Pod Software Update Sequencing by Reachability and Risk Rating
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for updating software in a distributed computing environment do not consider the structure of the cluster, leading to inefficient prioritization of vulnerability updates based on reachability and criticality, which can expose systems to security risks.
Innovation Solution
A computer-implemented method that calculates risk ratings for pods in a distributed computing environment by considering network topology, vulnerability scores, and criticality, prioritizing updates based on these ratings to ensure high-priority pods are addressed first.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If software is updated according to vulnerability score alone, then vulnerabilities are addressed based on severity, but the cluster structure and reachability are not considered leading to inefficient prioritization
Solution Approach 1:
The patent transforms the single vulnerability score parameter into a multi-dimensional risk rating by introducing additional parameters: reachability classification (direct/indirect internet access), criticality score, and communication relationships. This parameter expansion enables more accurate security prioritization while maintaining manageable complexity through systematic classification.
2Reliability
If all vulnerable pods are updated simultaneously, then security coverage is maximized, but resource consumption and system disruption increase
Solution Approach 1:
The patent segments the update process by classifying pods into priority groups based on risk ratings derived from reachability and criticality analysis. High-priority pods (direct internet access, critical infrastructure) are updated first, followed by medium and low-priority pods. This segmentation enables efficient resource allocation while maintaining comprehensive security coverage.
3Ease of operation
If update priority is determined without considering network topology, then the process is simple, but pods directly reachable from the internet may not be prioritized correctly
Solution Approach 1:
The patent performs preliminary analysis of network topology, reachability, and criticality before determining update priorities. By pre-classifying pods into risk categories based on their network exposure and infrastructure importance, the system identifies high-risk pods (those directly reachable from the internet or containing critical infrastructure) that require urgent updates, thereby addressing security risks before they can be exploited.
Data Source
Figure 1~2
Figure 3~4
Figure 5
AI summary
A prioritized method is presented for updating software in a distributed computing environment. The objective of the disclosure is to find a computer-implemented method for updating software on pods in the distributed computing environment. This is solved by calculating a risk rating for each pod in the manifest, taking into account a vulnerability score of the pod, the minimum number of inbound hops for reaching the pod, and the communication relationship between the given pod and other pods. Pods in the manifest are updated in accordance with the calculated risk ratings. (Fig. 1)