Securing collection of information of tenant container

Patent metadata

Field	Value
Publication number	US-2025168150-A1
Application number	US-202118695133-A
Country	US
Kind code	A1
Filing date	Oct 1, 2021
Priority date	Oct 1, 2021
Publication date	May 22, 2025
Grant date	—

Abstract

Embodiments of the present disclosure provide a method, a first computing device, a second computing device, and a computer program product for securing the information related to a tenant container. The method is performed by a first computing device. The method comprises receiving, from an endpoint agent resident on the first computing device, information collected from the tenant container during execution of the tenant container and encrypting at least some of the information related to the tenant container. Further, the method comprises transmitting the encrypted information to be decrypted at a second computing device in a secure environment for analysing the information at the second computing device. Corresponding first computing device, second computing device and computer program products are also disclosed.

First claim

1 . A method for securing a tenant container executed by a first computing device, the method performed by the first computing device, the method comprising:
receiving, from an endpoint agent resident on the first computing device, information collected from the tenant container during execution of the tenant container; encrypting at least some of the information related to the tenant container; and transmitting the encrypted information to be decrypted at a second computing device in a secure environment in the second computing device, wherein the information collected from the tenant container by the endpoint agent is not accessible to one or more processes that are being executed on the first computing device.

2 . The method according to claim 1 , further comprising:
identifying at least some of the information related to the tenant container to be encrypted.

3 . The method according to claim 1 , further comprising:
transmitting the encrypted information to a tenant associated with the tenant container.

4 . The method according to claim 1 , wherein the step of encrypting at least some of the information related to the tenant container comprises:
registering for an encryption service executing within a secure environment hosted by the second computing device; obtaining a public key which is generated within or inserted into the secure environment, hosted by the second computing device; and encrypting at least some of the information related to the tenant container using the public key.

5 . The method according to claim 1 , wherein the step of registering for an encryption service executing within a secure environment hosted by the second computing device comprises:
generating a request for the encryption service; and transmitting the request for the encryption service to the secure environment.

6 . The method according to claim 1 , wherein the information from the tenant container comprises metadata, events, and alerts related to multiple software processes, relationships between the software processes, operation of the first computing device, private data, Personal Identifiable Information, PII, related to the tenant container, and operating system configuration changes.

7 . A method for securing information related to a tenant container, the method performed by a second computing device, the method comprising:
receiving encrypted information related to the tenant container from a first computing device; decrypting the encrypted information in a secure environment hosted by the second computing device; and controlling the information leaving the secure environment.

8 . The method according to claim 7 , wherein the step of controlling the information leaving the secure environment comprising:
receiving, from a tenant associated with the tenant container or configured, an input identifying what information related to the tenant container leaves the secure environment hosted by the second computing device; and masking at least some of the information related to the tenant container based on the received input or other configuration.

9 . The method according to claim 7 , wherein the input identifying the information comprises one or more of: type of information of the tenant container, selection of information and metadata of the tenant container.

10 . The method according to claim 7 , wherein the step of controlling the information leaving the secure environment comprises:
identifying the information leaving the secure environment; and selectively masking at least some of the identified information leaving the secure environment;

11 . The method according to claim 7 , wherein the step of controlling the information leaving the secure environment comprises:
selectively encrypting the information by:
identifying the information leaving the secure environment; and
selectively replacing at least some of the identified information leaving the secure environment with a plurality of encrypted strings.

12 . The method according to claim 7 , wherein the step of controlling the information leaving the secure environment comprises:
selectively encrypting the information by:
identifying the information leaving the secure environment; and
result of analysis of the identified information leaving the secure environment.

13 . The method according to claim 7 , wherein composition of the information leaving the secure environment is dependent on a receiver of the information, wherein the receiver is one or more of: a tenant associated with the tenant container and a cloud service provider, CSP, hosting the tenant container.

14 . The method according to claim 7 , wherein the step of decrypting the encrypted information in a secure environment comprises:
registering for an encryption service executing within the secure environment hosted by the second computing device; obtaining a private key which is generated or inserted into the secure environment in the second computing device; and decrypting the encrypted information related to the tenant container using the private key.

15 . The method according to claim 7 , wherein the step of registering for an encryption service executing within a secure environment comprises:
generating a request for the encryption service; and transmitting the request for the encryption service to the secure environment.

16 . The method according to claim 7 , wherein the information from the tenant container comprises metadata, events, and alerts related to multiple software processes, relationships between the software processes, operation of the first computing device, private data, Personal Identifiable Information, PII, related to the tenant container and operating system configuration changes.

17 . The method according to claim 7 , wherein a summary of the information leaving the secure environment is generated in the secure environment.

18 . The method according to claim 17 , further comprising:
transmitting, to a tenant associated with the tenant container, the summary of the information leaving the secure environment.

19 . A first computing device for securing a tenant container, the first computing device being adapted for:
receiving, from an endpoint agent resident on the first computing device, information collected from the tenant container during execution of the tenant container; encrypting at least some of the information related to the tenant container; and transmitting the encrypted information to be decrypted at a second computing device in a secure environment in the second computing device, wherein the information collected from the tenant container by the endpoint agent is not accessible to one or more processes that are being executed on the first computing device.

20 - 24 . (canceled)

25 . A second computing device for securing information related to a tenant container, the second computing device being adapted for:
receiving encrypted information related to the tenant container from a first computing device; decrypting the encrypted information in a secure environment hosted in the second computing device; and controlling the information leaving the secure environment.

26 - 38 . (canceled)

Assignees

• Ericsson Telefon Ab L M

Inventors

• Normann Henrik
• Pålsson Lina
• Smeets Bernard
• Eriksson Mikael

Classifications

• H04L9/30

  Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy · CPC title

• H04L63/0428 Primary

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title

• H04L63/1441 Primary

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title