Browser Switching via Isolated Sandbox for Malware Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Computer systems face challenges in protecting against malware infections from untrusted web destinations, despite defensive protections, as existing solutions are costly and difficult to maintain, and malware can still reach and compromise devices.
Innovation Solution
Implementing a sandboxed computing environment with an internal isolation firewall that segregates trusted and untrusted browser processes, using a sandbox container process to isolate communications and prevent data exchange without explicit user input, and employing a whitelist or blacklist to determine network destination trustworthiness.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional defensive protections are implemented to protect against malware, then system security is improved, but cost and maintenance difficulty increase
Solution Approach 1:
The patent segments the browser execution environment into two distinct memory spaces: a trusted workspace for legitimate browsing and an isolated sandboxed environment for untrusted destinations. This segmentation allows the system to maintain strong security protections while simplifying maintenance, as the sandboxed environment can be reset or regenerated without affecting the trusted workspace.
Solution Approach 2:
The patent introduces an intermediary sandboxed browser process that acts as a mediator between the user and untrusted web destinations. This intermediary layer isolates potential malware threats from the main system, allowing security protections to be maintained while reducing the complexity of managing and maintaining defensive systems.
2Reliability
If traditional defensive protections are implemented to protect against malware, then system security is improved, but cost increases
Solution Approach 1:
The patent employs a disposable sandboxed environment that can be quickly instantiated and terminated. Rather than maintaining expensive, complex defensive systems continuously, the system creates lightweight sandboxed browser processes only when needed for untrusted destinations, reducing overall system cost while maintaining security.
3Ease of operation
If browser processes operate in a unified memory space, then ease of operation is improved, but security against malware is worsened
Solution Approach 1:
The patent segments memory space into trusted and untrusted regions, allowing browser processes to operate with appropriate isolation. This segmentation maintains ease of operation for trusted sites while preventing malware from spreading to the trusted workspace, thus addressing both usability and security concerns.
4Reliability
If an isolated computing environment is created for untrusted destinations, then malware protection is improved, but device complexity increases
Solution Approach 1:
The patent implements a universal sandboxed environment that can handle multiple untrusted destinations through a single isolated computing environment. This multi-functional approach provides strong malware protection while minimizing the complexity increase, as the same sandboxed infrastructure serves all untrusted browsing needs without requiring separate isolation mechanisms for each destination.
Data Source
AI summary
A host computer system may be configured to connect to a network. The host computer system may be configured to implement a workspace and an isolated computing environment. The host computer system may be configured to isolate the isolated computing environment from the workspace using an internal isolation firewall. The host computer system may be configured to receive a request to communicate with a first network destination. On a condition that the first network destination is determined to be trusted, the processor may be configured to communicate with the first network destination via a first browser process executed in the workspace. On a condition that the first network destination is determined to be untrusted, the processor may be configured to communicate with the first network destination via a second browser process executed in the isolated computing environment.