# US 12,192,182 B2 · Container with encrypted software packages > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,192,182 B2 - Document ID: US12192182B2 - Status: Granted - Kind: B2 - Application number: 17/794,401 - Filed: 2020-04-03 - Published: 2023-02-16 - Granted: 2025-01-07 - Earliest claimed: 2020-01-22 - Assignees: Telefonaktiebolaget LM Ericsson (publ) - Applicants: Telefonaktiebolaget LM Ericsson (publ) - Inventors: Pablo Martinez De La Cruz; Miguel Angel Garcia Martin - Web page: https://patentgrep.com/patent/US12192182B2 ## CPC - G06F 21/14: against software analysis or reverse engineering, e.g. by obfuscation - H04L 63/0435: {wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06)} - G06F 21/6209: {to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself} - H04L 63/062: {for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819)} - H04L 63/067: {using one-time keys (cryptographic mechanisms or cryptographic arrangements for generation of one-time passwords H04L9/0863)} - H04L 63/0838: {using one-time-passwords} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract The invention relates to a method for operating a container (100) providing a service to a user in a cloud environment, wherein the container is generated from a container image (51) which comprises an encrypted software package, the container image further comprising a decryption entity, wherein the method comprises the steps of receiving a message to set up the container (100) out of the container image (51), the message comprising an access identifier allowing access to a restricted area (60) to which the access is not provided without the access identifier, the restricted area comprising a plurality of decryption keys, and accessing the restricted area (60) using the access identifier received with the message, and retrieving a decryption key from the restricted area (60) based on the access identifier, and decrypting the encrypted software package with the retrieved decryption key in order to generate a decrypted software package, providing the service to the user based on the decrypted software package. ## Claims ### Claim 1 A method for protecting an unencrypted version of a software package from unauthorized access, wherein a container image comprises i) a decryption entity (DE) and ii) an encrypted version of the software package, the method comprising: instantiating a container from the container image comprising the decryption entity and the encrypted version of the software package, wherein the container is configured to automatically launch the decryption entity at the time container is instantiated; upon being launched, the decryption entity obtaining an access identifier allowing access to a restricted area, the restricted area comprising a plurality of decryption keys; the decryption entity accessing the restricted area using the access identifier; the decryption entity retrieving a decryption key from the restricted area based on the access identifier; the decryption entity decrypting the encrypted version of the software package with the retrieved decryption key in order to generate the unencrypted version of the software package; and providing the service to the user using the unencrypted version of the software package. ### Claim 2 (depends on 1) The method of claim 1, wherein the access identifier is a one-time access identifier allowing only a single access to the restricted area. ### Claim 3 (depends on 2) The method of claim 2, wherein the one-time access identifier is a one-time token. ### Claim 4 (depends on 1) The method of claim 1, wherein the encrypted software package is stored in a first layer of the container image, and the decryption entity configured to decrypt the encrypted software package using the retrieved decryption key is stored in a second layer of the container image, wherein the second layer is not the first layer. ### Claim 5 (depends on 1) The method of claim 1, wherein the restricted area is a secure vault. ### Claim 6 A method for operating a decryption agent configured to support decryption of an encrypted software package in order to generate a decrypted software package used by a container providing a service to a user in a cloud environment, wherein the container is generated from a container image which comprises the encrypted software package, the method comprising: receiving, from a container orchestration entity, a service definition allowing the service to be provided by the container and the container image needed to generate the container to be identified; identifying the container image based on the received service definition, the container image comprising the encrypted software package; determining a decryption key to be used to generate the decrypted software package from the encrypted software package; requesting from a restricted area comprising a plurality of decryption keys, a generation of an access identifier with which the determined decryption key stored in the restricted area can be accessed, wherein the access to the restricted area is not provided without the access identifier; receiving, from the restricted area, the requested access identifier; generating a new service definition based on the service definition to which the access identifier is added; and transmitting the new service definition back to the container orchestration entity. ### Claim 7 (depends on 6) The method of claim 6, wherein the requested access identifier is requested as one time access identifier allowing only a single access to the restricted area. ### Claim 8 (depends on 6) The method of claim 6, wherein the decryption key is determined based on the identified container image. ### Claim 9 (depends on 6) The method of claim 6 wherein generating the new service definition comprises creating a storage area into which the decrypted software package is to be inserted, and the storage area is created such that at least one of the following conditions is met: the storage area cannot be stored in a persistent storage, the storage area does not survive a reboot of the container, or the storage area is private to the container. ### Claim 10 A method for operating a service management entity configured to manage a set-up of a container providing a service to a user in a cloud environment, wherein the container is generated from a container image which comprises an encrypted software package, the method comprising: storing the container image in a container image registry; storing, in a restricted area, a decryption key for use in decrypting the encrypted software package, the restricted area storing a plurality of decryption keys, wherein access to the restricted area is not provided without an access identifier; and providing to a decryption agent mapping information that maps a container image identifier for identifying the container image with a decryption key identifier for identifying the decryption key for use in decrypting the encrypted software package. ### Claim 11 (depends on 1) A system comprising: memory; processing circuitry, wherein the system is configured to perform the method of claim 1. ### Claim 12 (depends on 11) The container of claim 11, wherein the access identifier is a one-time access identifier allowing only a single access to the restricted area. ### Claim 13 (depends on 11) The container of claim 11, wherein the encrypted software package is stored in a first layer of the container image, and the decryption entity configured to decrypt the encrypted software package using the retrieved decryption key is stored in a second layer of the container image, wherein the second layer is not the first layer. ### Claim 14 (depends on 6) A decryption agent configured to support decryption of an encrypted software package in order to generate a decrypted software package used by a container providing a service to a user in a cloud environment, wherein the container is generated from a container image which comprises the encrypted software package, the decryption agent comprising; memory storing a computer program; and processing circuitry for executing the computer program for configuring the service management entity to perform the method of claim 6. ### Claim 15 (depends on 14) The decryption agent of claim 14, further being operative to request the requested access identifier as one time access identifier allowing only a single access to the restricted area. ### Claim 16 (depends on 14) The decryption agent of claim 14, further being operative to determine the decryption key based on the identified container image. ### Claim 17 (depends on 14) The decryption agent of claim 14, further being operative, for generating the new service definition, to create a storage area into which the decrypted software package is to be inserted. ### Claim 18 (depends on 17) The decryption agent of claim 17, further being operative, to create the storage area such that at least one of the following conditions is met: the empty file cannot be stored in a persistent storage, does not survive a reboot of the container, is private to the container. ### Claim 19 (depends on 10) A service management entity configured to manage a set-up of a container providing a service to a user in a cloud environment, wherein the container is generated from a container image which comprises an encrypted software package, the service management entity comprising; memory storing a computer program; and processing circuitry for executing the computer program for configuring the service management entity to perform the method of claim 10. ### Claim 20 (depends on 1) A non-transitory computer readable storage medium storing a computer program comprising program code to be executed by at least one processing unit of a container, of a decryption agent entity or of a service management entity wherein execution of the program code causes the at least one processing unit to execute the method of claim 1.