Remote Cluster Inspection Nodes for Multi-Tenant Vulnerability Scanning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cybersecurity solutions for cloud environments face challenges in scalability and complexity, particularly when dealing with multi-tenant agentless vulnerability scanning across various cloud platforms, as they require continuous monitoring and maintenance of virtual appliances, which is not feasible at scale.
Innovation Solution
A method and system for scalable vulnerability scanning that involves generating inspection nodes and persistent volumes in a remote cluster, allowing for on-demand provisioning of inspector workloads to inspect cloud workloads, using a container orchestration system to efficiently scale with demand and support multi-tenancy across multiple cloud environments.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If agent-based scanning is used, then vulnerability detection capability is provided, but system complexity and maintenance burden increase due to active installation and monitoring requirements
Solution Approach 1:
The patent extracts the scanning function from the cloud workloads themselves and places it in a separate remote cluster. Instead of agents running on workloads, the system creates inspection nodes in a remote cluster that access workload data through APIs, eliminating the complexity of agent installation and monitoring while maintaining vulnerability detection capability.
Solution Approach 2:
The patent introduces a remote cluster as an intermediary between the cloud workloads and the scanning function. The remote cluster provisions inspection nodes that act as mediators to access workload information through cloud provider APIs, avoiding direct agent installation on workloads and reducing system complexity.
2Reliability
If virtual appliances are deployed in cloud environments for scanning, then vulnerability scanning capability is achieved, but scalability becomes difficult due to deployment complexity across multiple cloud environments
Solution Approach 1:
The patent creates a universal scanning platform in the remote cluster that can scan workloads across multiple cloud environments (AWS, Azure, GCP) through a standardized interface. The remote cluster provisions inspection nodes that can access different cloud providers' APIs uniformly, enabling scalability across diverse cloud environments without environment-specific deployment complexity.
Solution Approach 2:
The patent creates copies of inspection nodes in the remote cluster that can be provisioned on-demand to match the number of workloads requiring inspection. These inspection node copies are identical templates that can be rapidly deployed across different cloud environments, enabling easy scaling without manual appliance deployment in each environment.
3Reliability
If continuous monitoring is performed to detect changes in virtual workloads, then vulnerability detection is enabled, but resource consumption and operational burden increase due to baseline maintenance requirements
Solution Approach 1:
The patent implements periodic inspection instead of continuous monitoring. The remote cluster provisions inspection nodes that perform vulnerability scanning at scheduled intervals or triggered by events, rather than continuously monitoring for changes. This periodic approach reduces resource consumption while maintaining effective vulnerability detection.
Solution Approach 2:
The system uses cloud provider APIs to automatically access and inspect workload data without requiring manual baseline establishment or continuous operational intervention. The remote cluster automatically provisions inspection nodes and executes scans based on configured schedules or triggers, eliminating the need for manual baseline maintenance and reducing operational burden.
Data Source
AI summary
A method for scalable vulnerability detection is provided. The method includes selecting at least a workload of a plurality of workloads deployed in a first cloud environment for inspection, wherein the workload includes a first volume; generating in a remote cluster an inspection node, the inspection node including at least a first disk, wherein the remote cluster provisions inspection nodes in response to demand for inspection nodes; generating a persistent volume (PV) on which the at least a first disk is mounted, wherein the at least a first disk is generated from a snapshot of the first volume; and generating a persistent volume claim (PVC) of the PV for an inspector workload, wherein the inspector workload is configured to inspect the PV for an object, and wherein inspector workloads are provisioned in response to demand for inspector workloads.