K-anonymous vulnerability detection
K-anonymous vulnerability detection is disclosed. Data descriptive of a container image including at least one container layer having a layer identifier is received. The layer identifier is encoded to produce an encoded layer identifier. A first portion of the layer identifier is transmitted to a vulnerability registry server. One or more vulnerability identifiers are received from the vulnerability server. The vulnerability identifiers are associated with the first portion of the encoded layer identifier. It is determined that the layer identifier matches a matching vulnerability identifier of the one or more vulnerability identifiers.
1. A method comprising:
receiving, by a computer system comprising one or more computing devices, data descriptive of a container image, the container image comprising at least one container layer, the at least one container layer having a layer identifier comprising a plurality of characters;
encoding, by the computer system, a first portion of the layer identifier to produce an encoded identifier, wherein the first portion of the layer identifier comprises a plurality of first characters of the plurality of characters, and wherein a second portion of the layer identifier comprises a remainder of the layer identifier comprising at least one second character of the plurality of characters;
transmitting, by the computer system, the encoded identifier to a vulnerability registry server;
receiving, by the computer system, one or more vulnerability identifiers from the vulnerability registry server, each of the one or more vulnerability identifiers associated with the first portion of the layer identifier and respectively comprising second portions; and
determining, by the computer system, that the layer identifier matches a matching vulnerability identifier of the one or more vulnerability identifiers based on a comparison between a second portion of the layer identifier and a corresponding second portion of the matching vulnerability identifier.
2. The method of claim 1 , wherein the method further comprises, in response to determining that the layer identifier matches the matching vulnerability identifier, handling a vulnerability in the container image.
3. The method of claim 1 , wherein encoding the first portion of the layer identifier comprises truncating the second portion of the layer identifier from the layer identifier to produce the encoded identifier.
4. The method of claim 1 , wherein encoding the first portion of the layer identifier comprises hashing the layer identifier with a hashing algorithm configured to receive the layer identifier as input and produce as output the encoded identifier, wherein the encoded identifier comprises a hashed identifier.
5. The method of claim 4 , wherein the hashing algorithm comprises at least one of a Message-Digest 5 (MD5) algorithm, a Secure Hash Algorithm 1 (SHA-1) algorithm, a Secure Hash Algorithm 2 (SHA-2) algorithm, a New Technology LAN Manager (NTLM) algorithm, or a Cyclic Redundancy Check 32 (CRC32) algorithm.
6. The method of claim 1 , wherein the plurality of first characters of the first portion of the layer identifier comprises a first set of consecutive characters of the layer identifier, and wherein the at least one second character of the second portion of the layer identifier comprises a second set of consecutive characters of the layer identifier.
7. The method of claim 1 , wherein receiving the data descriptive of the container image comprises receiving, by the computer system, a command to download the container image, and wherein the method further comprises, in response to determining that the layer identifier matches the matching vulnerability identifier, aborting a download process of the container image.
8. The method of claim 1 , wherein the method further comprises:
determining, by the computer system, that the layer identifier does not match any of the one or more vulnerability identifiers; and
in response to determining that the layer identifier does not match any of the one or more vulnerability identifiers, transmitting a communication to one or more remote computing devices indicating that the container image does not match any of the one or more vulnerability identifiers.
9. The method of claim 1 , wherein the vulnerability registry server comprises a Common Vulnerabilities and Exposures (CVE) database.
10. A computer system comprising:
one or more computing devices to:
receive data descriptive of a container image, the container image comprising at least one container layer, the at least one container layer having a layer identifier comprising a plurality of characters;
encode a first portion of the layer identifier to produce an encoded identifier, wherein the first portion of the layer identifier comprises a plurality of first characters of the plurality of characters, and wherein a second portion of the layer identifier comprises a remainder of the layer identifier comprising at least one second character of the plurality of characters;
transmit the encoded identifier to a vulnerability registry server;
receive one or more vulnerability identifiers from the vulnerability registry server, each of the one or more vulnerability identifiers associated with the first portion of the layer identifier and respectively comprising second portions; and
determine that the layer identifier matches a matching vulnerability identifier of the one or more vulnerability identifiers based on a comparison between a second portion of the layer identifier and a corresponding second portion of the matching vulnerability identifier.
11. The computer system of claim 10 , wherein the one or more computing devices are further to, in response to determining that the layer identifier matches the matching vulnerability identifier, identify a vulnerability in the container image.
12. The computer system of claim 10 , wherein, to encode the first portion of the layer identifier, the one or more computing devices are further to truncate the second portion of the layer identifier from the layer identifier to produce the encoded identifier.
13. The computer system of claim 10 , wherein, to encode the first portion of the layer identifier, the one or more computing devices are further to hash the layer identifier with a hashing algorithm configured to receive the layer identifier as input and produce as output the encoded identifier, wherein the encoded identifier comprises a hashed identifier.
14. The computer system of claim 13 , wherein the hashing algorithm comprises at least one of a Message-Digest 5 (MD5) algorithm, a Secure Hash Algorithm 1 (SHA-1) algorithm, a Secure Hash Algorithm 2 (SHA-2) algorithm, a New Technology LAN Manager (NTLM) algorithm, or a Cyclic Redundancy Check 32 (CRC32) algorithm.
15. The computer system of claim 10 , wherein, to receive the data descriptive of the container image, the one or more computing devices are further to receive, by the computer system, a command to download the container image, and wherein the one or more computing devices are further to, in response to determining that the layer identifier matches the matching vulnerability identifier, abort a download process of the container image.
16. The computer system of claim 10 , wherein the one or more computing devices are further to:
determine that the layer identifier does not match any of the one or more vulnerability identifiers; and
in response to determining that the layer identifier does not match any of the one or more vulnerability identifiers, transmit a communication to one or more remote computing devices indicating that the container image does not match any of the one or more vulnerability identifiers.
17. A non-transitory computer-readable storage medium that includes executable instructions to cause one or more processor devices to:
receive data descriptive of a container image, the container image comprising at least one container layer, the at least one container layer having a layer identifier comprising a plurality of characters;
encode a first portion of the layer identifier to produce an encoded identifier, wherein the first portion of the layer identifier comprises a plurality of first characters of the plurality of characters, and wherein a second portion of the layer identifier comprises a remainder of the layer identifier comprising at least one second character of the plurality of characters;
transmit the encoded identifier to a vulnerability registry server;
receive one or more vulnerability identifiers from the vulnerability registry server, each of the one or more vulnerability identifiers associated with the first portion of the layer identifier and respectively comprising second portions; and
determine that the layer identifier matches a matching vulnerability identifier of the one or more vulnerability identifiers based on a comparison between a second portion of the layer identifier and a corresponding second portion of the matching vulnerability identifier.
18. The medium of claim 17 , wherein the instructions further cause the one or more processor devices to, in response to determining that the layer identifier matches the matching vulnerability identifier, identify a vulnerability in the container image.
19. The medium of claim 17 , wherein to encode the first portion of the layer identifier, the instructions further cause the one or more processor devices to truncate the second portion of the layer identifier from the layer identifier to produce the encoded identifier.
20. The medium of claim 17 , wherein, to encode the first portion of the layer identifier, the instructions further cause the one or more processor devices to hash the layer identifier with a hashing algorithm configured to receive the layer identifier as input and produce as output the encoded identifier, wherein the encoded identifier comprises a hashed identifier.