Hierarchical Workload Scanning for Cloud Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cloud computing infrastructure lacks effective methods for identifying and managing security vulnerabilities in workload instances, hindering businesses from fully utilizing cloud resources.
Innovation Solution
A method for hierarchical and incremental scanning of workload instances is introduced, which identifies a previously scanned anchor image and scans the differences between the instance and the anchor image for security issues.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional security scanning methods are used to scan entire workload instances, then security coverage is comprehensive, but scanning time and computational resources are excessive
Solution Approach 1:
The patent segments the scanning process by dividing the workload instance into changed portions versus unchanged portions. Instead of scanning the entire instance, only the changed portions (newly created or modified files, directories, and processes) are scanned for vulnerabilities. This segmentation is achieved through comparison of instance states before and after changes, allowing comprehensive security coverage of critical areas while excluding redundant scanning of unchanged components.
Solution Approach 2:
The patent performs preliminary actions by establishing a baseline representation of the workload instance before changes occur. This baseline includes the file system state, process list, and configuration parameters. When changes happen, the system compares against this pre-established baseline to identify only the modified portions that require security scanning, thereby reducing scanning time while maintaining thoroughness.
2Reliability
If comprehensive security scanning of all workload instances is performed, then security coverage is complete, but computational resources and cost increase significantly
Solution Approach 1:
The patent applies local quality by focusing security scanning resources only on specific local areas where changes have occurred. Instead of uniformly scanning entire instances, the system identifies and scans only the changed portions (new files, modified configurations, updated processes) that pose potential security risks. This localized scanning approach maintains effective security detection while dramatically reducing overall computational resource consumption.
Solution Approach 2:
The patent implements partial action by scanning only the necessary portions of the workload instance rather than the entire instance. The system determines the minimum required scanning scope by comparing current state against baseline, scanning only the changed portions needed for security assessment. This partial scanning approach provides sufficient security coverage without the excessive resource consumption of full-instance scanning.
3Reliability
If security scanning is performed on all workload instances, then security coverage is comprehensive, but management complexity increases
Solution Approach 1:
The patent introduces dynamics by making the scanning scope adaptive rather than static. The system dynamically determines which portions of the workload instance require scanning based on real-time comparison of changes against the baseline. This dynamic approach automatically adjusts scanning coverage based on actual workload state, reducing manual configuration complexity and enabling comprehensive security monitoring with simplified system management.
Data Source
AI summary
A computer executed method is presented for identifying security issues in a workload. The method identifies instance(s) of the workload and scans each instance for security vulnerabilities using hierarchical and incremental scanning. The hierarchical and incremental scan of each instance is performed by identifying as a base machine image a machine image that has previously been scanned for security vulnerabilities and that the instance originated from. The differences between the instance and the base machine image are then identified and scanned for security vulnerabilities.