Multi-User Application Isolation via Encrypted Data Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing software applications often face issues with multiple users accessing the same application on a device, leading to altered states and data sharing between different users or enterprises, resulting in security concerns and compliance violations.
Innovation Solution
A computing device with data stores and processors configured to store encrypted data subsets for each user, allowing decryption and configuration based on authentication data to maintain separate executable states for multiple users, ensuring secure and compliant access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the same application is shared between multiple users on a device, then user convenience and device utilization are improved, but data security and compliance are compromised due to inadvertent data sharing between different enterprises
Solution Approach 1:
The application is segmented into multiple isolated instances, each dedicated to a specific user or enterprise. The system creates separate execution environments with distinct data spaces, preventing cross-contamination while allowing multiple users to access the same application codebase on a single device.
Solution Approach 2:
Different data spaces are created with locally optimized security properties for each user. Each user's data environment is configured with specific access controls and isolation levels tailored to their enterprise's requirements, allowing high security for sensitive data while maintaining ease of access for authorized operations.
2Productivity
If application state is maintained for quick resumption, then user productivity is improved, but user-specific data is exposed to subsequent users causing security violations
Solution Approach 1:
The system performs preliminary configuration of isolated data spaces for each user before application execution. User-specific settings, data, and security parameters are pre-established in separate environments, allowing rapid resumption without exposing data to other users.
Solution Approach 2:
Instead of sharing the actual application state, the system creates isolated copies of the execution environment for each user. Each user interacts with their own copy of the application state in a sandboxed environment, maintaining productivity while preventing data exposure to other users.
3Reliability
If encryption is implemented for each user's data, then data security is improved, but system complexity and processing overhead increase
Solution Approach 1:
The encryption and decryption operations are extracted from the main application logic and handled by a dedicated security management component. This separate module manages all cryptographic operations for multiple users, reducing the complexity burden on individual application instances while maintaining strong security.
Solution Approach 2:
A universal encryption framework is implemented that serves all users and applications through a common security infrastructure. The same encryption algorithms and key management mechanisms are reused across all user data spaces, reducing overall system complexity compared to implementing separate encryption systems for each user.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A computing device stores a set of executable code comprising first, second and third subsets of data. The first and second subsets of data comprise first and second encrypted data, respectively. Responsive to receipt of first authentication data for authenticating a respective user, the computing device is arranged to decrypt one of the first and second encrypted data to generate decrypted data, and to configure the third subset of data based on the decrypted data. The third subset of data, having been so configured, is executable by the one or more processors using the operating system to perform one or more tasks on behalf of the respective user. Thus an application-level log in is provided.