Virtual Machine Image Scanning via Lightweight Instance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing solutions for scanning virtual machine images require downloading the images or deploying agents at the image storage location, which can slow down the scanning process, consume additional resources, and introduce security risks.
Innovation Solution
Create a lightweight virtual machine instance based on a virtual machine image and an application programming interface (API) of the deployment environment, replacing the entry point with a script that retrieves and executes a static scanner executable to perform the scanning without downloading the image.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the agent performing the scanning is deployed at the same computer location as the image to be scanned, then the scanning can be performed in place, but this requires downloading the images or deployment of an agent which slows down the scanning and consumes additional network and storage resources
Solution Approach 1:
The patent introduces a cloud-based scanning service as an intermediary between the virtual machine image and the scanning agent. Instead of deploying the agent directly at the image location or downloading the image, the cloud service acts as a mediator that receives the image data, performs scanning, and returns results. This resolves the contradiction by maintaining scanning accessibility while eliminating the time loss and resource consumption associated with traditional approaches.
Solution Approach 2:
The patent moves the scanning operation from the local dimension (on-premises scanning agents) to a cloud dimension. By transitioning the scanning infrastructure to a cloud-based service, the system gains access to scalable computing resources without requiring local agent deployment or image downloads. This dimensional shift resolves the time and resource constraints of traditional local scanning while preserving accessibility through network-based image transmission.
2Ease of operation
If the agent performing the scanning is deployed at the same computer location as the image to be scanned, then the scanning can be performed in place, but this requires use of dedicated network and storage resources which interferes with or impedes other processes at that location
Solution Approach 1:
The cloud-based scanning service acts as an intermediary that handles all scanning operations externally, preventing local resource contention. The image is transmitted to the cloud service which performs scanning independently, eliminating the need for dedicated local network and storage resources. This resolves the contradiction by maintaining scanning accessibility while preserving local system performance and productivity.
Solution Approach 2:
The patent segments the scanning function from the virtual machine hosting environment. By separating the scanning operation into an independent cloud-based service, the system eliminates resource contention between scanning processes and other virtual machine operations. This segmentation resolves the contradiction by allowing scanning accessibility while preventing interference with other processes at the location.
3Measurement precision
If scanning involves analyzing a dynamic instance of an image at runtime, then the scanning can be performed on the actual running system, but executing the image introduces security risks in the environment in which the image is stored
Solution Approach 1:
The cloud-based scanning service serves as a secure intermediary environment for executing and analyzing the virtual machine image. Instead of running the image directly in the storage environment which creates security risks, the image is transmitted to the cloud service where it is executed in an isolated, controlled setting. This resolves the contradiction by maintaining scanning accuracy through runtime analysis while eliminating security risks through environmental isolation.
Solution Approach 2:
The patent creates a copy of the virtual machine image for scanning purposes. Instead of executing the original image in its storage environment, a copy is transmitted to and executed in a cloud-based scanning environment. This copying approach resolves the contradiction by enabling accurate runtime scanning of the copied instance while protecting the original storage environment from security risks.
Data Source
AI summary
A system and method for scanning of virtual machine images. The method includes creating a virtual machine instance of a virtual machine based on a virtual machine image of the virtual machine and an application programming interface (API) of an environment in which the virtual machine is to be deployed, wherein the virtual machine image has an entry point such that the virtual machine instance executes the entry point; and replacing the entry point of the virtual machine instance with a lightweight script, wherein the lightweight script is configured to retrieve a static scanner executable, to execute the static scanner executable, and to send results of the scanning.