Back to results
US 2023/0401319 A1Published application
System and method for performing hierarchical and incremental workload scanning
AssigneeCheck Point Software Technologies Ltd.
InventorsOhad Tanami, Itay Harush
Life of this patent
Estimating the term…
Abstract
A computer executed method is presented for identifying security issues in a workload. The method identifies instance(s) of the workload and scans each instance for security vulnerabilities using hierarchical and incremental scanning. The hierarchical and incremental scan of each instance is performed by identifying as a base machine image a machine image that has previously been scanned for security vulnerabilities and that the instance originated from. The differences between the instance and the base machine image are then identified and scanned for security vulnerabilities.
Claims20
A method executed by processor circuitry for performing hierarchical and incremental scanning to identify security issues in a workload executed using a set of electronic resources, the method comprising:
- identifying with the processor circuitry at least one instance of the workload;
- for each of the identified at least one instance, using the processor circuitry to perform hierarchical and incremental scanning by:
- identifying as parent machine images one or more machine images that the instance originated from, wherein:
- the parent machine images and the instance have a hierarchical tree structure as a set of related and connected nodes;
- each of the nodes in the hierarchical tree structure represents one of the parent machine images or the instance;
- and
- each of the nodes in the hierarchical tree structure is at least one of:
- connected to one or more child nodes of the nodes in the hierarchical tree structure as a parent node, such that the one or more child nodes originated from the parent node;
- or
- connected to a parent node of the nodes in the hierarchical tree structure as a child node, such that the child node originated from the parent node;
- determining from the parent machine images a base machine image by identifying from amongst the parent machine images a parent machine image that:
- has previously been scanned to identify security vulnerabilities;
- and
- is most closely related to the instance according to the hierarchical tree structure;
- identifying differences between a volume of the instance and the base machine image;
- scanning the identified differences for security vulnerabilities;
- and
- when security vulnerabilities are identified in the differences, issuing a notification based on the identified security vulnerabilities.
15 more elements
A system for performing hierarchical and incremental scanning to identify security vulnerabilities comprising:
- electronic resources configured to execute a dynamic workload, wherein:
- the electronic resources include memory and an electronic processor;
- the electronic processor is configured to dynamically scale a number of instances of the dynamic workload based on demand for the dynamic workload and to execute the instances of the dynamic workload, such that:
- increased demand results in a creation of new instances of the dynamic workload;
- and
- decreased demand results in a termination of existing instances of the dynamic workload;
- processor circuitry configured to:
- identify at least one instance of the dynamic workload;
- for each of the identified at least one instance, perform hierarchical and incremental scanning by:
- identifying as parent machine images one or more machine images that the instance originated from, wherein:
- the parent machine images and the instance have a hierarchical tree structure as a set of related and connected nodes;
- each of the nodes in the hierarchical tree structure represents one of the parent machine images or the instance;
- and
- each of the nodes in the hierarchical tree structure is at least one of:
- connected to one or more child nodes of the nodes in the hierarchical tree structure as a parent node, such that the one or more child nodes originated from the parent node;
- or
- connected to a parent node of the nodes in the hierarchical tree structure as a child node, such that the child node originated from the parent node;
- determining from the parent machine images a base machine image by identifying from amongst the parent machine images a parent machine image that:
- has previously been scanned to identify security vulnerabilities;
- and
- identifying differences between a volume of the instance and the base machine image;
- scanning the identified differences for security vulnerabilities;
- and
- when security vulnerabilities are identified in the differences, issuing a notification based on the identified security vulnerabilities.
21 more elements
An electronic device for performing hierarchical and incremental scanning to identify security vulnerabilities in a workload executed using a set of electronic resources, the electronic device comprising:
- a network interface configured to communicate with the set of electronic resources;
- processor circuitry configured to:
- identify at least one instance of the workload;
- for each of the identified at least one instance, perform hierarchical and incremental scanning by:
- identifying as parent machine images one or more machine images that the instance originated from, wherein:
- the parent machine images and the instance have a hierarchical tree structure as a set of related and connected nodes;
- each of the nodes in the hierarchical tree structure represents one of the parent machine images or the instance;
- and
- each of the nodes in the hierarchical tree structure is at least one of:
- connected to one or more child nodes of the nodes in the hierarchical tree structure as a parent node, such that the one or more child nodes originated from the parent node;
- or
- connected to a parent node of the nodes in the hierarchical tree structure as a child node, such that the child node originated from the parent node;
- determining from the parent machine images a base machine image by identifying from amongst the parent machine images a parent machine image that:
- has previously been scanned to identify security vulnerabilities;
- and
- identifying differences between a volume of the instance and the base machine image;
- scanning the identified differences for security vulnerabilities;
- and
- when security vulnerabilities are identified in the differences, issuing a notification based on the identified security vulnerabilities.
16 more elements
Dependencies are inferred from the claim text.