TWI733490B - System for detecting image file security and method thereof - Google Patents

Abstract

The present invention is a system for detecting image file security and a method thereof, which can be applied on different platforms. When the user uploads an image file to a centralized database through each platform, until the image file is downloaded to each host, the image file can ensure the consistency of their contents. In addition, the security vulnerabilities of the image file itself can be continuously detected, and the use status of the image file is provided by the host, thereby achieving the purposes of security risk detection, signature verification, and compliance inspection of the image file.

Description

Container image file information security detection system and method

The present invention relates to the technology of container resource protection, in particular to a container image file information security detection system and method.

In the technical field of software microservices, microservices have the characteristics of agility and flexible expansion. Compared with monolithic application services, it can solve many issues derived from monolithic application services. However, there was no suitable microservice in the past. The architecture execution environment has not been widely used. In recent years, with the rise of container technology, it has provided a perfect execution environment for microservices, making the construction of microservice architecture based on container technology very suitable for today's cloud applications. Among them, Each microservice must be able to be updated independently. This loosely coupled architecture allows applications to innovate quickly. In addition, microservices can be developed through different programming languages and tools. With the advantages of containerization, it is not limited to the platform. The environment can also improve the portability of the service to the platform.

However, the containerization technology is accompanied by its risks. The image file resources generated under the container technology will inevitably give rise to security problems. In the image file storage and the transmission process between each local terminal, if it is not a closed environment In the case, there is bound to be an opportunity for external malicious attackers to tamper with the image file resources in various ways, which will cause the malicious image file to be downloaded when the back-end service is deployed and run this After the image file is likely to cause the local end to be attacked and damaged. In short, the information security issues that containerization technology may face include the protection of container resources. Container resources are images that encapsulate specific applications. These images can come from a public image repository (Docker Hub). Or it may come from a private self-built image file storage, and the use of image file resources has potential risks. One is that the image file itself has security vulnerabilities, and the other is that the image file resources are at risk of being tampered with by external malicious attackers. If the image file resource runs to a high risk, it is very likely that other services on the local end will be severely affected. Therefore, the protection of container resources is also extremely important.

Therefore, if a technology for protecting container resources can be found, especially if the image file is downloaded to the local side to ensure its consistency and can verify whether the image file held on the host side meets the specifications, this will become Those skilled in the art are eager to pursue the goal of a solution.

The purpose of the present invention is to provide a container image information security detection technology, which is detected through open source security vulnerability comparison to obtain the level of potential risks and the problem; secondly, through the content comparison technology of the image file, it can Ensure the consistency of its content; in addition, a test can be performed on the host side to confirm whether the image file resources held on the host side are compliant.

In order to achieve the above and other objectives, the present invention proposes a container image file security inspection system, which includes: a central control server, which includes a scheduling module for arranging image file execution inspections, in order to use the scheduling module When the image file is received, it sends a detection request; the detection server receives the detection request from the central control server, so that the central control server obtains the image file and then pre-stores the image file and the security vulnerability database Information is compared to generate test results; and a centralized database, which includes a review module for sorting and storing the security vulnerability levels and problems of the image file, where the review The visual module obtains the detection result from the detection server, and stores the detection result and the image file after the detection in the centralized database for the host to use.

In the above system, the central control server includes a central control signature module that executes the signature of the image file before the image file is tested, and the host side is included in the receiving of the signed image file After that, execute the host signature module of unsignature.

In the above-mentioned system, the inspection module periodically updates the inspection result to the inspection server, so as to periodically perform comparison and inspection of the latest security vulnerabilities for all the image files in the centralized database.

In the above system, the host side includes the monitoring module that collects the use information of the host side using the image file and returns the use information to the central control server, and the central control server includes the use information The verification module that compares with the centralized database to confirm the usage of the image file on the host side.

In the above system, when the monitoring module detects that the host side uses an unknown image file, it reports the usage information of the unknown image file to the verification module.

In one embodiment, the security vulnerability database is an open source security vulnerability database provided by a third party and continuously updated.

The present invention further proposes a container image file security detection method, which includes the following steps: after receiving the image file, generating a detection request for the image file; according to the detection request, comparing the image file with the pre-stored information in the security vulnerability database , To generate the detection result; and store the detection result and the detected image file to a centralized database for the host to use the detected image file.

In the above method, the multiplexing includes executing the signature of the image file before the detection of the image file.

In the above-mentioned method, the multiplexing includes regularly updating the detection result in the centralized database, so as to regularly perform comparison and detection of the latest security vulnerabilities in all the image files in the centralized database.

In the above method, after the image file is obtained and used on the host side, the host side collects and returns the usage information of the image file to confirm the usage of the image file on the host side.

In the above method, when the host side detects that the host side uses an unknown image file, the host side reports the usage information of the unknown image file.

In summary, the container image information security detection system and method proposed by the present invention can use multiple different open source security vulnerability databases for detection, report the level of potential risks and problems, and provide a continuous detection mechanism for image files. To ensure that the existing image file resources in the centralized database do not have new risks, and in order to avoid the container from being tampered with, the present invention uses the image file content comparison technology to upload the image file to the platform and then to the image file. In the process of being downloaded to the local machine, the consistency of the content can be ensured; in addition, in order to provide further protection, the client service can be executed on each host side, which is to synchronize with the server side regularly and detect the host side. Whether the image file resources held by the computer are compliant, and when necessary, an immediate alarm will be notified to the owner of the machine to carry out risk handling.

1: Container image file information security inspection system

11: Central control server

111: Scheduling module

112: Central Control Signature Module

113: Verification Module

12: Check the server

13: Centralized database

131: View Module

14: host side

141: Host Signature Module

142: Monitoring Module

100: Image file

S61~S63: steps

S71~S75: steps

Please refer to the detailed description of the present invention and its accompanying drawings to further understand the technical content of the present invention and its objectives and effects. The relevant drawings are described as follows.

FIG. 1 is a structural diagram of the container image file information security inspection system of the present invention.

2 is a structural diagram of another embodiment of the container image file security inspection system of the present invention.

Figure 3 is a schematic diagram of risk detection performed by the container image file information security detection system of the present invention picture.

4 is a schematic diagram of the image file signature executed by the container image file security inspection system of the present invention.

FIG. 5 is a schematic diagram of the container image file information security inspection system of the present invention performing compliance verification.

Figure 6 is a step diagram of the container image file security detection method of the present invention.

FIG. 7 is a flowchart of the risk detection, signature and compliance verification performed by the container image file security detection method of the present invention.

The following describes the technical content of the present invention with specific specific embodiments. Those familiar with the art can easily understand the advantages and effects of the present invention from the content disclosed in this specification. However, the present invention can also be implemented or applied by other different specific embodiments.

The present invention proposes a universal container image file security detection solution, which can be applied to different platforms. When the user uploads the image file to a centralized database through the upload function of each platform or the image file is In the process of downloading to each host, it can ensure the consistency of its content, and continuously detect the security vulnerabilities of the image file itself, and provide an information security detection solution that continuously monitors the use of the image file on the host side and real-time alarms.

FIG. 1 is a structural diagram of the container image file information security inspection system of the present invention. As shown in the figure, the container image file information security detection system 1 includes a central control server 11, a detection server 12, a centralized database 13, and a host terminal 14.

The central control server 11 includes a scheduling module for arranging the image file 100 to perform detection 111. When the scheduling module 111 receives the image file 100, it will issue a detection request to execute the detection of the image file 100 to request the detection server 12 to perform the detection of the image file 100. In other words, the user transmits the image file 100 to the central control server 11, and the central control server 11 initiates the detection of the image file 100, that is, the risk detection of the image file 100 is initiated.

The detection server 12 receives a detection request from the central control server 11 to obtain the image file 100 from the central control server 11 and compare it with the pre-stored information in the security vulnerability database to generate a detection result. In short, the central control server 11 sends a detection request to request the detection server 12 to perform detection. The detection server 12 compares the image file 100 with the data in the security vulnerability database to confirm whether the image file 100 exists. Risk, the security vulnerability database can be an open source security vulnerability database provided by a third party, and it will be continuously updated to facilitate the detection server 12 to continuously determine whether the image file 100 has new security vulnerabilities.

The centralized database 13 includes a viewing module 131 for sorting and storing the security vulnerability levels and problems of the image file. The viewing module 131 obtains the detection result from the detection server 12 to obtain the detection result and The image file 100 after the detection is stored in the centralized database 13 and is used by the host terminal 14. In detail, the centralized database 13 organizes the security vulnerability levels and problems of the image file 100 through the viewing module 131, and the centralized database 13 stores the detection results and the detected image file 100, and the detected image The file 100 is available for the host terminal 14 to access.

In one embodiment, the viewing module 131 regularly updates the detection result to the detection server 12, so that all the image files in the centralized database 13 are regularly compared and detected for the latest security vulnerabilities, so that all images can be ensured. The test result of the file is in line with the current demand.

In a specific implementation, third-party open source detection software, such as WhiteSource, can be used for risk detection, and it will be compared with dozens of open source security vulnerability databases on the backend. Identify whether the third-party components of the image file have weaknesses, the version update status, and the validity of the license (License). The detection process can include two parts: trigger detection work and update detection results. Among them, the trigger detection work will provide a general microservice API interface to provide trigger detection work. It is deployed on various platforms and registered with WhiteSource through the image file uploaded by the platform. Trigger detection, and update detection results will provide a universal microservice API interface to obtain detection results, deploy on the centralized database side, and WhiteSource obtains the result analysis of image file resources from different platforms, and will periodically trigger WhiteSource to target All image files in the database are continuously monitored for the latest security vulnerability database. Such a container image detection architecture can provide a centralized image resource management and control center, and continuously monitor all images to avoid missing the latest known potential risks.

2 is a structural diagram of another embodiment of the container image file security inspection system of the present invention. As shown in the figure, the central control server 11, the detection server 12, the centralized database 13, and the host terminal 14 of the container image file information security inspection system 1 are as described in FIG. 1. In addition, in this embodiment, the container image information security inspection system 1 allows multiple host terminals 14 to obtain the inspected image file 100. The multiple host terminals 14 are denoted by numbers 1-N. Among them, the central control server 11 It includes a central control signature module 112 and a verification module 113, and each host terminal 14 (number 1-N) includes a host signature module 141 and a monitoring module 142.

In order to ensure the content consistency of the image file 100, the central control signature module 112 of the central control server 11 executes the signature of the image file 100 and stores it in the centralized database 13 before the image file 100 is tested. After the host terminal 14 obtains the signed image file 100, the host signing module 141 of the host terminal 14 will execute the unsigned signature of the signed image file 100.

In order to ensure that the image file 100 used by the host side 14 meets the specifications, the present invention proposes that the host side 14 continuously monitors whether the image file 100 used by it is compliant. Therefore, the monitoring module 142 of the host side 14 regularly collects all the images in the host side 14 Use information of all image files 100 used and return the The usage information is sent to the central control server 11, and after the verification module 113 of the central control server 11 obtains the usage information, it compares it with the centralized database 13 to confirm the image file 100 used in the host side 14 Usage.

In addition, in addition to the image file 100 taken by the host side 14 from the centralized database 13, the host side 14 may also use other image files that are not from the centralized database 13. At this time, the monitoring module 142 of the host side 14 The usage status of these other image files can also be reported to the verification module 113 of the central control server 11, so that the verification module 113 can assist in confirming whether the other image files are compliant images.

In one embodiment, the present invention uses the image file of the software platform Docker as the implementation object, and applies this detection process on different platforms through the universal container image security detection solution proposed by the present invention. The user uploads the image file 100 to the centralized database 13 through various platforms. When the image file 100 is downloaded to each host 14, the consistency of its content can be ensured, and the consistency of the content can be ensured by updating and comparing. The security vulnerabilities of the image file 100 itself are detected. In addition, the use of the image file in the host terminal 14 can also be continuously monitored, so as to be able to immediately alert whether the image file has security problems.

In summary, the present invention provides a distributed platform image risk detection mechanism through the scheduling module 111, the detection server 12, and the viewing module 131, and integrates the detection results in the centralized database 13, thereby completing the container image. Risk detection. In addition, through the monitoring module 142 and the verification module 113, a distributed platform image file compliance verification mechanism is provided, and the data is concentrated on the central control server 11, and compared with the centralized database 13 for confirmation, thereby completing Compliance verification of container image files.

FIG. 3 is a schematic diagram of the risk detection performed by the container image file security detection system of the present invention. This embodiment addresses the issue of potential security vulnerabilities in the image file itself. As shown in the figure, the central control server 11 of the container image information security inspection system 1 will pass through the image file 100 after the user uploads it. The scheduling module 111 sends out a security vulnerability detection request. After the detection server 12 receives the detection request, the image file 100 is tested and compared through multiple different open source security vulnerability databases to identify the open source code and Whether the package has corresponding weaknesses, version update status, and the validity of the authorization, the inspection module 131 will sort the security weakness levels of the image file 100 and the results of the problems and store them in the centralized database 13 to check the server The security vulnerability database of the device 12 is continuously updated, and at the same time, all image files are continuously tested to ensure that no new security weaknesses appear in the existing image file resources in the centralized database 13.

4 is a schematic diagram of the image file signature executed by the container image file security inspection system of the present invention. This embodiment is aimed at the issue that container resources may be tampered with by malicious attackers. As shown in the figure, the container image information security detection system 1 of the present invention uses the image file content comparison technology, and the user passes the image file 100 through The upload function of the central control server 11 uploads to the centralized database 13, until the image file 100 is downloaded to each host 14, the image file 100 is protected by the signature, that is, in the central control server 11 The signature control module 112 will sign the image file 100, and the host signature module 141 of the host side 14 will verify the image file 100 after obtaining the signed image file 100 to ensure its content Consistency.

In one embodiment, for the security of the image file, in the new version of the image file of the Docker system, an additional information field named Digest will be added. Digest is the SHA256 value calculated through the entire image file content. If the content of the file changes, the SHA256 value of Digest will also change accordingly. In actual implementation, two sets of tools, Notary and Portieris, can be used to check the signature of the image file during the process of image file push and capture to ensure the consistency of the image file content in the process.

FIG. 5 is a schematic diagram of the container image file information security inspection system of the present invention performing compliance verification. Even if the previous image file has been checked and signed by trust, each host 14 may use its Other channels import unknown image files, so the host side 14 may still be attacked. Therefore, in order to ensure that the image files used by each host side 14 are compliant, as shown in the figure, the container image file security of the present invention The detection system 1 proposes to continuously monitor the environmental information of the host side 14 and the usage status of the image file used, collect the data of the host side 14 through the monitoring module 142 and report it to the central control server 11, and then through the central control server The verification module 113 of the device 11 performs data verification with the centralized database 13, so as to prevent the host side 14 from having potential security vulnerabilities, or to avoid the risk of the host side 14 being attacked by using unknown image files.

Finally, through the alarm mechanism, once it is found that the host side 14 is using an unknown image file, it must immediately notify the system administrator to confirm the situation and eliminate the problem, or the image file 100 itself has security vulnerabilities, it will immediately notify the image file 100. The developer repairs the security vulnerabilities of the image file 100 and uploads it again. Therefore, the present invention combines the aforementioned various mechanisms to become a container image security detection solution, ensuring that the image 100, once uploaded to the platform, complies with the custom security specifications, and can actively detect unknown potential risks.

The following describes the overall architecture of an application example of the container image security inspection system 1 of the present invention. Please also refer to Figures 2-5, which illustrate that the present invention can simultaneously perform container image risk detection, container image signature and container image file. Compliance verification and other procedures. First of all, when the user uploads the image file 100 to the central control server 11 through the user interface of the platform, it will enter the control of the entire container image security inspection. From the beginning, the information security inspection of the image file 100 will be scheduled. The module 111 triggers a request for detection of the image file 100. After the detection server 12 is compared with dozens of open source security vulnerability databases, the viewing module 131 at the end of the centralized database 13 will periodically update the detection to the detection server 12 As a result, all the image files in the centralized database 13 will be regularly checked for the latest security vulnerabilities.

Since testing often requires working hours, when faced with users who have services on the shelves immediately Under demand, before the inspection report is generated, the container image file signature mechanism can be used to ensure the consistency of the image file content, that is, the central control server 11 central control signature module 112 first pushes to the centralized data When the image file 100 needs to be used by the host side 14, the image file 100 will be captured by the host signature module 141 of the host side 14 to ensure the consistency of the content of the image file 100.

Finally, regarding container image compliance verification, the monitoring module 142 regularly captures the environmental information and image resource usage of each host 14 and reports it to the verification module 113 of the central control server 11. After the verification module After the 113 data is compared and confirmed, it prevents the host side 14 from having potential security vulnerabilities or the use of unknown image files to cause the host side 14 to be attacked. If the host side 14 is found to use an unknown image file, the system management can be notified immediately If the user confirms the situation and eliminates the problem, or the image file 100 itself has security vulnerabilities, the developer of the image file 100 will be immediately notified to fix the security vulnerabilities of the image file 1 and upload it again.

Figure 6 is a step diagram of the container image file security detection method of the present invention.

In step S61, after receiving the image file uploaded by the user, a detection request for the image file is generated. This step is to explain that when the uploaded image file is received, the image file detection will be performed. At this time, a detection request for the image file will be generated. In actual operation, the detection request can be made by the device or server that receives the image file, such as The central control server is used to control the risk detection of uploaded image files.

In step S62, according to the detection request, the pre-stored information of the image file and the security vulnerability database is compared to generate a detection result. This step describes the comparison of the image file with the pre-stored information in the security vulnerability database according to the detection request, so as to confirm whether the image file is at risk, and then generate the detection result. In actual operation, the central control server can request the detection server The detection server executes the detection, and the detection server connects to the external security vulnerability database or to the built-in security vulnerability database of the detection server to compare the security vulnerabilities of the image file and generate the detection result.

In step S63, the detection result and the detected image file are stored in a centralized database for the host to use the detected image file. This step is to store the detected image file and the detection result in a centralized database. In actual operation, the centralized database will sort out the security vulnerability levels and problems of the image file, and the detected image file can be used by the host Access.

In one embodiment, before the image file is detected, the image file is signed. In order to ensure the consistency of the content of the image file, and there may be a need for the shelf before the image file detection, the signature mechanism is used to ensure the content consistency of the image file, in other words, even if it is intercepted and tampered with by someone in the middle of the transmission, it will be delivered later On the host side, the image file that has been tampered with cannot be verified.

In one embodiment, the detection result in the centralized database is regularly updated, so that all the image files in the centralized database are regularly checked for the latest security vulnerabilities. This embodiment illustrates that in order to ensure that the detection results meet the current requirements, that is, the definition or specifications of risk vulnerabilities have been changed, the detection server will periodically update the detection results in the centralized database, so that the previous detection can be passed. The image file will still meet the latest security risk standards.

In one embodiment, after obtaining and using the image file on the host side, the host side collects and returns the usage information of the image file to confirm the usage of the image file on the host side. In order to ensure that the image file used by the host complies with the specifications, the host can continuously monitor whether the image file it uses is compliant, so the host can periodically collect the usage information of the image file it uses and send it back to the central control server. Similarly, if the host side detects that the host side uses an unknown image file, the host side can also report the usage information of the unknown image file, thereby preventing the unknown image file from causing harm to the host side.

FIG. 7 is a flowchart of the risk detection, signature and compliance verification performed by the container image file security detection method of the present invention.

Step S71: Perform image file detection and perform signature and signature. In other words, after uploading the image file, the user can perform image file detection and signature and endorsement first. This step is to detect security vulnerabilities in the image file, and sign and endorse the image file to ensure that the image is captured later The file request is the same image file resource.

Step S72, the centralized database manages the result of the image file related information. The centralized database is responsible for storing the image file information and detection results from different platforms, and will check all the image file data that have been detected again at regular intervals to avoid the emergence of new security vulnerabilities. This step is centralized management from different platforms The uploaded image file information and detection result will be checked again for all the detected image file data at regular intervals.

In step S73, the host side obtains the image file and performs signature confirmation. This step means that each host requests the image file capture through the centralized database, and the host side confirms the signature content. Its purpose is to confirm the signature content to ensure that the request to capture the image file is the same image file resource.

Step S74: Obtain the image file usage information on the host side, and perform a compliance comparison with the centralized database. This step means that the host side will periodically confirm whether all the image file information left on the local side is compliant. The purpose is to ensure that the image file used on the local side meets the latest specifications, that is, to obtain the host side image file regularly. Information, and confirm the content of the image file with the centralized database to determine whether it meets the company’s information security regulations.

In step S75, an alarm is issued to notify the system manager. This step is to explain that if an uncompliant image file is found on the host side, the system administrator will be notified immediately for processing.

It can be seen from the above that the present invention proposes a container image file security detection solution, which can be used universally on different platforms and apply this detection process, from the image file being uploaded to the platform to the image file being downloaded to the local terminal. It can ensure the consistency of its content; secondly, the image file can be continuously tested, this The mechanism can ensure that there are no new security loopholes in the existing image file resources in the centralized database; in addition, since it is unavoidable that the image file is imported into the host through other channels, the present invention also proposes a verification mechanism, namely Detect whether the image file resources and configuration files held on the host side comply with the specifications and policies, to prevent the host side from being artificially or maliciously attacked by importing unknown image file resources, and the owner of the host side must be alerted to the risk in real time handle.

In summary, the container image information security inspection system and method of the present invention has the following advantages when compared with other conventional technologies: First, it ensures that the image file is uploaded to the centralized platform via the upload function of the platform. The database, when the image file is downloaded to each host, the consistency of its content can be ensured to prevent the content from being tampered with by malicious attackers; second, the security vulnerabilities of the image file itself are continuously detected to ensure the execution None of the services provided by the host have security vulnerabilities or acceptable security vulnerabilities; third, provide continuous monitoring of the image file usage on the host side to prevent the host side from using unknown image files to cause the host side to be attacked; fourth, provide real-time alarm function, wherever If it is detected that the image file itself has security vulnerabilities, or there is an unknown image file on the host side, an alarm can be issued immediately to notify the image file developer or system administrator.

The above detailed description is a specific description of a feasible embodiment of the present invention, but this embodiment is not intended to limit the scope of the patent of the present invention. Any equivalent implementation or modification that does not deviate from the technical spirit of the present invention shall be included in In the scope of the patent in this case.

1: Container image file information security inspection system

11: Central control server

111: Scheduling module

12: Check the server

13: Centralized database

131: View Module

14: host side

100: Image file

Claims (11)

A container image file information security inspection system, which includes: The central control server includes a scheduling module for arranging image files to perform detection, so that when the scheduling module receives the image file, it sends a detection request; The detection server receives a detection request from the central control server to obtain the image file from the central control server and then compares the image file with the pre-stored information in the security vulnerability database to generate a detection result; and The centralized database includes a viewing module for sorting and storing the security vulnerability levels and problems of the image file. The viewing module obtains the detection result from the detection server to obtain the detection result and the detected The subsequent image file is stored in the centralized database for the host to use. For example, the container image information security inspection system described in item 1 of the scope of patent application, wherein the central control server further includes a central control signature module, which is used to execute the signature of the image file before detecting the image file , And the host side includes a host signing module, which is used to execute the unsigned after receiving the signed image file. For example, the container image information security inspection system described in item 1 of the scope of patent application, wherein the inspection module regularly updates the inspection result to the inspection server to regularly update all the image files in the centralized database Comparison and detection of security vulnerabilities. For example, in the container image information security inspection system described in item 1 of the scope of patent application, the host side also includes a monitoring module for collecting usage information of the host side using the image file and returning the usage information to the The central control server, and the central control server further includes a verification module, which is used to compare the usage information with the centralized database to confirm the usage of the image file on the host side. For example, the container image information security inspection system described in item 4 of the scope of patent application, wherein the monitoring module reports the use information of the unknown image to the verification module when detecting that the host side uses an unknown image file . For example, in the container image information security detection system described in item 1 of the scope of patent application, the security vulnerability database is an open source security vulnerability database provided by a third party and continuously updated. A container image file information security detection method includes the following steps: After receiving the image file, generate a detection request for the image file; According to the detection request, the image file is compared with the pre-stored information in the security vulnerability database to generate the detection result; and The detection result and the detected image file are stored in a centralized database for the host to use the detected image file. For example, the container image security inspection method described in item 7 of the scope of patent application includes executing the signature of the image file before the image file is inspected. For example, the container image security detection method described in item 7 of the scope of patent application includes regular updating of the detection results in the centralized database, so as to regularly update all the image files in the centralized database with the latest security vulnerabilities The comparison test. For example, the container image security detection method described in item 7 of the scope of patent application, wherein, after the image file is obtained and used on the host side, the host side collects and returns the usage information of the image file to confirm The usage of the image file on the host side. For example, in the container image security detection method described in item 7 of the scope of patent application, when the host side detects that the host side uses an unknown image file, the host side reports the usage information of the unknown image file.

Images