Cloud Container Credential Secret Store

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Cloud platforms face security risks due to the exposure of confidential credentials through environment variables, which are often stored in plain text and accessible globally within containers, allowing unauthorized access to connected containers and systems.

Innovation Solution

A containerized application initializes in a cloud-based environment, obtaining and storing environment variables in a secret store, which can be encrypted, with options for symmetric or asymmetric key decryption, and utilizing a secure filesystem to manage access, thereby minimizing exposure and enhancing security.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If environment variables are stored in plain text for easy access, then ease of operation is improved, but security is worsened due to global accessibility and exposure risks

Engineering Contradiction:

Improveaccessibility of credentialsVSAvoidsecurity risk from credential exposure

Core Design Contradiction:

Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The patent extracts credentials from environment variables and stores them in a dedicated secret store component. This separation removes credentials from the globally accessible environment variable space while maintaining controlled access through the secret store interface, thereby reducing exposure risk while preserving operational accessibility.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The patent implements encryption specifically for credential storage in the secret store, applying security measures locally to sensitive data rather than globally to all environment variables. This allows plaintext access for non-sensitive data while providing encrypted protection for credentials, balancing accessibility and security based on local requirements.

Inventive Principle:

Principle #3Local quality

2Object-affected harmful factors

If environment variables are wiped after storing to reduce exposure, then security is improved, but reliability is worsened if access is needed later

Engineering Contradiction:

Improvecredential exposure durationVSAvoidavailability of credentials

Core Design Contradiction:

Object-affected harmful factorsVSReliability

Solution Approach 1:

The patent implements a mechanism where environment variables are treated as temporary, disposable objects that are wiped after use. The secret store provides persistent credential storage with controlled access, allowing credentials to be available when needed while minimizing their exposure time in the environment variable space. This disposable approach to environment variables reduces security risk while maintaining reliability through the persistent secret store.

Inventive Principle:

Principle #27Cheap short-living objects (Disposable)

Data Source

PatentUS11310037B2Cloud container security framework

Publication Date: 2022.04.19 SAP SE

AI summary

A containerized application is initialized in a cloud-based computing environment. Thereafter, the containerized application obtains environment variables encapsulating credentials. The containerized application stores the environment variables in a secret store of the containerized application. The environment variables are later wiped upon completion of the storing of the environment variables. Related apparatus, systems, techniques and articles are also described.