# US 2026/0089006 A1 · Image fingerprinting based on fuzzy hashing > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2026/0089006 A1 - Document ID: US20260089006A1 - Status: Published application - Kind: A1 - Application number: 19/408,470 - Filed: 2025-12-04 - Published: 2026-03-26 - Earliest claimed: 2024-06-04 - Assignees: Red Hat, Inc. - Applicants: Red Hat, Inc. - Inventors: Paolo Antinori; Stefano Maestri - Web page: https://patentgrep.com/patent/US20260089006A1 ## CPC - G06F 8/63: {Image based installation; Cloning; Build to order} - H04L 9/3236: {using cryptographic hash functions} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract In one example, a method may detect and notify a user of comparisons between image files for execution in a distributed computing environment. The method includes receiving an image file for deploying software, where the image contains metadata and a plurality of layers. The method may then normalize the metadata to produce normalized metadata. The method may then generate hashed metadata by applying a first fuzzy hashing function to the normalized metadata. The method may further generate hashed layers by applying a second fuzzy hashing function to the plurality of layers of the image file. The method may then generate a first fingerprint for the image file based on the hashed metadata and the hashed layers. Then, the methods may determine a similarity between the first fingerprint and a second fingerprint by comparing the first fingerprint to the second fingerprint. ## Claims ### Claim 1 A non-transitory computer-readable medium comprising program code that is executable by one or more processors for causing the one or more processors to perform operations including: receiving an image file for deploying software, the image file including a plurality of layers; generating a hashed layer by applying a fuzzy hashing function to at least one layer of the plurality of layers of the image file; generating a first fingerprint for the image file based on the hashed layer; and determining a similarity between the first fingerprint and a second fingerprint by comparing the first fingerprint to the second fingerprint. ### Claim 2 (depends on 1) The non-transitory computer-readable medium of claim 1, wherein the second fingerprint is associated with the image file, and wherein the operations further comprise: in response to determining that the similarity between the first fingerprint and the second fingerprint meets or exceeds a predefined similarity threshold: storing an indication that the software is running in a computing cluster. ### Claim 3 (depends on 1) The non-transitory computer-readable medium of claim 1, wherein the second fingerprint is associated with the image file, and wherein the operations further comprise: in response to determining that the similarity between the first fingerprint and the second fingerprint is below a predefined similarity threshold: outputting a warning indicating the image file is not recognized. ### Claim 4 (depends on 1) The non-transitory computer-readable medium of claim 1, wherein the image file includes metadata, and wherein the operations further comprise: generating hashed metadata by applying a second hashing function to the metadata; and generating the first fingerprint for the image file based on the hashed metadata. ### Claim 5 (depends on 1) The non-transitory computer-readable medium of claim 1, wherein the fuzzy hashing function is a first fuzzy hashing function, and wherein the operations further comprise: generating a file path hash by applying a second fuzzy hashing function to a file path associated with a filesystem of the image file; and generating the first fingerprint based on the file path hash. ### Claim 6 (depends on 5) The non-transitory computer-readable medium of claim 5, wherein the first fuzzy hashing function is different from the second fuzzy hashing function. ### Claim 7 (depends on 1) The non-transitory computer-readable medium of claim 1, wherein the fuzzy hashing function is a first fuzzy hashing function, and wherein the operations further comprise: generating a file hash by applying a second fuzzy hashing function to an individual file in a filesystem of the image file; and generating the first fingerprint based on the file hash. ### Claim 8 (depends on 7) The non-transitory computer-readable medium of claim 7, wherein the first fuzzy hashing function is different from the second fuzzy hashing function. ### Claim 9 (depends on 1) The non-transitory computer-readable medium of claim 1, wherein the operations further comprise: generating hashed content by applying at least two fuzzy hashing functions to content of the image file; and generating the first fingerprint based on the hashed content. ### Claim 10 (depends on 1) The non-transitory computer-readable medium of claim 1, wherein the operations further comprise generating the first fingerprint by: iteratively combining different amounts and types of hashed content associated with the image file to produce a plurality of fingerprint candidates; determining that a particular fingerprint candidate, from among the plurality of fingerprint candidates, is most similar to the second fingerprint as compared to a remainder of the plurality of fingerprint candidates; and selecting the particular fingerprint candidate for use as the first fingerprint. ### Claim 11 (depends on 1) The non-transitory computer-readable medium of claim 1, wherein the fuzzy hashing function is a first fuzzy hashing function, and wherein the operations further comprise: generating an access permission hash by applying a second fuzzy hashing function to an access permission associated with the image file; and generating the first fingerprint based on the access permission hash. ### Claim 12 A system comprising: a processor; and a memory including program code that is executable by processor for causing the processor to perform operations including: receiving an image file for deploying software, the image file including a plurality of layers; generating a hashed layer by applying a fuzzy hashing function to at least one layer of the plurality of layers of the image file; and generating a first fingerprint for the image file based on the hashed layer. ### Claim 13 (depends on 12) The system of claim 12, wherein the operations further comprise: determining a similarity between the first fingerprint and a second fingerprint by comparing the first fingerprint to the second fingerprint; and in response to determining that the similarity between the first fingerprint and the second fingerprint meets or exceeds a predefined similarity threshold: storing an indication that the software is running in a computing cluster. ### Claim 14 (depends on 12) The system of claim 12, wherein the operations further comprise: determining a similarity between the first fingerprint and a second fingerprint by comparing the first fingerprint to the second fingerprint; and in response to determining that the similarity between the first fingerprint and the second fingerprint is below a predefined similarity threshold: outputting a warning indicating the image file is not recognized. ### Claim 15 (depends on 12) The system of claim 12, wherein the operations further comprise: generating first hashed content by applying a first fuzzy hashing function to first content of the image file; generating second hashed content by applying a second fuzzy hashing function to second content of the image file; and generating the first fingerprint based on the first hashed content and the second hashed content. ### Claim 16 (depends on 12) The system of claim 12, wherein the fuzzy hashing function is a first fuzzy hashing function, and wherein the operations further comprise: generating a file path hash by applying a second fuzzy hashing function to a file path associated with a filesystem of the image file; and generating the first fingerprint based on the file path hash. ### Claim 17 A method comprising: receiving, by one or more processors, an image file for deploying software, the image file including a plurality of layers; generating, by the one or more processors, a hashed layer by applying a fuzzy hashing function to at least one layer of the plurality of layers of the image file; generating, by the one or more processors, a first fingerprint for the image file based on the hashed layer; and determining, by the one or more processors, a similarity between the first fingerprint and a second fingerprint by comparing the first fingerprint to the second fingerprint. ### Claim 18 (depends on 17) The method of claim 17, further comprising: in response to determining that the similarity between the first fingerprint and the second fingerprint meets or exceeds a predefined similarity threshold: storing, by the one or more processors, an indication that the software is running in a computing cluster. ### Claim 19 (depends on 17) The method of claim 17, further comprising: in response to determining that the similarity between the first fingerprint and the second fingerprint is below a predefined similarity threshold: outputting, by the one or more processors, a warning indicating the image file is not recognized. ### Claim 20 (depends on 17) The method of claim 17, further comprising: generating first hashed content by applying a first fuzzy hashing function to first content of the image file, wherein the first content includes the at least one layer of the plurality of layers; generating second hashed content by applying a second fuzzy hashing function to second content of the image file; and generating the first fingerprint based on the first hashed content and the second hashed content.