Browser Isolation via Virtualized GPU Command Decoupling

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing browser isolation techniques using pixel-based solutions compromise user experience due to rendering on cloud servers, increasing the load on cloud infrastructure and affecting performance.

Innovation Solution

Implementing a cloud-based system that uses virtualized Graphics Processing Units (GPUs) to initiate browser isolation sessions, where GPU commands are encoded at the server, sent over the network using TCP, and decoded and rendered at the user device, decoupling rendering from code execution and simulating a GPU device in the server for secure execution.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If pixel-based browser isolation is used, then security is improved, but user experience and performance deteriorate due to rendering on cloud servers

Engineering Contradiction:

ImprovesecurityVSAvoiduser experience

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The system segments the browser isolation architecture into two independent components: code execution (sandboxed on cloud server) and graphics rendering (performed locally on user device). This segmentation allows security benefits of cloud-based isolation to be maintained while eliminating the performance penalties of remote rendering, as only lightweight GPU commands are transmitted rather than heavy pixel streams

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The rendering function is extracted from the cloud server environment and relocated to the user's local device. The server executes all code in a sandboxed environment and sends only GPU command sequences to the local device, which then performs rendering independently. This extraction eliminates network dependency for rendering operations while maintaining security through sandboxed code execution

Inventive Principle:

Principle #2Taking out (Extraction)

2Reliability

If pixel-based browser isolation is used, then security is improved, but cloud infrastructure load increases

Engineering Contradiction:

ImprovesecurityVSAvoidcloud infrastructure load

Core Design Contradiction:

ReliabilityVSPower

Solution Approach 1:

The rendering workload is extracted from the cloud infrastructure and transferred to user devices. The server only needs to execute code in sandboxed environments and transmit compressed GPU command sequences, dramatically reducing computational requirements compared to full pixel-based rendering while maintaining security benefits

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The system changes the output parameter from pixel data (high-bandwidth, computationally intensive) to GPU command sequences (low-bandwidth, computationally efficient). This parameter transformation reduces network transmission requirements and server processing load while enabling local rendering capability

Inventive Principle:

Principle #35Parameter changes

Data Source

PatentUS20240403993A1Systems and methods for browser isolation via a virtualized Graphics Processing Unit (GPU)

Publication Date: 2024.12.05 ZSCALER INC

AI summary

Systems and methods for browser isolation via a virtualized Graphics Processing Unit (GPU). Various embodiments include steps of initiating a browser isolation session between a user device and a server associated with a cloud-based system; receiving a request for a resource from the user device; sending Graphics Processing Unit (GPU) commands associated with the resource to the user device over a network; and rendering graphics based on the GPU commands at the user device.