Dependency-Based Container Mirror Library Security Evaluation System and Method

Abstract

The present invention provides a system and method for evaluating the security of a container image library based on dependencies, including a management node and a detection node, and the management node and the detection node exchange data and work together; the management node completes the container image dependency tree in the container warehouse Build and update the container image dependency tree, and deliver the container image detection task; the detection node receives the delivered container image detection task, and the container image detection task performs a complete security inspection on the container image; if there is a security risk in the container image, issue The sub-mirror detection task is given to the detection node; the sub-mirror detection task issued by the detection node searches for all sub-mirrors of the container image in the container image dependency tree, and detects whether the files with security risks are repaired in the sub-mirror. The invention is beneficial to evaluate the impact range of vulnerabilities, to detect potential safety hazards in the container image, and has the effect of large-scale analysis of the security of the image in the container image library.

Description

technical field [0001] The present invention relates to the technical field of container mirror library security assessment, in particular to a dependency relationship-based container mirror library security assessment system and method. Background technique [0002] The mode of deploying and running software in a virtual environment based on container technology has brought great convenience, and the way of compiling once and deploying multiple times has brought increasing user needs. Among them, large manufacturers such as Docker, Red Hat, and Google have established official storage warehouses containing a large number of container images. At the same time, security issues in its container ecological environment continue to occur, especially after insecure images are mixed into storage warehouses. Due to the existence of various complex dependencies between images, users can freely choose to generate an image that may depend on A new instance of an insecure image, theref...

AI Technical Summary

Problems solved by technology

[0005] In view of the existing technologies mentioned above, the inventor believes that the problem of this method is that it takes a lot of time to download the image to the local evaluation. Therefore, when a security vulnerability breaks out, it is difficult to complete the large-scale container image in a short time. Security Assessment Methods for Libraries

Images