# US 11,310,037 B2 · Cloud container security framework > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,310,037 B2 - Document ID: US11310037B2 - Status: Granted - Kind: B2 - Application number: 16/932,197 - Filed: 2020-07-17 - Published: 2022-01-20 - Granted: 2022-04-19 - Earliest claimed: 2020-07-17 - Assignees: Sap SE - Applicants: Sap SE - Inventors: Udo Klein; Richard Lindner - Web page: https://patentgrep.com/patent/US11310037B2 ## CPC - H04L 9/0825: {using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates} - H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) - G06F 9/455: Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines - G06F 21/602: {Providing cryptographic facilities or services} - G06F 21/6209: {to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself} - H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage} - H04L 63/0435: {wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06)} - H04L 63/10: {for controlling access to devices or network resources} - H04L 67/1097: for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS] - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A containerized application is initialized in a cloud-based computing environment. Thereafter, the containerized application obtains environment variables encapsulating credentials. The containerized application stores the environment variables in a secret store of the containerized application. The environment variables are later wiped upon completion of the storing of the environment variables. Related apparatus, systems, techniques and articles are also described. ## Claims ### Claim 1 A computer-implemented method comprising: initializing, in a cloud-based computing environment, a containerized application; obtaining, by the containerized application, environment variables encapsulating credentials; storing, by the containerized application, the environment variables in a secret store internal to the containerized application, wherein the secret store runs with higher privileges than the containerized application; and wiping the environment variables upon completion of the storing of the environment variables. ### Claim 2 (depends on 1) The method of claim 1, further comprising: encrypting the environment variables within the secret store. ### Claim 3 (depends on 2) The method of claim 2, further comprising: spreading the environment variables within memory utilized by the secret store to obfuscate the encrypted environment variables. ### Claim 4 (depends on 1) The method of claim 1, wherein the environment variables comprise access credentials to the containerized application. ### Claim 5 (depends on 1) The method of claim 1, wherein at least a portion of the environment variables are encrypted, and wherein the method further comprises: decrypting, by the containerized application, the encrypted environment variables using a corresponding symmetric key. ### Claim 6 (depends on 1) The method of claim 1, wherein at least a portion of the environment variables are encrypted, and wherein the method further comprises: injecting a public decryption key into a filesystem of the cloud-based computing environment; providing, by the filesystem, the public decryption key to the containerized application; and decrypting, by the containerized application, data encapsulated within the environment variables using the provided public decryption key. ### Claim 7 (depends on 1) The method of claim 1, wherein the environment variables comprise a public decryption key, and wherein the method further comprises: injecting an encrypted secret into a filesystem of the cloud-based computing environment; providing, by the filesystem, the encrypted secret to the containerized application; and decrypting, by the containerized application, the encrypted secret using the provided public decryption key. ### Claim 8 A system comprising: at least one data processor; and memory storing instructions which, when executed by the at least one data processor, implements operations comprising: initializing a containerized application; obtaining, by the containerized application, environment variables encapsulating credentials; storing, by the containerized application, the environment variables in a secret store internal to the containerized application, wherein the secret store runs with higher privileges than the containerized application; and wiping the environment variables upon completion of the storing of the environment variables. ### Claim 9 (depends on 8) The system of claim 8, wherein the operations further comprise: encrypting the environment variables within the secret store. ### Claim 10 (depends on 9) The system of claim 9, wherein the operations further comprise: spreading the environment variables within memory utilized by the secret store to obfuscate the encrypted environment variables. ### Claim 11 (depends on 8) The system of claim 8, wherein the environment variables comprise access credentials to the containerized application. ### Claim 12 (depends on 8) The system of claim 8, wherein at least a portion of the environment variables are encrypted, and wherein the operations further comprise: decrypting, by the containerized application, the encrypted environment variables using a corresponding symmetric key. ### Claim 13 (depends on 8) The system of claim 8, wherein at least a portion of the environment variables are encrypted, and wherein the operations further comprise: injecting a public decryption key into a filesystem of a cloud-based computing environment; providing, by the filesystem, the public decryption key to the containerized application; and decrypting, by the containerized application, data encapsulated within the environment variables using the provided public decryption key. ### Claim 14 (depends on 8) The system of claim 8, wherein the environment variables comprise a public decryption key, and wherein the operations further comprise: injecting an encrypted secret into a filesystem of a cloud-based computing environment; providing, by the filesystem, the encrypted secret to the containerized application; and decrypting, by the containerized application, the encrypted secret using the provided public decryption key. ### Claim 15 A non-transitory computer program product storing instructions which, when executed by at least one computing device, implements operations comprising: initializing a containerized application; obtaining, by the containerized application, environment variables encapsulating credentials; storing, by the containerized application, the environment variables in a secret store internal to the containerized application, wherein the secret store runs with higher privileges than the containerized application; and wiping the environment variables upon completion of the storing of the environment variables. ### Claim 16 (depends on 15) The computer program product of claim 15, wherein at least a portion of the environment variables are encrypted, and wherein the operations further comprise: decrypting, by the containerized application, the encrypted environment variables using a corresponding symmetric key. ### Claim 17 (depends on 15) The computer program product of claim 15, wherein at least a portion of the environment variables are encrypted, and wherein the operations further comprise: injecting a public decryption key into a filesystem of a cloud-based computing environment; providing, by the filesystem, the public decryption key to the containerized application; and decrypting, by the containerized application, data encapsulated within the environment variables using the public provided decryption key. ### Claim 18 (depends on 15) The computer program product of claim 15, wherein the environment variables comprise a public decryption key, and wherein the operations further comprise: injecting an encrypted secret into a filesystem of a cloud-based computing environment; providing, by the filesystem, the encrypted secret to the containerized application; and decrypting, by the containerized application, the encrypted secret using the provided public decryption key. ### Claim 19 (depends on 6) The method of claim 6, wherein the injected public decryption key is accessible through an associated secret manager. ### Claim 20 (depends on 17) The system of claim 17, wherein the injected public decryption key is accessible through an associated secret manager.