# US 12,015,613 B2 · Method and system for secure container application framework > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,015,613 B2 - Document ID: US12015613B2 - Status: Granted - Kind: B2 - Application number: 17/592,632 - Filed: 2022-02-04 - Published: 2022-08-11 - Granted: 2024-06-18 - Earliest claimed: 2021-02-08 - Assignees: Veea Inc. - Applicants: VEAA Inc. - Inventors: Jim Sienicki; Roger Lucas; Perry Wintner; Nick Jelbert; Clint Smith - Web page: https://patentgrep.com/patent/US12015613B2 ## CPC - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - H04L 63/101: {Access control lists [ACL]} - G06F 11/1464: {for networked environments} - G06F 11/1469: {Backup restoration techniques} - G06F 21/105: {Arrangements for software license management or administration, e.g. for managing licenses at corporate level} - H04L 63/0435: {wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06)} - H04L 63/062: {for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819)} - H04L 63/102: {Entity profiles} - H04L 63/123: {received data contents, e.g. message integrity} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 67/1097: for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS] - G06F 21/1075: {Editing} - G06F 2201/815: Virtual - G06F 2221/2141: Access rights, e.g. capability lists, access control lists, access tables, access matrices - H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract An edge device may be configured to generate a secure container to perform a software application on the edge device. A security daemon operating on a processor of the edge device may receive a security policy for the software application from a secure container platform, retrieve a license associated with the software application, and determine permissions of the software application based on the retrieved license. The edge device may create a user or group account and updating a system service access-control list (ACL) based on the received security policy and the determined permissions, and generate and send a policy ready message to the secure container platform in response to creating the user or group account and updating the system service ACL. ## Claims ### Claim 1 An edge device, comprising: a processor configured with processor-executable instructions to: receive in a security daemon a security policy for a software application from a secure container platform; retrieve in a security daemon a license associated with the software application; determine permissions of the software application based on the retrieved license; create a user or group account, and update a system service access-control list (ACL), based on the received security policy and the determined permissions; obtain one or more application images of the software application; obtain one or more security images for the software application; generate a container package that includes the one or more application images and the one or more security images; generate and send a policy ready message that includes the generated container package to the secure container platform in response to creating the user or group account and updating the system service ACL, the secure container platform generating a secure container and applying the security policy to the secure container based on information included in the policy ready message; assign, by the security daemon, hardware resources and system resources to the secure container; and generate and send, by the security daemon, a policy applied message to the secure container platform in response to assigning the hardware resources and the system resources to the secure container. ### Claim 2 (depends on 1) The edge device of claim 1, wherein the processor is further configured with processor-executable instructions to: generate and send the security policy for the software application from the secure container platform to the security daemon; and receive in the secure container platform the policy ready message from security daemon in response to sending the security policy. ### Claim 3 (depends on 2) The edge device of claim 2, wherein the processor is further configured with processor-executable instructions to: send, by the secure container platform, a message to the security daemon to indicate the that the generated security policy was successfully applied to the generated secure container. ### Claim 4 (depends on 3) The edge device of claim 3, wherein the processor is further configured with processor-executable instructions to: receive, by the secure container platform, the policy applied message from the security daemon; start, by the secure container platform, the generated secure container in response to receiving the policy applied message from the security daemon; and send, by the secure container platform, a container started message to the security daemon. ### Claim 5 (depends on 4) The edge device of claim 4, wherein the processor is further configured with processor-executable instructions to: receive, by the security daemon, the container started message from the secure container platform; and assign, by the security daemon, network resources to the started secure container in response to the receiving the container started message from the secure container platform. ### Claim 6 A method of generating a secure container to perform a software application on an edge device, comprising: receiving, by a security daemon operating on a processor of the edge device, a security policy for the software application from a secure container platform; retrieving, by the security daemon, a license associated with the software application; determining, by the security daemon, permissions of the software application based on the retrieved license; creating, by the security daemon, a user or group account and updating a system service access-control list (ACL) based on the received security policy and the determined permissions; obtaining, by the security daemon, one or more application images of the software application; obtaining, by the security daemon, one or more security images for the software application; generating, by the security daemon, a container package that includes the one or more application images and the one or more security images; generating and sending, by the security daemon, a policy ready message that includes the generated container package to the secure container platform in response to creating the user or group account and updating the system service ACL, the secure container platform generating a secure container and applying the security policy to the secure container based on information included in the policy ready message; assigning, by the security daemon, hardware resources and system resources to the secure container; and generating and sending, by the security daemon, a policy applied message to the secure container platform in response to assigning the hardware resources and the system resources to the secure container. ### Claim 7 (depends on 6) The method of claim 6, further comprising: generating and sending, by the secure container platform, the security policy for the software application to the security daemon; and receiving, by the secure container platform, the policy ready message from security daemon in response to sending the security policy. ### Claim 8 (depends on 7) The method of claim 7, further comprising: sending, by the secure container platform, a message to the security daemon to indicate the that the generated security policy was successfully applied to the generated secure container. ### Claim 9 (depends on 8) The method of claim 8, further comprising: receiving, by the secure container platform, the policy applied message from the security daemon; starting, by the secure container platform, the generated secure container in response to receiving the policy applied message from the security daemon; and sending, by the secure container platform, a container started message to the security daemon. ### Claim 10 (depends on 9) The method of claim 9, further comprising: receiving, by the security daemon, the container started message from the secure container platform; and assigning, by the security daemon, network resources to the started secure container in response to the receiving the container started message from the secure container platform. ### Claim 11 A non-transitory computer readable storage medium having stored thereon processor-executable software instructions configured to cause a processor in an edge device to perform operations for generating a secure container to perform a software application on the edge device, the operations comprising: receiving, by a security daemon, a security policy for the software application from a secure container platform; retrieving, by the security daemon, a license associated with the software application; determining, by the security daemon, permissions of the software application based on the retrieved license; creating, by the security daemon, a user or group account and updating a system service access-control list (ACL) based on the received security policy and the determined permissions; obtaining, by the security daemon, one or more application images of the software application; obtaining, by the security daemon, one or more security images for the software application; generating, by the security daemon, a container package that includes the one or more application images and the one or more security images; generating and sending, by the security daemon, a policy ready message that includes the generated container package to the secure container platform in response to creating the user or group account and updating the system service ACL, the secure container platform generating a secure container and applying the security policy to the secure container based on information included in the policy ready message; assigning, by the security daemon, hardware resources and system resources to the secure container; and generating and sending, by the security daemon, a policy applied message to the secure container platform in response to assigning the hardware resources and the system resources to the secure container. ### Claim 12 (depends on 11) The non-transitory computer readable storage medium of claim 11, wherein the stored processor-executable instructions are configured to cause the processor in the edge device to perform operations further comprising: generating and sending, by the secure container platform, the security policy for the software application to the security daemon; receiving, by the secure container platform, the policy ready message from security daemon in response to sending the security policy. ### Claim 13 (depends on 12) The non-transitory computer readable storage medium of claim 12, wherein the stored processor-executable instructions are configured to cause the processor in the edge device to perform operations further comprising: sending, by the secure container platform, a message to the security daemon to indicate the that the generated security policy was successfully applied to the generated secure container. ### Claim 14 (depends on 13) The non-transitory computer readable storage medium of claim 13, wherein the stored processor-executable instructions are configured to cause the processor in the edge device to perform operations further comprising: receiving, by the secure container platform, the policy applied message from the security daemon; starting, by the secure container platform, the generated secure container in response to receiving the policy applied message from the security daemon; and sending, by the secure container platform, a container started message to the security daemon. ### Claim 15 (depends on 14) The non-transitory computer readable storage medium of claim 14, wherein the stored processor-executable instructions are configured to cause the processor in the edge device to perform operations further comprising: receiving, by the security daemon, the container started message from the secure container platform; and assigning, by the security daemon, network resources to the started secure container in response to the receiving the container started message from the secure container platform.