Method to intelligently manage the end to end container compliance in cloud environments

Patent metadata

Field	Value
Publication number	US-12417293-B2
Application number	US-202418622522-A
Country	US
Kind code	B2
Filing date	Mar 29, 2024
Priority date	May 27, 2021
Publication date	Sep 16, 2025
Grant date	Sep 16, 2025

Abstract

One example method includes receiving data from a container data collector (CDC), and the data concerns a container, analyzing the data and, based on the analyzing, identifying a security tool needed to scan the container, drawing the security tool from a knowledge lake, executing the security tool to perform a vulnerability scan of the container, based on the executing of the security tool, generating and analyzing a report concerning the vulnerability scan, and transmitting the report, and results of the analyzing, to an alert and action stage.

First claim

What is claimed is:

1. A method, comprising:
receiving data from a container data collector (CDC), and the data concerns a container;
analyzing the data and, based on the analyzing, identifying a security tool needed to scan the container;
drawing the security tool from a knowledge lake;
executing the security tool to perform a vulnerability scan of the container;
based on the executing of the security tool, generating and analyzing a report concerning the vulnerability scan;
transmitting the report, and results of the analyzing, to an alert and action stage; and
the receiving, the analyzing of the data, the identifying, the drawing, the executing, the generating and the analyzing of the report, and the transmitting, are all performed by a device management console that comprises the CDC, an elastic container security hub (ECSH) module, the knowledge lake, the alert and action stage, and a fixed profile (FP) module.

2. The method as recited in claim 1 , wherein the vulnerability scan identifies a vulnerability in the container, and also identifies a potential resolution to the vulnerability.

3. The method as recited in claim 1 , wherein the report and/or results of the analyzing enable the alert and action stage to generate an alert which includes information that may be used by a fixed profile (FP) module to update a container image on which the container is based.

4. The method as recited in claim 1 , wherein a container image, on which the container is based, is updated based on the report and/or the results of the analyzing.

5. The method as recited in claim 1 , wherein the container is based on a container image, and a container image update is performed that results in an updated container image that lacks a vulnerability that was identified in the vulnerability scan.

6. The method as recited in claim 5 , wherein a container creation request is generated that triggers creation of a new container based on the updated container image, and the new container lacks the vulnerability.

7. The method as recited in claim 5 , wherein the updated container image is transmitted to a container image repository.

8. The method as recited in claim 1 , wherein the security tool is returned to the knowledge lake after the security tool is no longer needed.

9. The method as recited in claim 1 , wherein the CDC obtains the data concerning the container after the CDC determines that a host includes a container environment that includes the container.

10. A computer readable storage medium having stored therein instructions that are executable by one or more hardware processors to perform operations comprising:
receiving data from a container data collector (CDC), and the data concerns a container;
analyzing the data and, based on the analyzing, identifying a security tool needed to scan the container;
drawing the security tool from a knowledge lake;
executing the security tool to perform a vulnerability scan of the container;
based on the executing of the security tool, generating and analyzing a report concerning the vulnerability scan;
transmitting the report, and results of the analyzing, to an alert and action stage; and
the report and/or the results of the analyzing enable the alert and action stage to generate an alert which includes information that may be used by a fixed profile (FP) module to update a container image on which the container is based.

11. The computer readable storage medium as recited in claim 10 , wherein the vulnerability scan identifies a vulnerability in the container, and also identifies a potential resolution to the vulnerability.

12. The computer readable storage medium as recited in claim 10 , wherein a container image, on which the container is based, is updated based on the report and/or the results of the analyzing.

13. The computer readable storage medium as recited in claim 10 , wherein the container is based on a container image, and a container image update is performed that results in an updated container image that lacks a vulnerability that was identified in the vulnerability scan.

14. The computer readable storage medium as recited in claim 13 , wherein a container creation request is generated that triggers creation of a new container based on the updated container image, and the new container lacks the vulnerability.

15. The computer readable storage medium as recited in claim 13 , wherein the updated container image is transmitted to a container image repository.

16. The computer readable storage medium as recited in claim 10 , wherein the security tool is returned to the knowledge lake after the security tool is no longer needed.

17. The computer readable storage medium as recited in claim 10 , wherein the receiving, the analyzing of the data, the identifying, the drawing, the executing, the generating and the analyzing of the report, and the transmitting, are all performed by a device management console that comprises the CDC, an elastic container security hub (ECSH) module, the knowledge lake, the alert and action stage, and a fixed profile (FP) module.

18. The computer readable storage medium as recited in claim 10 , wherein the CDC obtains the data concerning the container after the CDC determines that a host includes a container environment that includes the container.

Assignees

• Emc Ip Holding Co Llc

Inventors

• Kumar Suren
• Durairaj Vinod

Classifications

• G06N5/02

  Knowledge representation; Symbolic representation · CPC title

• G06F2221/034

  Test or assess a computer or a system · CPC title

• G06N20/00

  Machine learning · CPC title

• G06F21/57

  Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities · CPC title

• G06F21/577 Primary

  Assessing vulnerabilities and evaluating computer system security · CPC title