Microcontainer Vulnerability Assessment via File Matching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Microcontainers lack a package manager to determine vulnerability, making it difficult to identify vulnerable files when a package-level vulnerability report is received, as they do not have the necessary tools to identify the source package of each file included in the container.
Innovation Solution
A system is implemented to generate a file-level vulnerability report by comparing a vulnerable version of a software package with an updated version that fixes the vulnerability, and then scanning the microcontainer to identify matching files, allowing for the determination of vulnerable files within the container without relying on a package manager.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a package manager is used to determine vulnerability, then vulnerability identification is simplified, but microcontainers cannot use this approach because they lack a package manager
Solution Approach 1:
The patent introduces an intermediary system that acts as a bridge between package-level vulnerability reports and microcontainer files. This intermediary performs file-level analysis by comparing vulnerable and fixed versions of packages, generating detailed file-level vulnerability reports that can be applied to microcontainers without requiring a package manager inside the container.
2Loss of information
If package-level vulnerability reports are used, then vulnerability information is available, but the specific vulnerable files within the container cannot be identified
Solution Approach 1:
The patent segments the package-level vulnerability information into file-level details by comparing the vulnerable version of a package with a fixed version. This segmentation process identifies exactly which files contain the vulnerability, transforming coarse-grained package-level data into fine-grained file-level vulnerability information that can be precisely applied to microcontainer security assessment.
Data Source
AI summary
A system for determining vulnerability of an application container is provided. The system receives a report associating a first version of a software package with a vulnerability and a second version of the software package as being an update that fixes the vulnerability. The system receives the first version and the second version of the software package. The second version has one or more files that correspond to files in the first version. The system identifies a changed file in the first version of the software package that is different from a corresponding file in the second version of the software package. The system identifies a container file in an application container that matches the changed file in the first version of the software package. The system associates the identified container file with the vulnerability.