Container Disk File Segmentation for Targeted Security Scanning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security scanning methods for containers within virtual machines are inefficient as they require scanning the entire virtual machine disk file, leading to unnecessary resource usage when scanning a single or few containers, wasting computing resources.
Innovation Solution
A method that identifies and scans a container disk file separate from the virtual machine disk file, allowing for targeted security threat detection and updating a container scan catalog based on the results, enabling more granular and efficient scanning.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the entire virtual machine disk file is scanned for security threats, then comprehensive security coverage is achieved, but computing resources are wasted when only a few containers need scanning
Solution Approach 1:
The patent segments the virtual machine disk file into separate container disk files, each corresponding to a specific container. This segmentation allows the security scanning system to scan only the relevant container disk file rather than the entire virtual machine disk file, thus reducing unnecessary computing resource consumption while maintaining security coverage for the targeted container.
Solution Approach 2:
The patent extracts the container disk file from the virtual machine disk file, creating a separate, identifiable file structure. By taking out the container-specific data into its own disk file, the system can selectively scan only the extracted container portion when security scanning is requested, avoiding the need to scan the entire virtual machine disk file and thereby reducing wasted computing resources.
2Reliability
If the entire virtual machine disk file is scanned, then all containers are covered, but scanning time increases unnecessarily
Solution Approach 1:
The patent segments the virtual machine disk file into separate container disk files, enabling the scanning system to target only the specific container that requires security scanning. This segmentation reduces scanning time by eliminating the need to traverse and analyze data from other containers that do not require scanning, while still ensuring comprehensive security coverage for the targeted container.
Solution Approach 2:
By extracting container disk files from the virtual machine disk file, the patent enables the scanning system to access and scan only the relevant container data. This extraction reduces scanning time by allowing direct access to the container-specific file without having to process the entire virtual machine disk file, while maintaining complete security coverage for the scanned container.
3Productivity
If container disk files are separate from virtual machine disk files, then scanning efficiency improves, but system complexity increases
Solution Approach 1:
The patent segments the storage structure into separate container disk files within the virtual machine disk file system. While this creates additional file management overhead, it enables highly efficient security scanning by allowing direct access to and scanning of only the relevant container data, significantly improving scanning productivity compared to scanning the entire virtual machine disk file.
Solution Approach 2:
The patent implements a multi-functional file structure where the virtual machine disk file serves both as a container for multiple container disk files and as a manageable storage unit. This universal structure allows the system to maintain organized, separate container files for efficient scanning while still providing unified management capabilities, balancing the increased file management complexity with improved scanning productivity.
Data Source
AI summary
Techniques for security scanning of containers executing within VMs. A virtualization system maintains container disk files that store data for containers. The container disk files are stored separate from, and not included within, virtual machine disk files that store data for the virtual machines. To scan data for any particular container, a scanning module scans the container disk file associated with the container. If a threat is found, a container scan catalog is updated to indicate this fact. A container may be disconnected from the network if identified security threats cannot be removed from the container. An entire VM may be disconnected from the network if all containers within the VM have threats that cannot be cleaned. The use of container disk files for security threat scanning allows for data for individual containers to be scanned.