System and method for agent- less scanning of cloud infrastructure

Patent metadata

Field	Value
Publication number	US-2025004813-A1
Application number	US-202318344277-A
Country	US
Kind code	A1
Filing date	Jun 29, 2023
Priority date	Jun 29, 2023
Publication date	Jan 2, 2025
Grant date	—

Abstract

A method and a system of an agent-less scanning of cloud infrastructure is disclosed. The method includes running a virtual machine (VM) from a customer account and creating a snapshot of the VM in the customer account and saving the snap-shot of the virtual machine into a storage account. The method further includes creating at least one of: a docker image, a VM instance and a bare-metal system by restoring the respective snapshot saved in the storage account and gaining access to a restored system. The method further includes scanning the restored system by one of: using an ephemeral scanner that runs during a boot time of an instance or using a docker based command on a launched container and terminating instances of an ephemeral scanner by sending a message to at least one of: a cloud and a plurality of cloud servers for terminating the instances.

First claim

What is claimed is:

1 . A method of an agent-less scanning of cloud infrastructure, the method comprises:
running a virtual machine (VM) from a customer account and creating a snapshot of the VM in the customer account and saving the snapshot of the virtual machine into a storage account; creating at least one of: a docker image, a VM instance and a bare-metal system, by restoring the snapshot saved in the storage account and gaining access to a restored system; and scanning the restored system by one of: using an ephemeral scanner that runs during a boot time of an instance or using a docker based command on a launched container.

2 . The method of claim 1 , further comprises terminating one or more instances of the ephemeral scanner by sending a message to at least one of: a cloud and a plurality of cloud servers for terminating the instances.

3 . The method of claim 1 , wherein the method further comprises leveraging a cloud init functionality exposed by a plurality of cloud vendors to run an agent-less scanning during the boot time of an instance, in a linux based system.

4 . The method of claim 3 , further comprises obtaining a new snapshot to get the latest state of the system scanned during the scan runs.

5 . The method of claim 3 , wherein the cloud-init functionality allows the scanner to run at boot time with elevated privileges which allows performing at least one of: a misconfiguration check or a compliance check at an operating system (OS) level.

6 . The method of claim 1 , wherein scanning the system in windows comprises:
preparing a windows system by performing the steps comprising:
a) launching a windows snapshot of a source system to be scanned; and
b) detaching a boot volume of the source system and launching a temporary linux instance with a secure shell (ssh) access enabled;
attaching the boot volume of the source system to a temporary linux system; starting the temporary linux system and mounting the windows disk on the temporary linux system using cloud init; and booting up the windows machines and running the scanner during windows startup and receiving the functionality comprising the misconfiguration check and the compliance check at an operating system (OS) level.

7 . The method of claim 6 , wherein launching windows snapshot of source system to be scanned further comprises:
launching the windows snapshot; and shutting down the instance after the window snapshot is launched.

8 . The method of claim 6 , wherein detaching the boot volume comprises detaching a disk from the system.

9 . The method of claim 6 , wherein starting temporary linux system further comprises:
installing a new technology file system (ntfs) driver on the linux system; installing a chntpw utility; mounting a new technology file system (ntfs) volume; injecting a windows service to start on the next launch of the windows instance using a reged command; and installing a required service binary on the windows disk and configuring a service binary to start the scanner when windows starts up and unmounting the volume.

10 . The method of claim 1 , wherein scanning of the docker image further comprises:
launching a docker image; and running the scan operations using docker command for performing a scan task.

11 . A system of an agent-less scanning of cloud infrastructure, the system comprising:
a memory for storing one or more executable modules; and
a processor for executing the one or more executable modules for agent-less scanning, the one or more executable modules comprising:
a running module for running a virtual machine (VM) from a customer account and creating a snapshot of the VM in the customer account and saving the snapshot of the virtual machine into a storage account;
a creation module for creating at least one of: a docker image, a virtual machine instance and a bare-metal system by restoring the respective snapshot saved in the storage account and gaining access to a restored system;
a scan module for scanning the restored system by one of: using an ephemeral scanner that runs during a boot time of an instance or using a docker based command on a launched container; and
a termination module for terminating instances of an ephemeral scanner by sending a message to at least one of: a cloud and a plurality of cloud servers for terminating the instances.

12 . The system of claim 11 , wherein the scan module is further configured for leveraging a cloud init functionality exposed by a plurality of cloud vendors to run an agent-less scanning during the boot time of an instance.

13 . The system of claim 11 , wherein the scan module is further configured for obtaining a new snapshot to get the latest state of the system scanned during the scan runs.

14 . The system of claim 11 , wherein the cloud-init functionality allows the scanner to run at boot time with elevated privileges which allows to perform at least one of: misconfiguration or compliance checks at an operating system (OS) level.

15 . The system of claim 11 , wherein the scan module is further configured for:
preparing a windows system by performing the steps comprising:
a) launching a windows snapshot of a source system to be scanned; and
b) detaching a boot volume of the source system and launching a temporary linux instance with a secure shell (ssh) access enabled.
attaching the boot volume of the source system to the temporary linux system. starting the temporary linux system and mounting the windows disk on the temporary linux system using cloud init; and booting up the windows machines and running the scanner during windows startup and receiving the functionality comprising the misconfiguration and compliance checks at an operating system (OS) level.

16 . The system of claim 15 , wherein the scan module is further configured for:
launching the windows snapshot. shutting down the instance after the window snapshot is launched; and detaching a disk from the system.

17 . The system of claim 15 , wherein the scan module is further configured for:
installing a new technology file system (ntfs) driver on the linux system; installing a chntpw utility. mounting a new technology file system (ntfs) volume.
injecting a windows service to start on the next launch of the windows instance using a reged command; and
installing a required service binary on the windows disk and configuring a service binary to start the scanner when windows starts up and unmounting the volume.

18 . The system of claim 11 , wherein the creation module is further configured for:
launching a docker image; and
running the scan operations using docker command which performs the scan tasks for at least one of: operating system (OS) misconfigurations, software vulnerabilities and malware and ransomware scan.

Assignees

• Colortokens Inc

Inventors

• Pattabhi Ravi

Classifications

• G06F2009/45575

  Starting, stopping, suspending or resuming virtual machine instances · CPC title

• G06F2009/45562

  Creating, deleting, cloning virtual machine instances · CPC title

• G06F2009/45587

  Isolation or security of virtual machine instances · CPC title

• G06F2009/45591

  Monitoring or debugging support · CPC title

• G06F9/45558 Primary

  Hypervisor-specific management and integration aspects · CPC title