Container Image Scanning via Layer Segmentation for PaaS Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing Platform-as-a-Service (PaaS) systems face inefficiencies in image and container scanning, consuming excessive resources by performing full scans on entire application images, even when only parts have been modified or recently scanned, which is not optimized for security and resource usage.
Innovation Solution
Implementing distributed scan components across the PaaS system for separate build-time, runtime, and image repository scans, focusing on the top-most configurable layer of application images, with full image scans performed at the image build system and incremental updates, thereby reducing resource consumption and optimizing scanning processes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If full scans are performed on entire application images at nodes, then security coverage is comprehensive, but resource consumption is excessive
Solution Approach 1:
The patent segments the application image into multiple layers (read-only layers and read-write layers). Scan components only scan the read-write layers which contain potentially modified files, rather than scanning the entire image. This segmentation allows comprehensive security coverage of relevant areas while avoiding redundant scanning of unchanged read-only portions, thus resolving the contradiction between security coverage and resource consumption.
Solution Approach 2:
The patent extracts and scans only the top-most configurable layer (read-write layer) that contains potentially modified files, separating it from the rest of the image. By taking out only the necessary portion for scanning, the system maintains security coverage while significantly reducing the scanning scope and associated resource consumption.
2Productivity
If distributed scan components are implemented across multiple locations, then scanning efficiency is improved, but system complexity increases
Solution Approach 1:
The patent divides the scanning function into multiple scan components distributed at different locations (image build system, image repository, and nodes). Each scan component handles scanning tasks appropriate to its location, with the node scan component focusing only on read-write layers. This segmentation improves scanning efficiency by distributing the workload while managing complexity through clear role differentiation.
Solution Approach 2:
The patent implements preliminary scanning at the image build system and image repository before deployment to nodes. This preliminary action identifies and flags potentially problematic files in advance, so that node scan components only need to verify read-write layers, improving overall efficiency while reducing the complexity of node-level scanning.
3Reliability
If periodic full image scans are performed at nodes, then security is maintained, but system performance deteriorates
Solution Approach 1:
The patent extracts only the read-write layer (top-most configurable layer) for scanning at nodes, excluding all read-only layers. This extraction maintains security by monitoring potentially modified files while avoiding performance degradation from scanning unchanged portions of the image, thus resolving the contradiction between security maintenance and system performance.
Solution Approach 2:
The patent implements periodic scanning of only the read-write layer at nodes rather than continuous full-image scanning. This periodic action on a reduced scope maintains security coverage for modified files while minimizing performance impact, allowing the system to balance security maintenance with operational performance.
Data Source
AI summary
A method of container and image scanning includes receiving, by a processing device initiating a scan process to scan containers executing functionality of multiple applications. The method further includes, for each container of the containers, identifying portions of an application image instance of the container, the portions corresponding to previously-scanned clean layers of the application image instance, scanning, by the processing device in accordance with the scan process, remaining portions of the application image instance not associated with the previously-scanned clean layers, and responsive to a clean result of the scanning of the remaining portions of the application image instance, terminating, by the processing device, the scan process for the container and allowing the container having the application image instance to execute.