determines whether inbound traffic transmitted from the first subnet to the second subnet is allowed or blocked (S807).

If the inbound traffic to the first subnet is blocked, the connection topology configuration unit 160 ends the verification, and if allowed, determines the security policy of the second security group to which the second virtual server belongs (S808), and from the first virtual server. It is determined whether the transmitted inbound traffic is allowed or blocked (S809).

In the determination of step S809, the connection topology configuration unit 160 terminates the verification if it is blocked, and if it is connected, determines that the network connection between the first virtual server and the second virtual server is successful (S810).

The above description is intended to provide exemplary configurations and operations for implementing the present invention. The technical idea of the present invention will include not only the embodiments described above, but also implementations that can be obtained by simply changing or modifying the above embodiments. In addition, the technical idea of the present invention will also include implementations that can be achieved by easily changing or modifying the embodiments described above.

100: security topology generation system 200: cloud operator system
300: user terminal 110: API communication unit
120: information classification unit 130: VPC configuration analysis unit
140: security policy analysis unit 150: basic topology configuration unit
160: connection topology configuration unit 170: output unit
141: NACL analysis unit 142: SG analysis unit
143: HFW analysis unit 144: Error analysis unit
10: region 20: available area (AZ)
30: VPC 31: gateway
32: network ACL 33: subnet
34: security group 331: virtual server

Claims (5)

An API communication unit that collects API (Application Programming Interface) communication with the cloud service provider system and collects API for one VPC (Virtual Private Cloud) corresponding to the first user account,
An information classification unit that analyzes the API for one VPC collected through the API communication unit and classifies the information included in the API into VPC configuration information and security policy information,
A VPC configuration analysis unit that analyzes the VPC configuration information to identify objects constituting the corresponding VPC, and identifies the relationship between the objects,
A basic topology configuration unit that creates a basic security topology expressing the relationship between objects and objects constituting a VPC using information on the relationship between objects analyzed by the VPC configuration analysis unit,
A security policy that identifies the objects constituting the VPC by interworking with the VPC configuration analysis unit, and analyzes the security policy information applied to the VPC to determine whether the network connection status between objects and the security policy for each virtual server conflict and whether or not there is a policy overlap Analysis Department,
Receives the analysis result analyzed by the security policy analysis unit and information on the collision of security policies for each virtual server and whether or not the policy is duplicated, and uses this to interact with all other virtual servers based on one virtual server for each virtual server. A connection topology configuration unit that verifies whether inbound and outbound traffic is allowed/denied, identifies individual network connection information of each virtual server, and creates a final security topology that displays individual network connection information for each virtual server on the basic security topology, And
Cloud security topology generation system comprising an output unit for transmitting the final security topology to the outside. In claim 1,
The security policy analysis unit,
NACL analysis unit that analyzes each network ACL included in the VPC to determine network connection information for each subnet connected to the corresponding network ACL,
An SG analysis unit that analyzes the security policy of each security group and identifies the network connection information for each of the virtual servers participating as members of each security group
Cloud security topology generation system comprising an error analysis unit for comparing the analysis result of the NACL analysis unit and the analysis result of the SG analysis unit to determine whether the security policy conflict and policy overlap for each virtual server. In paragraph 2,
The security policy analysis unit,
Further comprising an HFW (Host FireWall) analysis unit that analyzes the security policy set in each virtual server itself and identifies network connection information for the corresponding virtual server,
In this case, the error analysis unit compares the analysis results of the NACL analysis unit, the SG analysis unit, and the HFW analysis unit to determine whether a security policy conflict or overlapping policy for each virtual server is identified. In paragraph 2,
The connection topology configuration unit sets the security policy of the network ACL as the highest priority when receiving information on the conflict of security policies for each virtual server and whether or not the policies are duplicated, and a cloud security that resolves the conflict of security policies and the overlap of security policies. Topology generation system. In paragraph 3,
The connection topology configuration unit sets the security policy of the network ACL with the highest priority and the security policy set in the virtual server with the lowest priority when receiving information on the collision of the security policy for each virtual server and whether the policy is duplicated. A cloud security topology creation system that solves the conflict of the security policy and the overlapping of the security policy.

Images