Vulnerability Scanner Using File System API for Remote Disk Block Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current vulnerability scanning methods for remote file systems are invasive, resource-intensive, and lack visibility into offline systems, as they require agent installation, network scanning, or disk imaging, which can impact performance and miss vulnerabilities in disconnected devices.
Innovation Solution
A method using a file system API to decode and read specific disk blocks of a remote file system, allowing targeted vulnerability scanning without agent installation or disk imaging, by determining target software objects, transmitting read requests, and extracting objects for scanning.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a scanner agent is installed on the target computer, then vulnerability scanning can be performed, but the target device performance is impacted and installation complexity increases
Solution Approach 1:
The patent introduces a surrogate computer as an intermediary that hosts a virtualized copy of the target file system. The vulnerability scanner operates on this surrogate system rather than directly on the target, eliminating the need for agent installation while maintaining scanning capability. The surrogate acts as a mediator between the scanner and the remote file system.
2Reliability
If a disk volume is created from a snapshot and mounted on a surrogate computer, then offline visibility is achieved, but resource consumption and scan time increase
Solution Approach 1:
The patent extracts only the specific file system metadata and disk block information needed for vulnerability scanning from the remote file system, rather than creating and mounting complete disk images. This selective extraction approach maintains offline visibility while significantly reducing the amount of data that needs to be processed during scanning.
Solution Approach 2:
The patent segments the vulnerability scanning process into distinct phases: first decoding file system metadata to identify target software objects, then selectively reading only the disk blocks containing those objects. This segmentation allows the scanner to work with minimal data while maintaining comprehensive coverage.
3Reliability
If traditional scanning methods are used, then comprehensive vulnerability coverage is achieved, but the approach is invasive and resource-intensive
Solution Approach 1:
The patent applies partial action by reading only the specific disk blocks that contain target software objects identified through file system decoding, rather than scanning entire disk images. This selective approach maintains comprehensive vulnerability coverage for identified targets while minimizing resource consumption by avoiding unnecessary data processing.
Data Source
AI summary
In an embodiment, a vulnerability scanner component determines one or more target software objects of a remote file system for a vulnerability scan, and performs, via a file system application programming interface (API), a file system decoding procedure based on information associated with the remote file system to determine a subset of disk blocks of the remote file system that comprise the one or more target software objects. The vulnerability scanner component transmits, to a remote device, a read request associated with the subset of disk blocks, and obtains, in response to the read request, the subset of disk blocks (e.g., rather than a full disk image). The vulnerability scanner component extracts the one or more target software objects from the subset of disk blocks, and performs the vulnerability scan on the extracted one or more target software objects.