Web Browser Isolation via Virtual Machine Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Modern operating systems are vulnerable to malware attacks, particularly those that exploit user inexperience, as antivirus and anti-malware software often detect damage only after it occurs, and there is a need for a system that provides enhanced protection with comparable performance to existing systems.
Innovation Solution
A web-based malware mitigation system utilizing a virtual machine with a minimized Linux operating system, BulwarkCore, which isolates the web browser from the host computer, employing a virtual communication link to restrict malicious software and allowing only specific communication formats, thereby preventing malware from affecting the user device.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a virtual machine is used to isolate the web browser from the host computer, then security against malware is improved, but device complexity increases
Solution Approach 1:
The system divides the computing environment into separate segments: a host computing device and a virtual machine. The web browser is isolated within the virtual machine, creating distinct security zones. This segmentation prevents malware from the browser from directly affecting the host system, as the virtual machine acts as an isolated container with limited communication capabilities through restricted communication links.
Solution Approach 2:
A virtual machine serves as an intermediary layer between the web browser and the host computing device. This intermediary controls and filters all communication between the browser environment and the host system through restricted communication links, blocking malicious interactions while allowing necessary functionality. The virtual machine mediates all data flow, preventing direct access to host resources.
2Reliability
If communication is restricted to specific formats only, then malware introduction is prevented, but communication versatility deteriorates
Solution Approach 1:
The communication link implements different quality rules for different directions of data flow. Incoming communication from the virtual machine to the host is heavily restricted to specific safe formats only, while outgoing communication from the host to the virtual machine allows greater flexibility. This local differentiation of communication quality provides security where needed while maintaining usability where safe.
Data Source
AI summary
A system for reducing the effects of unwanted software (“malware”) is described having a user computing device which runs on a user operating system (UOS) and a user web browser coupled by a limited communication link to a host computing device including VM executable code for emulating a virtual machine, a virtual OS which runs on the virtual machine and a web browser adapted to run on the virtual OS. The limited communication link connected between the user computing device and the host computing device is adapted to pass certain user input communications (signals from the input devices) from the user computing device to the host computing device; and pass certain output communications (signals to output devices) from the host computing device to the user computing device thereby restricting malware from being introduced to the user computing device.