Granted Patent B2

US 12,388,847 · App. 18/195,290 · Granted Aug 12, 2025

Inventors: Ravishankar Ganesh Ithal (Los Altos, CA); Yang Zhang (Los Altos, CA)

Assignee: Normalyze, Inc.

H04L63/1416G06F9/451G06F16/211G06F16/24569G06F16/355G06F16/95G06F21/577G06F21/6227H04L63/083H04L63/102H04L63/104H04L63/1433H04L63/18H04L63/205G06F2221/034G06F2221/2141

Abstract

Claims (76)

1. A computer-implemented method for analyzing data posture in a cloud environment, the computer-implemented method comprising:

receiving a request to analyze a data posture of a database in the cloud environment, wherein the database includes a user access credential configured to provide user access to the database;

in response to the request to analyze the data posture of the database, identifying a location of a snapshot of the database, and accessing, using a cloud environment role corresponding to the cloud environment, the location of the snapshot;

performing data posture analysis using data of the snapshot to obtain an indication of a structure of schema objects in the database; and

generating a representation of a user interface display that represents the data posture of the database based on the data posture analysis performed on data of the snapshot.

2. The computer-implemented method of claim 1 , wherein

the database comprises a first database,

the snapshot comprises a first snapshot of the first database,

the user access credential comprises a first user access credential, and

the computer-implemented method further comprises:

receiving a request to analyze a data posture of a second database in the cloud environment, wherein the second database includes a second user access credential configured to provide user access to the second database;

accessing, using the cloud environment role, a location of a second snapshot of the second database; and

performing data posture analysis using data of the second snapshot to obtain an indication of a structure of schema objects in the second database.

3. The computer-implemented method of claim 1 , and further comprising:

tracing network communication paths between pairs of compute resources in the cloud environment and storage resources corresponding to the database;

qualifying a subset of the pairs of the compute resources and the storage resources as vulnerable to breach attack based on the data posture analysis; and

generating a representation of propagation of the breach attack along the network communication paths, the representation of propagation of the breach attack identifying relationships between the subset of the pairs of the compute resources and the storage resources.

4. The computer-implemented method of claim 2 , and further comprising:

discovering the first and second snapshots using a cloud provider application programming interface (API); and

accessing each of the first and second snapshots through the cloud provider API.

5. The computer-implemented method of claim 2 , wherein performing the data posture analysis comprises:

obtaining metadata representing a structure of schema objects in at least one of the first database or the second database; and

based on the metadata, executing a content-based data classifier to classify data items in the schema objects.

6. The computer-implemented method of claim 5 , and further comprising:

based on the metadata, executing a content-based data classifier that analyzes content of data items in the schema objects by comparing the data items to predefined target data profiles and generates a classifier result that classifies the data items based on the content.

7. The computer-implemented method of claim 1 ,

wherein performing the data posture analysis using data of the snapshot comprises:

generating a separate representation of the first database, that is separate from the database, using the snapshot, and

scanning the representation of the first database.

8. The computer-implemented method of claim 2 , wherein the first and second snapshots comprise read-only point-in-time copies of the first and second databases, respectively.

9. The computer-implemented method of claim 7 , wherein

the database is stored on a first server in the cloud environment,

generating the separate representation of the database comprises recreating the database on a second server using the snapshot, and

scanning the separate representation of the database comprises scanning the recreated database on the second server.

10. The computer-implemented method of claim 1 , wherein the user access credential comprises secret data corresponding to a user associated with the database, and the cloud environment role comprises a cloud provider role, and the snapshot comprise a read-only point-in-time copy of the database.

11. A computing system comprising:

at least one processor; and

memory storing instructions executable by the at least one processor, wherein the instructions, when executed, cause the computing system to:

receive a request to analyze a data posture of a database in a cloud environment, wherein the database includes a user access credential configured to provide user access to the database;

in response to the request to analyze the data posture of the database,

perform data posture analysis on a representation that is separate from the database, wherein the data posture analysis is configured to:

access, using a cloud environment role corresponding to the cloud environment, a snapshot of the database;

obtain the representation based on the snapshot; and

identify a structure of schema objects in the database based on the representation; and

generate a representation of a user interface display that represents the data posture of the database based on the identified structure of schema objects.

12. The computing system of claim 11 , wherein

the database comprises a first database,

the snapshot comprises a first snapshot of the first database,

the user access credential comprises a first user access credential, and

the instructions, when executed, cause the computing system to:

receive a request to analyze a data posture of a second database in the cloud environment, wherein the second database includes a second user access credential configured to provide user access to the second database;

access, using the cloud environment role, a location of a second snapshot of the second database; and

perform data posture analysis using data of the second snapshot to obtain an indication of a structure of schema objects in the second database.

13. The computing system of claim 12 , wherein the instructions, when executed, cause the computing system to:

discover the first and second snapshots using a cloud provider application programming interface (API); and

access each of the first and second snapshots through the cloud provider API.

14. The computing system of claim 12 , wherein the instructions, when executed, cause the computing system to:

obtain metadata representing a structure of schema objects in at least one of the first database or the second database; and

based on the metadata, execute a content-based data classifier to classify data items in the schema objects.

15. The computing system of claim 14 , wherein the instructions, when executed, cause the computing system to:

based on the metadata, execute a content-based data classifier that analyzes content of data items in the schema objects by comparing the data items to predefined target data profiles and generates a classifier result that classifies the data items based on the content.

16. The computing system of claim 11 , wherein the instructions, when executed, cause the computing system to:

generate a separate representation of the database, that is separate from the database, using the snapshot, and

perform the data posture analysis based on a scan of the separate representation of the database.

17. The computing system of claim 11 , wherein the snapshot comprises a read-only point-in-time copy of the database.

18. The computing system of claim 11 , wherein the database is deployed in a production environment and configured to receive a user request for a data manipulation operation on data stored in the database.

19. The computing system of claim 14 , wherein the schema objects comprise at least one data column within a table, and the data items comprise a plurality of cells within the at least one data column.

20. A computing system comprising:

at least one processor; and

memory storing instructions executable by the at least one processor, wherein the instructions, when executed, provide:

a cloud data analysis logic configured to:

receive a request to perform data posture analysis on a database in a cloud environment, wherein the database includes a user access credential;

in response to the request, access, through a cloud provider application programming interface (API) using a cloud provider role corresponding to the cloud environment, a snapshot of the database; and

generate a separate database representation of the database, that separate is from the database, using the snapshot;

a scanner configured to scan the separate database representation of the database to obtain a representation of a structure of schema objects; and

a user interface component configured to generate a representation of a user interface display that represents the data posture analysis based on the scan.

Assignments (4)

Continuity (6)

References Cited (96)