Application Lifecycle Queueing for Secure Execution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Enterprises face vulnerabilities in securing proprietary data due to shared execution environments on personal devices, where user applications can interfere with and compromise enterprise activities, especially when both types of applications run in the same memory space, leading to potential data exposure and security breaches.
Innovation Solution
A trusted execution environment on computing devices that segregates enterprise and non-enterprise applications, using an operation queue to defer lifecycle operations until the trusted environment is established, ensuring that only when security measures are in place can these operations execute, thereby preventing unauthorized data access or communication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If enterprise applications and user applications run in the same memory space on personal devices, then device usability and application compatibility are improved, but security and data integrity deteriorate due to potential interference and compromise from user applications
Solution Approach 1:
The patent segments the execution environment into a trusted execution environment (TEE) and a non-TEE. Enterprise applications run within the TEE which provides isolated memory space and protected execution contexts, while user applications run outside the TEE. This segmentation allows both types of applications to coexist on personal devices without compromising security, as the TEE prevents user applications from accessing or interfering with enterprise application data and operations.
2Speed
If lifecycle operations are executed immediately upon application launch, then application responsiveness and user experience are improved, but security is compromised because the trusted execution environment may not be fully established
Solution Approach 1:
The patent implements preliminary action by establishing the trusted execution environment and its security infrastructure (including secure key store, interprocess communication channels, and network connections) before enterprise applications are launched. The system pre-configures the TEE with all necessary security measures, ensuring that when applications execute lifecycle operations, the protected environment is already in place. This eliminates the security vulnerability window that would exist if applications started before the TEE was fully established.
3Reliability
If infrastructure operations for establishing the trusted execution environment are performed before application startup, then security oversight is improved, but application startup time increases due to the additional initialization overhead
Solution Approach 1:
The patent merges the initialization of the trusted execution environment with the application launch process itself. Rather than completely separating TEE setup from application startup, the system combines these operations so that the TEE is established concurrently with application initialization. This integration allows infrastructure operations to be performed in parallel with application loading, reducing the perceived startup time while maintaining security oversight. The system orchestrates the TEE establishment and application launch together, optimizing the sequence of operations to minimize total startup time.
Data Source
AI summary
A trusted execution environment on an enterprise-enabled computing device allows invocation of a suite of secure applications (apps) on a computing device in an enterprise without hindering external or non-enterprise apps from running on in the same memory space on the same enterprise computing device. An application wrapper provides an operation queue for storing application lifecycle operations while the trusted execution environment is enabled, and the environment is secured. The application defers lifecycle operation to ensure that all security measures are in place before it is allowed to execute. The operation queue receives entries corresponding to the application lifecycle events, and suspends process execution of the lifecycle operations until the secure environment is ready for the operation queued events to be executed.