Containerized Library Vulnerability Prioritization

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current systems lack an efficient method to organize and continuously scan open-source libraries for vulnerabilities across various applications, requiring complex processes for upgrading and fixing vulnerabilities, which often necessitate intervention from both product development and security teams.

Innovation Solution

A container-based software implementation separates application code and libraries into distinct containers, allowing for continuous vulnerability scanning and prioritization using a vulnerability scoring system, enabling single replacements to fix vulnerabilities across all applications without repackaging application containers.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If libraries are embedded within each application container, then each application can access its required libraries independently, but vulnerability scanning becomes complex and requires repackaging application containers to fix vulnerabilities

Engineering Contradiction:

ImproveApplication independenceVSAvoidVulnerability management complexity

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The system segments libraries from application containers into a separate shared library container. This segmentation allows vulnerability scanning and updates to be performed on the library container independently, without requiring repackaging of application containers. The library container is mounted as a volume to multiple application containers, enabling centralized vulnerability management while maintaining application independence.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The shared library container acts as an intermediary between the vulnerability management system and application containers. It receives vulnerability scans, updates, and patches from the vulnerability management system, then provides these updates to application containers through volume mounting. This intermediary approach simplifies vulnerability management by decoupling the update process from application repackaging.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Productivity

If multiple applications share common libraries in a separate container, then vulnerability fixes can be applied centrally without repackaging applications, but coordinating library access across applications requires additional management overhead

Engineering Contradiction:

ImproveVulnerability fix efficiencyVSAvoidLibrary coordination overhead

Core Design Contradiction:

ProductivityVSDevice complexity

Solution Approach 1:

The shared library container serves multiple functions: it stores libraries for multiple applications, provides a centralized vulnerability scan target, and acts as an update distribution point. By making the library container universal and shared across all applications through volume mounting, the system achieves efficient centralized vulnerability management without requiring separate update processes for each application.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Solution Approach 2:

Application containers automatically access the shared library container through mounted volumes without requiring manual coordination or configuration for each update. The vulnerability management system can update libraries in the shared container, and applications automatically use the updated libraries through the mounted volume, enabling self-service vulnerability fixes without manual intervention in each application.

Inventive Principle:

Principle #25Self-service

3Reliability

If continuous vulnerability scanning is implemented on a centralized library container, then all applications using those libraries are protected, but the scanning process must handle multiple applications' library dependencies simultaneously

Engineering Contradiction:

ImproveVulnerability protection coverageVSAvoidScanning process complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The system merges all application library dependencies into a single shared library container. This consolidation allows the vulnerability scanning process to target one unified location rather than multiple scattered library files across different application containers. The scan results automatically apply to all applications that mount the shared library container, providing comprehensive protection with a single scanning operation.

Inventive Principle:

Principle #5Merging (Combining)

Data Source

PatentUS11748489B2Unified software library access and vulnerability correction prioritization

Publication Date: 2023.09.05 EMC IP HLDG CO LLC

AI summary

A container-based software implementation uses separate containers for software libraries and application code. A storage system may have multiple applications executing to control various aspects of operation of the storage system, and to enable access to the storage system by hosts. These applications are containerized separately from the libraries referenced by the applications, and the libraries are commonly housed in a separate container. The libraries may be open-source libraries, proprietary libraries, or third-party dependent libraries. A vulnerability management system scans the application containers to determine dependencies between applications and libraries, including the number of containers that reference a particular library and the frequency with which microservices of the containerized application reference the library. A vulnerability prioritization system uses the determined dependencies and vulnerability severity scores to prioritize libraries for correction based on the frequency of use of the library, the number of products impacted, and the severity of the vulnerabilities.