K-anonymous container vulnerability detection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing vulnerability detection methods in software modules, such as those using Common Vulnerabilities and Exposures (CVE) databases, can expose sensitive information about software vulnerabilities when communicating with untrusted or compromised servers, potentially leading to unauthorized access.

Innovation Solution

Implement k-anonymous vulnerability detection by encoding and truncating layer identifiers of container images before querying a vulnerability registry server, ensuring that only a portion of the identifier is transmitted, thus maintaining anonymity and security.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If the complete layer identifier is transmitted to the vulnerability registry server, then accurate vulnerability detection is achieved, but the system exposes sensitive information about software vulnerabilities to potential interception

Engineering Contradiction:

Improvevulnerability detection accuracyVSAvoidinformation exposure risk

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The layer identifier is divided into multiple segments, with only a first portion (prefix) transmitted to the vulnerability registry server. This segmentation allows the system to maintain vulnerability detection functionality while reducing the amount of sensitive information exposed in communications.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The invention extracts and transmits only the necessary portion (first portion/prefix) of the layer identifier that is sufficient for vulnerability matching, while retaining the complete identifier locally. This extraction approach minimizes information exposure while preserving detection accuracy.

Inventive Principle:

Principle #2Taking out (Extraction)

2Loss of information

If a truncated identifier is transmitted to the server, then communication anonymity is improved, but the precision of vulnerability matching decreases

Engineering Contradiction:

Improveinformation anonymityVSAvoidvulnerability matching precision

Core Design Contradiction:

Loss of informationVSMeasurement precision

Solution Approach 1:

The system transmits a partial identifier (first portion only) rather than the complete identifier. This partial action provides sufficient information for the server to return matching vulnerability candidates while maintaining communication anonymity, balancing precision and privacy requirements.

Inventive Principle:

Principle #16Partial or excessive action

Data Source

PatentUS12299135B2K-anonymous vulnerability detection

Publication Date: 2025.05.13 RED HAT LLC

AI summary

K-anonymous vulnerability detection is disclosed. Data descriptive of a container image including at least one container layer having a layer identifier is received. The layer identifier is encoded to produce an encoded layer identifier. A first portion of the layer identifier is transmitted to a vulnerability registry server. One or more vulnerability identifiers are received from the vulnerability server. The vulnerability identifiers are associated with the first portion of the encoded layer identifier. It is determined that the layer identifier matches a matching vulnerability identifier of the one or more vulnerability identifiers.