Code package processing

Patent metadata

Field	Value
Publication number	US-11275838-B2
Application number	US-201916507667-A
Country	US
Kind code	B2
Filing date	Jul 10, 2019
Priority date	Oct 20, 2016
Publication date	Mar 15, 2022
Grant date	Mar 15, 2022

Abstract

A method and system. A dataset is generated according to a code package. The code package includes an image file associated with a container for a tenant in a cloud environment. The dataset includes general information related to security aspects of the image file. The image file includes two or more image layers. A security indicator of the image file is extracted according to the dataset. A security level of the image file is determined by comparing the extracted security indicator of the image file with a security indicator of an authenticated image file. A vulnerability in the image file is identified based on the determined security level. In response to the vulnerability having been identified, the image file is updated with a patch that fixes the identified vulnerability. The patch includes a new image layer added to the two or more image layers in the updated image file.

First claim

What is claimed is:

1. A method, said method comprising:
generating, by one or more processors of a computing system, a dataset according to a code package, the code package comprising an image file associated with a container for a tenant in a cloud environment, and the dataset comprising general information related to security aspects of the image file, said image file comprising a plurality of image layers;
extracting, by the one or more processors, a security indicator of the image file according to the dataset;
determining, by the one or more processors, a security level of the image file by comparing the extracted security indicator of the image file with a security indicator of an authenticated image file, wherein the authenticated image file was previously confirmed to be safe, wherein if said comparing demonstrates that the security indicator of the image file matches the security indicator of the authenticated image file then the image file is safe, and wherein if said comparing demonstrates that the security indicator of the image file does not match the security indicator of the authenticated image file then potential vulnerabilities may exist in the image file;
identifying, by the one or more processors, a vulnerability in the image file based on the determined security level; and
in response to the vulnerability having been identified, updating, by the one or more processors, the image file with a patch that fixes the identified vulnerability, said patch comprising:
creating a new image layer for the image file based on the patch;
adding the new image layer to the plurality of image layers in the updated image file; and
generating a mapping relationship between the image file and the new image layer.

2. The method of claim 1 , wherein said generating the dataset according to the code package comprises:
loading the image file into a Sand Box environment to initiate the container; and
obtaining package information of the container as the dataset by launching the initiated container.

3. The method of claim 1 , wherein said generating the dataset according to the code package comprises:
obtaining manifest data of the image file as the dataset by calling a registry Application Programming Interface (API).

4. The method of claim 1 , wherein said extracting the security indicator comprises:
extracting a root kit of the image file according to the dataset as the security indicator of the image file.

5. The method of claim 1 , said method further comprising:
obtaining, by the one or more processors, a tenant contract associated with a tenant type supported by the code package; and
updating, by the one or more processors, the image file with a further patch associated with a security requirement corresponding to the obtained tenant contract.

6. The method of claim 1 , said method further comprising:
in response to a pulling request for the code package from the tenant,
returning, by the one or more processors, the image file to the tenant; and
returning, by the one or more processors, the new image layer according to the mapping relationship.

7. A computing system, comprising one or more processors, one or more memories, and one or more computer readable hardware storage devices, said one or more hardware storage device containing program code executable by the one or more processors via the one or more memories to implement a method said method comprising:
generating, by the one or more processors, a dataset according to a code package, the code package comprising an image file associated with a container for a tenant in a cloud environment, and the dataset comprising general information related to security aspects of the image file, said image file comprising a plurality of image layers;
extracting, by the one or more processors, a security indicator of the image file according to the dataset;
determining, by the one or more processors, a security level of the image file by comparing the extracted security indicator of the image file with a security indicator of an authenticated image file, wherein the authenticated image file was previously confirmed to be safe, wherein if said comparing demonstrates that the security indicator of the image file matches the security indicator of the authenticated image file then the image file is safe, and wherein if said comparing demonstrates that the security indicator of the image file does not match the security indicator of the authenticated image file then potential vulnerabilities may exist in the image file;
identifying, by the one or more processors, a vulnerability in the image file based on the determined security level; and
in response to the vulnerability having been identified, updating, by the one or more processors, the image file with a patch that fixes the identified vulnerability, said patch comprising:
creating a new image layer for the image file based on the patch;
adding the new image layer to the plurality of image layers in the updated image file; and
generating a mapping relationship between the image file and the new image layer.

8. The computing system of claim 7 , wherein said generating the dataset according to the code package comprises:
loading the image file into a Sand Box environment to initiate the container; and
obtaining package information of the container as the dataset by launching the initiated container.

9. The computing system of claim 7 , wherein said generating the dataset according to the code package comprises:
obtaining manifest data of the image file as the dataset by calling a registry Application Programming Interface (API).

10. The computing system of claim 7 , wherein said extracting the security indicator comprises:
extracting a root kit of the image file according to the dataset as the security indicator of the image file.

11. The computing system of claim 7 , said method further comprising:
obtaining, by the one or more processors, a tenant contract associated with a tenant type supported by the code package; and
updating, by the one or more processors, the image file with a further patch associated with a security requirement corresponding to the obtained tenant contract.

12. The computing system of claim 7 , said method further comprising:
in response to a pulling request for the code package from the tenant,
returning, by the one or more processors, the image file to the tenant; and
returning, by the one or more processors, the new image layer according to the mapping relationship.

13. A computer program product, comprising one or more computer readable hardware storage devices having computer readable program code stored therein, said program code containing instructions executable by one or more processors of a computing system to implement a method, said method comprising:
generating, by the one or more processors, a dataset according to a code package, the code package comprising an image file associated with a container for a tenant in a cloud environment, and the dataset comprising general information related to security aspects of the image file;

determining, by the one or more processors, a security level of the image file according to the generated dataset, said image file comprising a plurality of image layers;
extracting, by the one or more processors, a security indicator of the image file according to the dataset;
determining, by the one or more processors, a security level of the image file by comparing the extracted security indicator of the image file with a security indicator of an authenticated image file, wherein the authenticated image file was previously confirmed to be safe

Assignees

• IBM

Inventors

• Cui Peng
• Hui Dong Xiao
• Jiang Tan
• Kuang Da Hu
• Ling Lan
• Peng Xu
• Wang Liang
• Zhang chun xiao
• Zhang Yu

Classifications

• G06F21/577 Primary

  Assessing vulnerabilities and evaluating computer system security · CPC title

• G06F2221/033

  Test or assess software · CPC title

• G06F8/65

  Updates (security arrangements therefor G06F21/57) · CPC title