JP2023062394A - Processing device and processing method - Google Patents

Abstract

To provide a processing device and a processing method, capable of supporting appropriate execution of countermeasures against vulnerabilities of programs included in container images.SOLUTION: A processing device includes a control unit which scans a container constructed by executing a container image for identifying an execution program executed in the container, wherein the control unit identifies vulnerabilities of the execution program, and executes triage processing to set priorities for countermeasures against vulnerabilities of programs included in the container image based on the identified vulnerabilities.SELECTED DRAWING: Figure 4

Description

The present invention relates to a processing apparatus and a processing method.

Conventionally, a virtualization technology is known in which two or more guest OSs run on a hypervisor by providing a virtualization layer (for example, a hypervisor) on the host OS (operation system) of a physical server. there is

Furthermore, attention is being focused on container technology that provides a common host OS without providing a guest OS by providing a container engine instead of a hypervisor. In container technology, virtualization is realized by containers constructed by executing container images.

Under such circumstances, a technology has been proposed to determine vulnerabilities of all programs included in a container image by statically scanning the container image (for example, Patent Literature 1).

U.S. Patent Application Publication No. 2018/0041539

As a result of extensive research, the inventors have noticed that not all programs included in a container image are executed when an application is executed using a container. Based on this new focus, assuming the setting of priorities for countermeasures against vulnerabilities (hereinafter referred to as triage), judging the vulnerabilities of all the programs included in the container image reveals that the vulnerability of the program The work for the developer to check is extremely complicated.

SUMMARY OF THE INVENTION Accordingly, the present invention has been made to solve the above-described problems, and provides a processing apparatus and processing method capable of supporting appropriate execution of countermeasures against vulnerabilities in programs included in container images. With the goal.

A processing device according to the disclosure includes a control unit that identifies an execution program executed in the container by scanning a container constructed by executing a container image, and the control unit identifies vulnerabilities of the execution program. Based on the identified vulnerabilities, triage processing is performed to set priorities for countermeasures against vulnerabilities of programs included in the container image.

The disclosed processing method comprises a step A of identifying an execution program executed in the container by scanning a container constructed by executing a container image; and a step B of executing a triage process of setting priorities for countermeasures against vulnerabilities of programs included in the container image, based on the vulnerabilities.

According to the present invention, it is possible to provide a processing device and a processing method capable of supporting appropriate execution of countermeasures against vulnerabilities of programs included in container images.

FIG. 1 is a diagram showing a processing system 100 according to an embodiment. FIG. 2 is a diagram for explaining container technology according to the embodiment. FIG. 3 is a diagram for explaining container technology according to the embodiment. FIG. 4 is a diagram showing the processing device 10 according to the embodiment. FIG. 5 is a diagram illustrating an example of triage processing in the embodiment; FIG. 6 is a diagram showing a processing method according to the embodiment.

Embodiments will be described below with reference to the drawings. In addition, in the following description of the drawings, the same or similar reference numerals are given to the same or similar parts.

However, it should be noted that the drawings are schematic, and the ratio of each dimension may differ from the actual one. Therefore, specific dimensions should be determined with reference to the following description. In addition, it is needless to say that the drawings may include portions having different dimensional relationships or ratios.

[Summary of Disclosure]
A processing apparatus according to an outline of the disclosure includes a control unit that identifies an execution program executed in the container by scanning a container constructed by executing a container image, and the control unit identifies vulnerabilities of the execution program. Then, on the basis of the identified vulnerabilities, triage processing is executed to set priorities for countermeasures against the vulnerabilities of the programs included in the container image.

A processing method according to the outline of the disclosure includes step A of identifying an execution program executed in the container by scanning a container constructed by executing a container image; and a step B of executing a triage process of setting priorities for countermeasures against vulnerabilities of programs included in the container image, based on the identified vulnerabilities.

In an overview of the disclosure, a processing device identifies executable programs that run in containers by scanning containers constructed by executing container images, and based on vulnerabilities of the executable programs, programs included in the container images. perform a triage process that prioritizes the vulnerabilities to be addressed. With such a configuration, assuming the application usage scene, the triage process is executed by focusing on the vulnerabilities of the executable program rather than the vulnerabilities of all the programs included in the container image. , it is possible to reduce the complexity of checking the vulnerabilities of the programs included in the container image, and to support the appropriate implementation of countermeasures against the vulnerabilities.

Here, the program is a process group (instruction group) for the OS (Operation System) kernel shared by the containers. A program may be used as a concept including software and middleware. The software may include OSS (Open Source Software) in which the source code of the software is open to the public.

[Embodiment]
(processing system)
A processing system according to an embodiment will be described below. FIG. 1 is a diagram showing a processing system 100 according to an embodiment.

As shown in FIG. 1, the processing system 100 has a processing device 10, a user terminal 20, a providing device 30, and an external device 40. FIG. The processing device 10, the user terminal 20, the providing device 30, and the external device 40 are communicably connected by a network 200. FIG. Network 200 may include, but is not limited to, the Internet, a local area network, or a mobile communication network. Network 200 may include a VPN (Virtual Private Network).

The processing device 10 sets priorities for countermeasures against vulnerabilities of programs included in applications provided by the providing device 30 . The processing device 10 may be composed of two or more servers, and at least part of the processing device 10 may be realized by a cloud computing service. Details of the processor 10 will be described later (see FIG. 2).

The user terminal 20 has a display 21 and displays the priorities set by the processing device 10. FIG. User terminal 20 may be a device utilized by a project developer. For example, the user terminal 20 may be a personal computer, a smart phone, or a tablet terminal. For example, the display 21 may be a liquid crystal panel or an organic EL panel.

The providing device 30 provides an application realized by two or more programs. Applications are provided by virtualization technology called container technology. The providing device 30 may be composed of two or more servers, and at least part of the providing device 30 may be realized by cloud computing services.

The external device 40 manages information about program vulnerabilities. The external device 40 may manage a vulnerability score regarding the vulnerability of the program itself. A CVSS (Common Vulnerability Scoring System) provided by a third party may be used as the vulnerability score. The external device 40 may manage the vulnerability content of processes executed by the program. Vulnerability content may be associated with package information (for example, package name) regarding a package containing two or more program groups. CVE (Common Vulnerabilities and Exposures) provided by a third party may be used as the contents of vulnerabilities associated with the package information. The vulnerability content may be associated with program information (for example, software name) about the program. Information generated based on an NVD (National Vulnerability Database) provided by a third party may be used as the vulnerability content associated with the program information. The external device 40 may be composed of two or more servers, and at least part of the external device 40 may be realized by cloud computing services.

Here, the contents of the vulnerability (for example, CVE) associated with the package information may be managed by a first device constructed by a third party. The contents of the vulnerability associated with the package information may be information disclosed to the outside in the network 200. FIG.

On the other hand, the vulnerability content (eg, NVD-based content) associated with program information may be managed in a second device constructed by an entity that provides triage processing. The details of the vulnerability associated with the package information may be information that is not open to the public on the network 200 .

(container technology)
The container technology according to the embodiment will be described below. 2 and 3 are diagrams for explaining the container technology according to the embodiment.

As shown in Figure 2, two or more containers (container #1 and container #2 in Figure 2) are virtualized under the premise that an OS is installed on a physical server and a container engine is installed on the OS. . For example, each container includes middleware (MW) and an application (App) provided on the middleware.

As shown in FIG. 3, a container image is generated by building a container file (Build), and a container is generated by executing the container image (Run).

A container file corresponds to a design document of a container image, and is a text-based definition file. A container image corresponds to the composition of an application. A container corresponds to the execution environment of a container image. Execution of the container executes the application.

(Processing device)
A processing apparatus according to an embodiment will be described below. FIG. 4 is a diagram showing the processing device 10 according to the embodiment.

As shown in FIG. 4, the processing device 10 has a communication section 11, a management section 12, and a control section 13. FIG.

The communication unit 11 is configured by a communication module. The communication module can be a wireless communication module conforming to standards such as IEEE802.11a/b/g/n/ac/ax, LTE, 5G, 6G, etc., and a wired communication module conforming to standards such as IEEE802.3 may be

In the embodiment, communication unit 11 acquires a container image. For example, the communication unit 11 may acquire the container image from the user terminal 20, or may acquire the container image from the providing device 30. FIG. The communication unit 11 may acquire a container image from a storage service provided by a third party (for example, Docker Hub, AWS ECR (Elastic Container Registry), etc.).

The management unit 12 is configured by a storage medium such as SSD (Solid State Drive) or HDD (Hard Disk Drive), and stores various information.

In the embodiment, the management unit 12 manages container images acquired from the user terminal 20 or the providing device 30. FIG.

Control unit 13 may include at least one processor. At least one processor, CPU (Central Processing Unit), MPU (Micro Processing Unit), GPU (Graphics Processing Unit), one or more Integrated Circuit, one or more Discrete Circuit, and may be configured by a combination thereof .

In the embodiment, the control unit 13 constitutes a control unit that identifies an execution program executed in a container by scanning a container constructed by executing a container image. The control unit 13 identifies the vulnerability of the execution program, and executes triage processing for setting the priority order for countermeasures against the vulnerability of the program included in the container image based on the identified vulnerability. Specifically, the control unit 13 may perform the following operations.

First, the control unit 13 identifies execution processes executed in containers by scanning containers constructed by executing container images. Control unit 13 identifies an execution program based on the execution process. For example, the control unit 13 may use information stored in the external device 40 to identify the execution program corresponding to the execution process.

Second, the control unit 13 determines whether or not the package information regarding the package containing the execution program is registered in the external device 40 (eg, first device).

When the package information is registered, the control unit 13 refers to the first device based on the package information, identifies the contents of the vulnerability associated with the package information, and identifies the contents of the identified vulnerability. to identify the risk of the running process based on The control unit 13 identifies the vulnerability of the execution program based on the vulnerability score of the execution program and the degree of risk of the execution process. That is, when the package information is registered, the control unit 13 identifies the vulnerability of the execution program based on the package information.

If the package information is not registered, the control unit 13 refers to the second device based on the program information about the execution program, identifies the details of the vulnerability associated with the program information, and detects the identified vulnerability. Identify the risk of the execution process based on the content of the nature. The control unit 13 identifies the vulnerability of the execution program based on the vulnerability score of the execution program and the degree of risk of the execution process. That is, when the package information is not registered, the control unit 13 identifies the vulnerability of the execution program based on the program information.

Although not particularly limited, the control unit 13 may specify the risk of the execution process as follows. For example, the control unit 13 may specify that the risk of the executing process is low if the execution process does not involve the opening of the port when the details of the vulnerability involve the opening of the port. Note that the control unit 13 may specify that the risk level of the executing process is high if the execution process involves opening the port when the content of the vulnerability involves opening the port.

Thirdly, the control unit 13 executes triage processing for setting priorities for countermeasures against vulnerabilities of programs included in the container image, based on the vulnerabilities of the execution programs. For example, the control unit 13 performs the triage process so that the execution program has a higher priority than the non-execution programs other than the execution program.

(triage process)
An example of triage processing according to the embodiment will be described below. FIG. 5 is a diagram illustrating an example of triage processing according to the embodiment. Here is an example of a case in which the process risk is represented by two levels (high, low) and the program vulnerability score is represented by three levels (high, medium, low).

As shown in FIG. 5, the processing device 10 may perform triage processing such that the priority of the executing program is higher than the priority of the non-executing program.

The processing device 10 may perform triage processing for execution programs such that an execution program executing a process with a high degree of risk has a higher priority than an execution program executing a process with a low degree of risk. The processing device 10 may perform triage processing for execution programs such that execution programs with high vulnerability scores are given higher priority than execution programs with low vulnerability scores.

Although not particularly limited, the processing device 10 triages the non-executable programs so that the priority of the non-executable programs with a high vulnerability score is higher than the priority of the non-executable programs with a low vulnerability score. processing may be performed. However, the processing device 10 may perform triage processing without distinguishing between non-executable programs.

(Processing method)
A processing method according to the embodiment will be described below. FIG. 6 is a diagram showing a processing method according to the embodiment.

As shown in FIG. 6, the processing device 10 acquires a container image from the user terminal 20 in step S10. The processing device 10 may acquire the container image from the providing device 30. FIG. The processing device 10 may acquire container images from storage services provided by third parties (for example, Docker Hub, AWS ECR, etc.).

At step S12, the processing device 10 executes the container image.

In step S14, the processing device 10 identifies execution processes executed in the container by scanning the container constructed by executing the container image.

In step S16, processing device 10 identifies an execution program based on the execution process. For example, the processing device 10 may use information stored in the external device 40 to identify the execution program corresponding to the execution process.

In step S18, the processing device 10 transmits to the external device 40 package information regarding the package containing the execution program.

In step S20, the processing device 10 receives vulnerability information associated with package information. Vulnerability information may include vulnerability content (eg, CVE). The vulnerability information may include the vulnerability score of the executor. When the package information is not registered, the processing device 10 receives a message indicating that the package information is not registered.

In step S22, the processing device 10 transmits the program information regarding the execution program to the external device 40 when the package information is not registered. Note that if the package information is registered, the processing device 10 omits the processing of step S22.

At step S24, the processing device 10 receives the vulnerability information associated with the program information. Vulnerability information may include vulnerability content (eg, NVD-based content). The vulnerability information may include the vulnerability score of the executor.

In step S26, the processing device 10 executes triage processing. The processing device 10 may perform triage processing according to the procedure shown in FIG.

In step S28, the processing device 10 transmits the triage result to the user terminal 20. FIG. The user terminal 20 displays the triage result.

(Action and effect)
In the embodiment, the processing device 10 identifies an execution program executed in the container by scanning the container constructed by executing the container image, and identifies the program included in the container image based on the vulnerability of the execution program. perform a triage process that prioritizes the vulnerabilities to be addressed. With such a configuration, assuming the application usage scene, the triage process is executed by focusing on the vulnerabilities of the executable program rather than the vulnerabilities of all the programs included in the container image. , it is possible to reduce the complexity of checking the vulnerabilities of the programs included in the container image, and to support the appropriate implementation of countermeasures against the vulnerabilities.

[Modification 1]
Modification 1 of the embodiment will be described below. In the following, differences with respect to the above-described embodiments are mainly described.

In embodiments, a CVSS provided by a third party is used as the vulnerability score. In contrast, in Modification 1, the following information may be used as the vulnerability score in addition to the CVSS.

Specifically, the processing device 10 determines whether information indicating whether or not the program is externally accessible (hereinafter referred to as first information) and whether an attack code (PoC) against the vulnerability of the program is distributed. The vulnerability score of the program may be specified based on the information indicating whether or not (hereinafter referred to as second information).

For example, the processing device 10 may specify the vulnerability score of a program such that the vulnerability score of an externally accessible program is higher than the vulnerability score of an externally inaccessible program. The processing device 10 may specify the vulnerability score of the program such that the vulnerability score of the program in which the attack code is distributed is higher than the vulnerability score of the program in which the attack code is not distributed.

The processing device 10 may identify the vulnerability score of the program based on both the first information and the second information. In such a case, the processing device 10 may specify the vulnerability score of the program so that the second information is prioritized over the first information, and the first information is prioritized over the second information. A program's vulnerability score may be determined as follows.

Note that the processing device 10 may specify the program vulnerability score so that the first information is given priority over the CVSS, and the program vulnerability score is specified so that the second information is given priority over the CVSS. may be specified.

[Other embodiments]
Although the present invention has been described by the above-described embodiments, the statements and drawings forming part of this disclosure should not be construed as limiting the present invention. Various alternative embodiments, implementations and operational techniques will become apparent to those skilled in the art from this disclosure.

The above disclosure exemplifies the case where the vulnerability content is identified based on CVE and NVD. However, the above disclosure is not so limited. Vulnerability content may be identified based on ICAT (IPA Cyber security Alert Service) Metabase, JVN (Japan Vulnerability Notes), JVN iPedia, OSVDB (Open Source Vulnerability Database), and the like.

Although not specifically mentioned in the above disclosure, priority may also be referred to as triage level.

In the embodiment, the case where the processing device 10 is one device is exemplified. However, embodiments are not so limited. The functions of processing device 10 may be realized by two or more entities. Two or more entities may include entities that provide cloud computing services. Also, the management unit 12 may be a cloud-based database provided separately from the processing device 10 .

Although not particularly mentioned in the embodiment, a program that causes a computer to execute each process performed by the processing device 10 may be provided. Also, the program may be recorded on a computer-readable medium. A computer readable medium allows the installation of the program on the computer. Here, the computer-readable medium on which the program is recorded may be a non-transitory recording medium. The non-transitory recording medium is not particularly limited, but may be, for example, a recording medium such as CD-ROM or DVD-ROM.

Alternatively, a chip configured by a memory storing a program for executing each process performed by the processing device 10 and a processor executing the program stored in the memory may be provided.

DESCRIPTION OF SYMBOLS 10... Processing apparatus, 11... Communication part, 12... Management part, 13... Control part, 20... User terminal, 21... Display, 30... Providing apparatus, 100... Processing system

Claims (5)

a control unit that identifies an execution program executed in the container by scanning the container constructed by executing the container image;
The control unit identifies vulnerabilities in the execution program, and executes triage processing for setting priorities for countermeasures against vulnerabilities in programs included in the container image based on the identified vulnerabilities. Device. 2. The processing device according to claim 1, wherein said control unit executes said triage process so that said priority of said execution program is higher than said priority of non-execution programs other than said execution program. 3. The processing device according to claim 1, wherein, when package information relating to a package containing said execution program is registered, said control unit identifies vulnerability of said execution program based on said package information. . 4. The control unit according to any one of claims 1 to 3, wherein, when package information relating to a package containing the execution program is not registered, the vulnerability of the execution program is identified based on program information relating to the execution program. or 1. The processing apparatus according to claim 1. A step of scanning a container built by running a container image to identify executable programs running in said container;
a step B of identifying vulnerabilities in the execution program and executing triage processing for setting priorities for countermeasures against vulnerabilities in programs included in the container image, based on the identified vulnerabilities; Processing method.

Images