Granted Patent B2

US 12,395,325 · App. 18/327,198 · Granted Aug 19, 2025

Inventors: Leigh Griffin (Waterford, IE); Stephen Coady (Dublin, IE)

Assignee: Red Hat, Inc.

H04L9/0852

Abstract

Claims (71)

1. A method comprising:

determining, by a computing device, that a container image comprising a plurality of container image layers generated by a container build engine is to be transmitted from a container image repository to a target computing device;

determining, by the computing device, that a first container image layer of the plurality of container image layers is a sensitive container image layer to be encrypted prior to transmission to the target computing device;

obtaining, by the computing device, a first key generated by a quantum computing system that uses a quantum key distribution protocol, a plurality of qubits and a quantum communication channel to generate the first key;

encrypting the first container image layer using the first key to generate a first encrypted container image layer; and

transmitting the first encrypted container image layer to the target computing device.

2. The method of claim 1 wherein determining that the first container image layer of the plurality of container image layers is a sensitive container image layer to be encrypted prior to transmission to the target computing device comprises accessing metadata that indicates which container image layers of the plurality of container image layers are sensitive container image layers.

3. The method of claim 1 further comprising:

determining, by the computing device, that a plurality of container image layers including the first container image layer are sensitive container image layers to be encrypted prior to transmission to the target computing device;

encrypting, by the computing device, the plurality of container image layers using the first key to generate a corresponding plurality of encrypted container image layers; and

transmitting the plurality of encrypted container image layers to the target computing device.

4. The method of claim 1 further comprising:

determining, by the computing device, that a second container image layer of the plurality of container image layers is not a sensitive container image layer; and

sending, by the computing device to the target computing device, the second container image layer without encrypting the second container image layer.

5. The method of claim 1 further comprising:

determining, by the computing device, that an eavesdropper has eavesdropped on the quantum communication channel;

in response to determining that the eavesdropper has eavesdropped on the quantum communication channel, sending a message to the target computing device indicating that the first encrypted container image layer has been compromised.

6. The method of claim 5 further comprising:

in response to determining that the eavesdropper has eavesdropped on the quantum communication channel, automatically obtaining, by the computing device, a second key generated by the quantum computing system using the quantum key distribution protocol, the plurality of qubits and the quantum communication channel;

encrypting the first container image layer using the second key to generate a second encrypted container image layer; and

transmitting the second encrypted container image layer to the target computing device.

7. The method of claim 5 further comprising:

determining, by the computing device, an estimated amount of the first key ascertained by the eavesdropper; and

determining, by the computing device, that the estimated amount of the first key ascertained by the eavesdropper is less than a threshold;

in response to determining, by the computing device, that the estimated amount of the first key ascertained by the eavesdropper is less than the threshold, inhibiting sending a message to the target computing device indicating that the first encrypted container image layer has been compromised.

8. The method of claim 5 further comprising:

determining, by the computing device, an estimated amount of the first key ascertained by the eavesdropper; and

determining, by the computing device, that the estimated amount of the first key ascertained by the eavesdropper is greater than a threshold;

in response to determining, by the computing device, that the estimated amount of the first key ascertained by the eavesdropper is greater than the threshold, sending a message to the target computing device indicating that the first encrypted container image layer has been compromised.

9. The method of claim 1 wherein the quantum computing system comprises the computing device.

10. The method of claim 1 further comprising:

determining, by the computing device, that an eavesdropper has eavesdropped on the quantum communication channel;

in response to determining that the eavesdropper has eavesdropped on the quantum communication channel, determining a plurality of target computing devices to which the first encrypted container image layer has been transmitted; and

sending, by the computing device to each of the plurality of target computing devices, a message that the first encrypted container image layer has been compromised.

11. The method of claim 10 further comprising:

automatically obtaining, by the computing device, a second key generated by the quantum computing system using the quantum key distribution protocol, the plurality of qubits and the quantum communication channel;

encrypting the first container image layer using the second key to generate a second encrypted container image layer; and

transmitting, by the computing device to each of the plurality of target computing devices, the second encrypted container image layer.

12. A computing device comprising:

a memory; and

a processor device coupled to the memory to:

determine that a container image comprising a plurality of container image layers generated by a container build engine is to be transmitted from a container image repository to a target computing device;

determine that a first container image layer of the plurality of container image layers is a sensitive container image layer to be encrypted prior to transmission to the target computing device;

obtain a first key generated by a quantum computing system that uses a quantum key distribution protocol, a plurality of qubits and a quantum communication channel to generate the first key;

encrypt the first container image layer using the first key to generate a first encrypted container image layer; and

transmit the first encrypted container image layer to the target computing device.

13. The computing device of claim 12 wherein to determine that the first container image layer of the plurality of container image layers is a sensitive container image layer to be encrypted prior to transmission to the target computing device, the processor device is further to access container image metadata that indicates which container image layers of the plurality of container image layers are sensitive container image layers.

14. The computing device of claim 12 wherein the processor device is further to:

determine that a plurality of container image layers including the first container image layer are sensitive container image layers to be encrypted prior to transmission to the target computing device;

encrypt the plurality of container image layers using the first key to generate a corresponding plurality of encrypted container image layers; and

transmit the plurality of encrypted container image layers to the target computing device.

15. The computing device of claim 12 wherein the processor device is further to:

determine that a second container image layer of the plurality of container image layers is not a sensitive container image layer; and

send, to the target computing device, the second container image layer without encrypting the second container image layer.

16. The computing device of claim 12 wherein the processor device is further to:

determine that an eavesdropper has eavesdropped on the quantum communication channel;

in response to determining that the eavesdropper has eavesdropped on the quantum communication channel, send a message to the target computing device indicating that the first encrypted container image layer has been compromised.

17. A non-transitory computer-readable storage medium that includes executable instructions to cause a processor device to:

determine that a container image comprising a plurality of container image layers generated by a container build engine is to be transmitted from a container image repository to a target computing device;

determine that a first container image layer of the plurality of container image layers is a sensitive container image layer to be encrypted prior to transmission to the target computing device;

obtain a first key generated by a quantum computing system that uses a quantum key distribution protocol, a plurality of qubits and a quantum communication channel to generate the first key;

encrypt the first container image layer using the first key to generate a first encrypted container image layer; and

transmit the first encrypted container image layer to the target computing device.

18. The non-transitory computer-readable storage medium of claim 17 wherein to determine that the first container image layer of the plurality of container image layers is a sensitive container image layer to be encrypted prior to transmission to the target computing device, the instructions are further operable to cause the processor device to access container image metadata that indicates which container image layers of the plurality of container image layers are sensitive container image layers.

19. The non-transitory computer-readable storage medium of claim 17 wherein the instructions are further operable to cause the processor device to:

determine that a plurality of container image layers including the first container image layer are sensitive container image layers to be encrypted prior to transmission to the target computing device;

encrypt the plurality of container image layers using the first key to generate a corresponding plurality of encrypted container image layers; and

transmit the plurality of encrypted container image layers to the target computing device.

20. The non-transitory computer-readable storage medium of claim 17 wherein the instructions are further operable to cause the processor device to:

determine that a second container image layer of the plurality of container image layers is not a sensitive container image layer; and

send, to the target computing device, the second container image layer without encrypting the second container image layer.

Assignments (2)

Continuity (1)

References Cited (12)