IP Library › Granted Patent US 11,647,040

Granted Patent B1

US 11,647,040 · App. 17/864,905 · Granted May 9, 2023

Vulnerability scanning of a remote file system

Inventors: Kevin Douglas (Vienna, VA); Matthew Wirges (West Bend, WI)

Assignee: TENABLE, INC.

H04L63/1433 G06F21/6209

View Patent ↗

Loading inventors, assignments & file history…

Monitor This Case

Get email alerts when status or documents change.

Order Certified Copies

Most orders are placed with the USPTO same day — all within 24 business hours.

Order via The Patent Place →

Pre-filled with this patent's details

Quick Facts

Patent No.: US 11,647,040
App. No.: 17/864,905
Granted: May 9, 2023
Kind: B1

External Links

USPTO Patent Center↗ Full Patent PDF↗

Abstract

In an embodiment, a vulnerability scanner component determines one or more target software objects of a remote file system for a vulnerability scan, and performs, via a file system application programming interface (API), a file system decoding procedure based on information associated with the remote file system to determine a subset of disk blocks of the remote file system that comprise the one or more target software objects. The vulnerability scanner component transmits, to a remote device, a read request associated with the subset of disk blocks, and obtains, in response to the read request, the subset of disk blocks (e.g., rather than a full disk image). The vulnerability scanner component extracts the one or more target software objects from the subset of disk blocks, and performs the vulnerability scan on the extracted one or more target software objects.

Claims (108)

1. A method of operating a vulnerability scanner component, comprising:

determining one or more target software objects of a remote file system for a vulnerability scan;

performing, via a file system application programming interface (API), a file system decoding procedure based on information associated with the remote file system to determine a subset of disk blocks of the remote file system that comprise the one or more target software objects;

transmitting, to a remote device, a read request associated with the subset of disk blocks;

obtaining, in response to the read request, the subset of disk blocks;

extracting the one or more target software objects from the subset of disk blocks; and

performing the vulnerability scan on the extracted one or more target software objects,

wherein the vulnerability scanner component is allocated read-only access to data associated with the remote file system.

2. The method of claim 1 ,

wherein the remote device corresponds to an asset that is executing the remote file system or to a device that is hosting a disk image of the remote file system, and

wherein the read request requests the subset of disk blocks.

3. The method of claim 1 , wherein the one or more target software objects comprise one or more file system registry files of the remote file system.

4. The method of claim 1 , wherein the remote file system is an X-Methods file system (XFS), extension 4 (EXT4) or New Technology File System (NTFS).

5. A method of operating a vulnerability scanner component, comprising:

determining one or more target software objects of a remote file system for a vulnerability scan;

mapping the subset of disk blocks to a set of cloud storage blocks associated with a cloud service that comprise the subset of disk blocks;

transmitting, to a remote device, a read request associated with the subset of disk blocks,

wherein the read request is transmitted to the cloud service, and

wherein the read request requests the set of cloud storage blocks that comprise the subset of disk blocks;

obtaining, in response to the read request, the subset of disk blocks;

extracting the one or more target software objects from the subset of disk blocks; and

performing the vulnerability scan on the extracted one or more target software objects.

6. The method of claim 5 ,

wherein the cloud service is Amazon Web Services (AWS), and the set of cloud storage blocks is a set of Elastic Block Stores (EBSs), or

wherein the cloud service is Microsoft Azure, and the set of cloud storage blocks is a set of Blobs.

7. A method of operating a vulnerability scanner component, comprising:

determining one or more target software objects of a remote file system for a vulnerability scan;

transmitting, to a remote device, a read request associated with the subset of disk blocks;

obtaining, in response to the read request, the subset of disk blocks;

extracting the one or more target software objects from the subset of disk blocks; and

performing the vulnerability scan on the extracted one or more target software objects,

wherein the read request does not trigger retrieval of a disk image of the remote file system.

8. A vulnerability scanner component, comprising:

a memory; and

at least one processor communicatively coupled to the memory, the at least one processor configured to:

determine one or more target software objects of a remote file system for a vulnerability scan;

perform, via a file system application programming interface (API), a file system decoding procedure based on information associated with the remote file system to determine a subset of disk blocks of the remote file system that comprise the one or more target software objects;

transmit, to a remote device, a read request associated with the subset of disk blocks;

obtain, in response to the read request, the subset of disk blocks;

extract the one or more target software objects from the subset of disk blocks; and

perform the vulnerability scan on the extracted one or more target software objects,

wherein the vulnerability scanner component is allocated read-only access to data associated with the remote file system.

9. The vulnerability scanner component of claim 8 ,

wherein the remote device corresponds to an asset that is executing the remote file system or to a device that is hosting a disk image of the remote file system, and

wherein the read request requests the subset of disk blocks.

10. The vulnerability scanner component of claim 8 , wherein the one or more target software objects comprise one or more file system registry files of the remote file system.

11. The vulnerability scanner component of claim 8 , wherein the remote file system is an X-Methods file system (XFS), extension 4 (EXT4) or New Technology File System (NTFS).

12. A vulnerability scanner component, comprising:

a memory; and

at least one processor communicatively coupled to the memory, the at least one processor configured to:

determine one or more target software objects of a remote file system for a vulnerability scan;

map the subset of disk blocks to a set of cloud storage blocks associated with a cloud service that comprise the subset of disk blocks;

transmit, to a remote device, a read request associated with the subset of disk blocks,

wherein the read request is transmitted to the cloud service, and

wherein the read request requests the set of cloud storage blocks that comprise the subset of disk blocks;

obtain, in response to the read request, the subset of disk blocks;

extract the one or more target software objects from the subset of disk blocks; and

perform the vulnerability scan on the extracted one or more target software objects.

13. The vulnerability scanner component of claim 12 ,

wherein the cloud service is Amazon Web Services (AWS), and the set of cloud storage blocks is a set of Elastic Block Stores (EBSs), or

wherein the cloud service is Microsoft Azure, and the set of cloud storage blocks is a set of Blobs.

14. A vulnerability scanner component, comprising:

a memory; and

at least one processor communicatively coupled to the memory, the at least one processor configured to:

determine one or more target software objects of a remote file system for a vulnerability scan;

transmit, to a remote device, a read request associated with the subset of disk blocks;

obtain, in response to the read request, the subset of disk blocks;

extract the one or more target software objects from the subset of disk blocks; and

perform the vulnerability scan on the extracted one or more target software objects,

wherein the read request does not trigger retrieval of a disk image of the remote file system.

15. A non-transitory computer-readable medium storing computer-executable instructions that, when executed by a vulnerability scanner component, cause the vulnerability scanner component to:

determine one or more target software objects of a remote file system for a vulnerability scan;

transmit, to a remote device, a read request associated with the subset of disk blocks;

obtain, in response to the read request, the subset of disk blocks;

extract the one or more target software objects from the subset of disk blocks; and

perform the vulnerability scan on the extracted one or more target software objects,

wherein the vulnerability scanner component is allocated read-only access to data associated with the remote file system.

16. The non-transitory computer-readable medium of claim 15 ,

wherein the remote device corresponds to an asset that is executing the remote file system or to a device that is hosting a disk image of the remote file system, and

wherein the read request requests the subset of disk blocks.

17. The non-transitory computer-readable medium of claim 15 , wherein the one or more target software objects comprise one or more file system registry files of the remote file system.

18. The non-transitory computer-readable medium of claim 15 , wherein the remote file system is an X-Methods file system (XFS), extension 4 (EXT4) or New Technology File System (NTFS).

19. A non-transitory computer-readable medium storing computer-executable instructions that, when executed by a vulnerability scanner component, cause the vulnerability scanner component to: