Adaptive Rendering Isolation for Sensitive Information Theft Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for preventing theft of sensitive information during remote application sessions are inefficient, prone to false positives and negatives, and require significant computational and bandwidth resources, while existing solutions fail to provide a secure environment against malicious attacks and phishing attempts.
Innovation Solution
The Adaptive Rendering Application Isolation System (ARAIS) isolates applications by rendering them remotely and intercepting input/output at a higher level in the graphics pipeline, using draw commands to minimize data transfer and latency, and evaluates sensitive information only upon user input, preventing verified sensitive information from being transmitted.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If pixel-based remote desktop protocols (RDP) are used to remote applications, then the application can be accessed remotely, but the user experience deteriorates when web browsing is intercepted at the operating system interface level and compatibility issues arise on non-Windows devices
Solution Approach 1:
The patent introduces a browser isolation service as an intermediary layer between the user's browser and the web server. This service runs the browser in an isolated container environment, mediating all web browsing traffic through a controlled interface. The isolation service translates between the isolated browser environment and the user's local browser, enabling remote application access while maintaining cross-platform compatibility through standardized web protocols rather than OS-specific interfaces.
2Reliability
If sandboxing is implemented on the client computing system to isolate applications, then security against malware is improved, but the entire client system remains vulnerable if the attack escapes the sandbox and client-side isolation requires software installation
Solution Approach 1:
The patent moves the sandboxing isolation from the client side to a server-side browser isolation service. The isolated browser runs in a containerized environment on the remote server, acting as an intermediary that executes web content in a controlled, isolated space. This eliminates the need for client-side software installation while containing security threats to the isolated environment. The isolation service mediates all interactions between the untrusted web content and the user's local system, preventing attacks from reaching the client machine.
Solution Approach 2:
The patent segments the browsing environment into an isolated container running on the remote server, separate from the user's local system. This segmentation divides the computing environment into distinct isolation boundaries - the isolated browser instance in the container, the browser isolation service managing the container, and the user's local browser. This spatial and architectural segmentation ensures that security threats remain confined to the isolated segment and cannot affect the user's local system.
3Reliability
If extensive CPU, GPU, and memory resources are allocated to run web browsers remotely on a server, then browser isolation security is achieved, but the computational cost and expense increase significantly
Solution Approach 1:
The patent implements partial isolation by containing only the browser process and its immediate web browsing activities in an isolated container environment on the server, rather than isolating the entire server infrastructure. This partial action approach provides sufficient security for web browsing while avoiding the excessive computational overhead of full-system isolation. The isolation service applies isolation selectively to the browser component that requires it, reducing overall resource consumption compared to comprehensive server-wide isolation.
Solution Approach 2:
The patent uses lightweight container virtualization to create isolated browsing environments that share the underlying server infrastructure. Instead of allocating dedicated physical resources for each isolated browser instance, the system creates virtualized copies of the browsing environment that share CPU, memory, and storage resources. This copying approach with resource sharing significantly reduces the computational cost compared to running full isolated systems for each user while maintaining security boundaries through container isolation mechanisms.
Data Source
AI summary
Methods, systems, and techniques for application isolation by remote-enabling applications are provided. Example embodiments provide an Adaptive Rendering Application Isolation System (“ARAIS”), which transparently enables applications to run in an isolated execution environment yet be rendered locally in a manner that facilitates preventing theft of sensitive information while allowing users to interact with any third-party application or website via the local environment without overburdening available bandwidth or computational resources by, in some cases, evaluating only select information responsive only to select events, as compared to whitelist/blacklist techniques, monitoring all information provided by the user, or other techniques. The ARAIS typically includes an orchestrator server that comprises one or more of a sensitive-information theft-prevention logic engine, information-theft prevention engines, or a rules engine. These components cooperate to deliver isolation-ready technology with sensitive-information theft prevention to client applications.