US 12,192,182 B2 · Container with encrypted software packages

Abstract

The invention relates to a method for operating a container (100) providing a service to a user in a cloud environment, wherein the container is generated from a container image (51) which comprises an encrypted software package, the container image further comprising a decryption entity, wherein the method comprises the steps of receiving a message to set up the container (100) out of the container image (51), the message comprising an access identifier allowing access to a restricted area (60) to which the access is not provided without the access identifier, the restricted area comprising a plurality of decryption keys, and accessing the restricted area (60) using the access identifier received with the message, and retrieving a decryption key from the restricted area (60) based on the access identifier, and decrypting the encrypted software package with the retrieved decryption key in order to generate a decrypted software package, providing the service to the user based on the decrypted software package.

Claims20

Dependent claims

A method for protecting an unencrypted version of a software package from unauthorized access, wherein a container image comprises i) a decryption entity (DE) and ii) an encrypted version of the software package, the method comprising:

instantiating a container from the container image comprising the decryption entity and the encrypted version of the software package, wherein the container is configured to automatically launch the decryption entity at the time container is instantiated;
upon being launched, the decryption entity obtaining an access identifier allowing access to a restricted area, the restricted area comprising a plurality of decryption keys;
the decryption entity accessing the restricted area using the access identifier;
the decryption entity retrieving a decryption key from the restricted area based on the access identifier;
the decryption entity decrypting the encrypted version of the software package with the retrieved decryption key in order to generate the unencrypted version of the software package;
and
providing the service to the user using the unencrypted version of the software package.

4 more elements

A method for operating a decryption agent configured to support decryption of an encrypted software package in order to generate a decrypted software package used by a container providing a service to a user in a cloud environment, wherein the container is generated from a container image which comprises the encrypted software package, the method comprising:

receiving, from a container orchestration entity, a service definition allowing the service to be provided by the container and the container image needed to generate the container to be identified;
identifying the container image based on the received service definition, the container image comprising the encrypted software package;
determining a decryption key to be used to generate the decrypted software package from the encrypted software package;
requesting from a restricted area comprising a plurality of decryption keys, a generation of an access identifier with which the determined decryption key stored in the restricted area can be accessed, wherein the access to the restricted area is not provided without the access identifier;
receiving, from the restricted area, the requested access identifier;
generating a new service definition based on the service definition to which the access identifier is added;
and
transmitting the new service definition back to the container orchestration entity.

5 more elements

Dependencies are inferred from the claim text.

Container with encrypted software packages

Life of this patent

Container with encrypted software packages

Life of this patent

Abstract

Claims20