IP Library › Granted Patent US 10,936,725
Granted Patent B2
US 10,936,725 · App. 16/163,197 · Granted Mar 2, 2021

Container image vulnerability reduction

Inventors: Azzedine Benameur (Fairfax, VA); Chien An Chen (Fairfax, VA); Lei Ding (North Potomac, MD)
Assignee: Accenture Global Solutions Limited
G06F21/577G06F9/45558G06F9/545G06F16/16G06F2009/45587
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 10,936,725
App. No.
16/163,197
Filed
Oct 17, 2018
Granted
Mar 2, 2021
Kind
B2
Art Unit
2493
USPC
726/25
Abstract

Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for container image vulnerability reduction. In one aspect, a method includes obtaining a first container image that is formed from a set of files, determining that a first particular file of the set of files is necessary for an application and a second particular file of the set of files is not necessary for the application based on execution of the application in a first container instantiated with the first container image, in response generating a second container image from the first particular file and not from the second particular file, and executing the application in a second container instantiated with the second container image.

Claims (62)

1. A computer-implemented method comprising:

obtaining a first container image that is formed from a set of files;

determining that a first particular file of the set of files is necessary for an application and a second particular file of the set of files is not necessary for the application based on execution of the application in a first container instantiated with the first container image;

in response to determining that the first particular file of the set of files is necessary for an application and the second particular file of the set of files is not necessary for the application based on execution of the application in the first container instantiated with the first container image, generating a second container image from the first particular file and not from the second particular file; and

executing the application in a second container instantiated with the second container image,

wherein determining that the first particular file of the set of files is necessary for the application and the second particular file of the set of files is not necessary for the application based on execution of the application in the first container instantiated with the first container image includes obtaining, from a kernel of an operating system that hosts the first container, an indication that a file system event of accessing was performed with the first particular file.

2. The method of claim 1 , wherein determining that a first particular file of the set of files is necessary for an application and a second particular file of the set of files is not necessary for the application based on execution of the application in the first container instantiated with the first container image comprises:

determining that a function that uses the first particular file was called.

3. The method of claim 1 , wherein determining that a first particular file of the set of files is necessary for an application and a second particular file of the set of files is not necessary for the application based on execution of the application in the first container instantiated with the first container image comprises:

determining that a predetermined time period has elapsed without the second particular file being accessed.

4. The method of claim 1 , wherein determining that a first particular file of the set of files is necessary for an application and a second particular file of the set of files is not necessary for the application based on execution of the application in the first container instantiated with the first container image comprises:

determining that a predetermined time period has elapsed without a function that uses the second particular file being called.

5. The method of claim 1 , wherein generating a second container image from the first particular file and not from the second particular file comprises:

copying the first particular file into a new folder with a subfolder that matches a subfolder of the first particular file in the first container image; and

generating the second container image based on the subfolder structure of files within the new folder.

6. The method of claim 5 , wherein generating a second container image from the first particular file and not from the second particular file comprises:

updating symbolic links in files within the new folder to use the new folder.

7. The method of claim 1 , comprising:

identifying a first set of vulnerabilities in the first container image;

identifying a second set of vulnerabilities in the second container image; and

providing an indication of a difference between the first set of vulnerabilities and the second set of vulnerabilities.

8. A system comprising:

one or more computers and one or more storage devices storing instructions that are operable, when executed by the one or more computers, to cause the one or more computers to perform operations comprising:

obtaining a first container image that is formed from a set of files;

determining that a first particular file of the set of files is necessary for an application and a second particular file of the set of files is not necessary for the application based on execution of the application in a first container instantiated with the first container image;

in response to determining that the first particular file of the set of files is necessary for an application and the second particular file of the set of files is not necessary for the application based on execution of the application in the first container instantiated with the first container image, generating a second container image from the first particular file and not from the second particular file; and

executing the application in a second container instantiated with the second container image,

wherein determining that the first particular file of the set of files is necessary for the application and the second particular file of the set of files is not necessary for the application based on execution of the application in the first container instantiated with the first container image includes obtaining, from a kernel of an operating system that hosts the first container, an indication that a file system event of accessing was performed with the first particular file.

9. The system of claim 8 , wherein determining that a first particular file of the set of files is necessary for an application and a second particular file of the set of files is not necessary for the application based on execution of the application in the first container instantiated with the first container image comprises:

determining that a function that uses the first particular file was called.

10. The system of claim 8 , wherein determining that a first particular file of the set of files is necessary for an application and a second particular file of the set of files is not necessary for the application based on execution of the application in the first container instantiated with the first container image comprises:

determining that a predetermined time period has elapsed without the second particular file being accessed.

11. The system of claim 8 , wherein determining that a first particular file of the set of files is necessary for an application and a second particular file of the set of files is not necessary for the application based on execution of the application in the first container instantiated with the first container image comprises:

determining that a predetermined time period has elapsed without a function that uses the second particular file being called.

12. The system of claim 8 , wherein generating a second container image from the first particular file and not from the second particular file comprises:

copying the first particular file into a new folder with a subfolder that matches a subfolder of the first particular file in the first container image; and

generating the second container image based on the subfolder structure of files within the new folder.

13. The system of claim 12 , wherein generating a second container image from the first particular file and not from the second particular file comprises:

updating symbolic links in files within the new folder to use the new folder.

14. The system of claim 8 , the operations comprising:

identifying a first set of vulnerabilities in the first container image;

identifying a second set of vulnerabilities in the second container image; and

providing an indication of a difference between the first set of vulnerabilities and the second set of vulnerabilities.

15. A non-transitory computer-readable medium storing instructions executable by one or more computers which, upon such execution, cause the one or more computers to perform operations comprising:

obtaining a first container image that is formed from a set of files;

determining that a first particular file of the set of files is necessary for an application and a second particular file of the set of files is not necessary for the application based on execution of the application in a first container instantiated with the first container image;

in response to determining that the first particular file of the set of files is necessary for an application and the second particular file of the set of files is not necessary for the application based on execution of the application in the first container instantiated with the first container image, generating a second container image from the first particular file and not from the second particular file; and

executing the application in a second container instantiated with the second container image,

wherein determining that the first particular file of the set of files is necessary for the based on execution of the application in the first container instantiated with the first container image includes obtaining, from a kernel of an operating system that hosts the first container, an indication that a file system event of accessing was performed with the first particular file.

16. The medium of claim 15 , wherein determining that a first particular file of the set of files is necessary for an application and a second particular file of the set of files is not necessary for the application based on execution of the application in the first container instantiated with the first container image comprises:

determining that a function that uses the first particular file was called.

17. The medium of claim 15 , wherein determining that a first particular file of the set of files is necessary for an application and a second particular file of the set of files is not necessary for the application based on execution of the application in the first container instantiated with the first container image comprises:

determining that a predetermined time period has elapsed without the second particular file being accessed.

18. The medium of claim 15 , wherein generating a second container image from the first particular file and not from the second particular file comprises:

copying the first particular file into a new folder with a subfolder that matches a subfolder of the first particular file in the first container image; and

generating the second container image based on the subfolder structure of files within the new folder.

19. The medium of claim 18 , wherein generating a second container image from the first particular file and not from the second particular file comprises:

updating symbolic links in files within the new folder to use the new folder.

20. The medium of claim 15 , the operations comprising:

identifying a first set of vulnerabilities in the first container image;

identifying a second set of vulnerabilities in the second container image; and

providing an indication of a difference between the first set of vulnerabilities and the second set of vulnerabilities.

Assignments (1)
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Dec 27, 2018
From: BENAMEUR, AZZEDINE; CHEN, CHIEN AN; DING, LEI
To: ACCENTURE GLOBAL SOLUTIONS LIMITED
Reel/Frame 047858/0478 →
Continuity (1)
Related Publication 20200125731A1 · Apr 23, 2020
Cited By (1)
US 12,717,621