信息网络安全

信息网络安全 ›› 2023, Vol. 23 ›› Issue (2): 76-84.doi: 10.3969/j.issn.1671-1122.2023.02.009

• 技术研究 • 上一篇    下一篇

基于依赖关系的容器供应链脆弱性检测方法

夏懿航1, 张志龙2, 王木子3, 陈力波2()   

  1. 1.上海交通大学网络信息中心，上海 200240
    2.上海交通大学电子信息与电气工程学院，上海 200240
    3.北京计算机技术及应用研究所，北京 100854
  • 收稿日期:2022-11-08 出版日期:2023-02-10 发布日期:2023-02-28
  • 通讯作者: 陈力波 E-mail:bob777@sjtu.edu.cn
  • 作者简介:夏懿航（1996—），男，浙江，助理工程师，硕士，主要研究方向为Web安全|张志龙（1981—），男，江苏，高级工程师，博士研究生，主要研究方向为网络空间安全|王木子（1990—），男，北京，工程师，本科，主要研究方向为计算机软件工程|陈力波（1985—），男，江西，工程师，硕士，主要研究方向为网络与系统安全。
  • 基金资助:
    国家重点研发计划(2022QY1702);国家广播电视总局实验室项目(TXX20200001ZSB001)

Dependency-Based Vulnerability Detection Method in Container Supply Chain

XIA Yihang1, ZHANG Zhilong2, WANG Muzi3, CHEN Libo2()   

  1. 1. Network & Information Center, Shanghai Jiao Tong University, Shanghai 200240, China
    2. School of Electronic Information and Electrical Engineering, Shanghai Jiao Tong University, Shanghai 200240, China
    3. Beijing Institute of Computer Technology and Applications, Beijing 100854, China
  • Received:2022-11-08 Online:2023-02-10 Published:2023-02-28
  • Contact: CHEN Libo E-mail:bob777@sjtu.edu.cn

RichHTML

11

PDF (PC)

95

摘要：

容器作为一种轻量化隔离方法，具有方便部署、易于移植等特点，近年来发展很快。容器的隔离性阻碍了内部软件成分被外部检测工具所获知，导致软件成分分析、安全评估等无法有效开展，阻碍了软件供应链安全检测。为了解决此问题，文章提出基于依赖关系的容器供应链脆弱性检测方法，区别于利用分析工具在容器运行时进行检测的方法，该方法以镜像为粒度，利用不同镜像中各个层之间的相关性，在解构镜像的基础上提取基于镜像依赖关系形成的软件供应链，能够检测到镜像内容依赖、执行配置依赖和动态构建依赖等多个维度导致的供应链安全问题。实验结果表明，文章所提方法在应对软件供应链的安全威胁时能发挥很好的检测作用，高效地发现了公开容器仓储（如Docker Hub）中存在的大量供应链安全隐患。

关键词: 软件供应链, 容器安全, 安全检测, 多维度依赖

Abstract:

As a lightweight isolation method, the container has been widely applied due to its convenient deployment and portability. However, its isolation also naturally prevents its internal software components from being known by external detection tools. It will result in the inability to carry out general software component analysis and evaluation, further hindering threats in the software supply chain. To address this dilemma, this paper proposed a dependency-based vulnerability detection method in container supply chain, which was different from the popular tools that usually analyze by launching the target container. This method took the image as the granularity. The correlation between the layers in different images was used, this paper extracted the software formed based on the container image dependency on the basis of deconstructing the software image. The proposed method could detect supply chain security problems caused by multiple dimensions, such as image-content dependencies, execution-configuration dependencies, and dynamic build dependencies. The experimental results show that the proposed method can make sense in detecting various risks in the software supply chain and efficiently discover a large number of risks in public container repositories (such as Docker Hub).

Key words: software supply chain, container security, security detection, multi-dimensional dependency

中图分类号: