Container Image SBOM Data Structure for CVE Remediation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing technologies fail to effectively utilize Software Bill of Materials (SBOM) metadata from the OpenSSF community to protect Open Container Initiative (OCI) containers from Common Vulnerabilities and Exposures (CVEs).
Innovation Solution
A computer-implemented method that retrieves a container image from a repository, updates it based on filesystems and metadata, and creates a data structure to manage and fix security vulnerabilities and exposures for containers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If container images are updated with filesystems and metadata from repositories, then container security is improved, but system complexity increases due to the need to manage and process SBOM metadata and vulnerability information
Solution Approach 1:
The patent introduces an intermediary system that sits between the container repository and the host system. This intermediary automatically processes container images, extracts SBOM metadata, identifies vulnerabilities, and generates security updates. By acting as a mediator, it handles the complexity of metadata management and vulnerability assessment, allowing the host system to benefit from improved container security without directly managing the complex processes itself.
Solution Approach 2:
The system enables container images to self-update by automatically processing their own metadata and identifying security vulnerabilities. The container image carries its own SBOM information, which is used to detect vulnerabilities and apply fixes without requiring external intervention for each update cycle. This self-service approach reduces the operational complexity while maintaining high security standards.
2Measurement precision
If comprehensive metadata for application packages is collected and processed, then vulnerability detection accuracy is improved, but processing time and computational resources increase
Solution Approach 1:
The patent performs preliminary processing of container images by extracting and organizing SBOM metadata during the image build or push phase, before the image is deployed to hosts. This advance preparation ensures that when the image is running, vulnerability detection can quickly reference pre-processed metadata rather than parsing raw package information in real-time, thus maintaining high detection accuracy while reducing processing time during operational phases.
3Reliability
If automatic updates are applied to container images on hosts, then security vulnerability remediation is improved, but container operation continuity may be affected
Solution Approach 1:
The system implements periodic vulnerability scanning and scheduled update application rather than continuous or immediate updates. Container images are scanned at defined intervals, and security updates are applied during maintenance windows or off-peak periods. This periodic approach ensures that security vulnerabilities are systematically remediated while minimizing disruption to container operations, as updates are not applied continuously or unexpectedly.
Data Source
AI summary
A computer-implemented method for managing containers. A processor set retrieves a container image from a container repository. The container image is retrieved by a host comprising a copy of the container image. The processor set updates the copy of the container image on the host based on filesystems in the container image retrieved from the container repository and metadata for the application packages associated with the container image retrieved from the container repository. The processor set creates a data structure comprising information for fixing security vulnerabilities and exposures for containers based on the metadata for the application packages, information associated with the application packages, and information associated with containers for the container image on the host.