Optimizing container image encryption
AssigneeEMC IP Holding Company LLC
InventorsKfir Wolfson, Jehuda Shemer, Stav Sapir, Amos Zamir, Naor Radami
Life of this patent
Estimating the term…
Abstract
One example method includes packaging a containerized application into at least two images. The first image may include the main application and the second image includes a decryptor. Sensitive information associated with the application is encrypted and included in the second image. The decryptor operates separately from the main application. After the decryptor successfully completes, the main application is run. The main application may include a copier layer to copy any data decrypted by the decryptor into the main application.
Claims19
A method, comprising:
- packaging an application that is associated with sensitive data into at least a first image and a second image by placing first layers in the first image, the first layers including a copier layer and by placing second layers in the second image, wherein the second layers include a decryptor layer and an encrypted layer that includes the sensitive data in an encrypted form;
- and
- configuring the second image to run before the first image.
A non-transitory storage medium having stored therein instructions that are executable by one or more hardware processors to perform operations comprising:
- packaging an application that is associated with sensitive data into at least a first image and a second image by placing first layers in the first image, the first layers including a copier layer and by placing second layers in the second image, wherein the second layers include a decryptor layer and an encrypted layer that includes the sensitive data in an encrypted form;
- and
- configuring the second image to run before the first image.
The non-transitory storage medium of claim 14, further comprising running the copier layer, wherein the copier layer copies the decrypted sensitive data to a location in a layer root directory associated with the main application.
Dependencies are inferred from the claim text.