Container Image Scanning With File-Based Vulnerability Signatures
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing container image vulnerability scanning methods rely on package managers, which cannot detect manually installed packages, vulnerabilities in dependencies, or mitigations, and introduce potential vulnerabilities, leading to inaccurate scanning and performance issues.
Innovation Solution
A vulnerability scanning method that generates unique vulnerability signatures by indexing every file in a container image's layers, using hashes and metadata to create rules for each layer, allowing for accurate vulnerability detection without requiring a package manager.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If package managers are used for vulnerability scanning, then scanning can be performed using existing tools, but manually installed packages cannot be detected and potential vulnerabilities are introduced
Solution Approach 1:
The patent extracts the vulnerability scanning function from the package manager system and implements it independently through direct filesystem inspection. The scanner examines container image layers and package databases directly without relying on package manager tools, thereby detecting manually installed packages while avoiding package manager-introduced vulnerabilities.
Solution Approach 2:
The patent introduces an intermediary vulnerability signature database that mediates between the container image filesystem and the scanning process. Signatures are generated from known vulnerable packages and their dependencies, allowing accurate detection without direct package manager involvement.
2Ease of operation
If package managers are used for vulnerability scanning, then scanning functionality is available, but performance issues are introduced
Solution Approach 1:
The patent performs preliminary actions by pre-generating vulnerability signatures from known vulnerable packages and their dependency relationships before scanning. During actual scanning, these pre-computed signatures are directly compared against the container image contents, eliminating the need for time-consuming package manager operations during the scanning process.
3Measurement precision
If comprehensive vulnerability scanning is performed, then detection accuracy is improved, but false positives increase
Solution Approach 1:
The patent skips unnecessary verification steps by directly comparing filesystem contents and package database entries against vulnerability signatures. The scanning process efficiently matches package names, versions, and dependency relationships without redundant checks, maintaining high detection accuracy while minimizing false positives through precise signature matching.
Data Source
AI summary
Mechanisms are provided for scanning container images for vulnerabilities. With these mechanisms, a container image is received for inclusion in a container image registry and each layer of the container image is scanned to generate file signatures for each file referenced in each layer. Vulnerability signature(s) are applied to each layer, based on the file signatures of the layer, to determine if criteria of the vulnerability rule(s) of the vulnerability signature(s) are satisfied by at least one layer of the container image. Registration of the container image in the container image registry is accepted or denied based on results of the application of the vulnerability signature(s). Each vulnerability signature comprises one or more vulnerability rules generated from a scanning and indexing of layers of one or more other container images.