Parallel Vulnerability Scanning via VNIC and Routing Namespace
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Vulnerability scanning in cloud environments is complicated by non-unique IP addresses across virtual cloud networks, making it challenging to perform efficient and accurate parallel scans.
Innovation Solution
The system processes multiple scanning requests simultaneously by generating a virtual network interface card (VNIC) and configuring a root routing namespace to communicate with multiple scanner instances in parallel, allowing packets to be sent to target addresses within the cloud network.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If vulnerability scanning is performed in a cloud environment with non-unique IP addresses, then scanning coverage can be expanded across multiple virtual cloud networks, but it becomes challenging to perform efficient and accurate parallel scans
Solution Approach 1:
The system segments the scanning operation by creating separate scanner instances and virtual network interface cards (VNICs) for each scanning request. Each scanner instance operates independently with its own network stack, allowing parallel scans across multiple VCNs without interference. This segmentation resolves the conflict by enabling efficient parallel scanning while maintaining manageable complexity through modular architecture.
Solution Approach 2:
The patent introduces an intermediary layer consisting of the root routing namespace and VNIC abstraction that mediates between multiple scanner instances and the target VCNs. This intermediary manages the complexity of non-unique IP addresses by providing a unified routing interface, allowing scanners to operate efficiently without directly handling the complexity of address reuse across networks.
2Loss of time
If multiple scanner instances are used to scan different target addresses simultaneously, then response time can be reduced, but resource management becomes more complex
Solution Approach 1:
The root routing namespace serves as a universal resource that can be shared across multiple scanner instances simultaneously. Instead of creating separate routing namespaces for each scanner (which would increase complexity), the system uses a single multi-functional root routing namespace that handles routing for all parallel scans, reducing resource management complexity while maintaining fast response times.
Solution Approach 2:
The patent merges multiple scanning operations into a unified system architecture where multiple scanner instances share common infrastructure including the root routing namespace and packet forwarding mechanisms. This consolidation reduces resource management complexity compared to completely separate scanning systems, while still enabling parallel operation to maintain fast response times.
3Adaptability or versatility
If IP addresses are reused across different virtual cloud networks, then address space utilization is improved, but vulnerability scanning accuracy becomes compromised
Solution Approach 1:
The system applies local quality by maintaining distinct network contexts for each VCN within the scanning architecture. Each scanner instance operates with awareness of its specific target VCN's network context, allowing accurate vulnerability identification despite IP address reuse. The routing namespace and VNIC configuration ensure that scanning packets are delivered to the correct network context, preserving measurement precision while allowing address space reuse.
Data Source
AI summary
A computing device may receive a plurality of scanning requests with at least one scanning request in the plurality identifying a target address of a target network. The computing device may for at least a subset of the plurality of scanning requests: generate a scanner instance and a virtual network interface card (VNIC) in response to the scanning request. The scanner instance and the VNIC communicating with a routing namespace that can communicate with two or more scanner instances simultaneously. Until the target address has been scanned: one or more packets can be sent from the scanner instance to the target address via the routing namespace and VNIC. The one or more packets can be wrapped in one or more packet wrappers identifying the target address and the target network. In response to the target address being scanned, the scanner instance and VNIC can be decommissioned.