Container Transmission Security Through Change-Prohibited Region Integrity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing container image security solutions fail to determine the extent of security ensured when secondary developers make alterations to the container image and change configurations, as they only ensure the validity of the entire container image.
Innovation Solution
A transmission apparatus and reception apparatus that include information about change-prohibited regions within a container, indicating they have not been altered, and vulnerability inspection data, allowing for verification processing based on this information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If vulnerability inspection is performed on the entire container image, then the security coverage is improved, but the ability to determine security after modifications is worsened
Solution Approach 1:
The container image is segmented into multiple layers, with each layer independently inspected for vulnerabilities. This segmentation allows the system to track which specific layers contain vulnerabilities and to determine security status after modifications by comparing layer hashes, thereby maintaining security determination capability while achieving comprehensive coverage.
Solution Approach 2:
Vulnerability inspection is performed in advance on each container layer before the container is deployed or modified. The inspection results, including layer hashes and vulnerability information, are stored beforehand, enabling rapid security determination after modifications by comparing current layer states with the pre-inspected baseline.
2Measurement precision
If the entire container image is re-inspected after modifications, then the security accuracy is improved, but the inspection time is worsened
Solution Approach 1:
Instead of re-inspecting the entire container image, the system segments the verification process by computing hashes only for the modified layers and comparing them with the pre-inspected baseline. This segmented approach maintains security verification accuracy while significantly reducing inspection time by avoiding redundant scanning of unchanged layers.
Solution Approach 2:
The system performs partial inspection by focusing only on the modified portions of the container image. By computing hashes of changed layers and comparing with the baseline, the system achieves sufficient security verification accuracy without the excessive time cost of full re-inspection.
3Loss of information
If detailed vulnerability information is stored for the entire container, then the security information completeness is improved, but the storage overhead is worsened
Solution Approach 1:
Vulnerability information is stored at the layer level rather than for the entire container. Each layer's hash and associated vulnerability data are stored separately, providing complete security information for each segment while reducing overall storage overhead by avoiding redundant information across layers.
Solution Approach 2:
The system extracts and stores only the essential vulnerability information (layer hash and vulnerability details) for each layer, separating this critical data from the full container image. This extraction maintains vulnerability information completeness while minimizing storage overhead by storing only what is necessary for security verification.
Data Source
AI summary
In order to appropriately provide information related to vulnerability that may be included in a container as a transmission target, a transmission apparatus includes an information obtaining unit configured to obtain information related to a change-prohibited region included in a container to be transmitted, information indicating that the change-prohibited region has not been changed, and information related to vulnerability inspection for the change-prohibited region, and a transmission processing unit configured to include, in the container, the information related to the change-prohibited region, the information indicating that the change-prohibited region has not been changed, and the information related to the vulnerability inspection for the change-prohibited region, and transmit the container.