Client Protection Space for Secure Server Communication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current client/server service providing systems face challenges in securing both the service user and provider systems from external hacking attacks, as conventional security methods are inadequate in protecting against malicious codes and vulnerabilities, especially in network-based environments.
Innovation Solution
A method is introduced where a protection space is created independently from the existing operating system environment in the client system, and client applications are executed only within this space, ensuring that only trusted network packets are transmitted to the server, utilizing operating system level virtualization to isolate system resources and verify client objects for integrity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional security methods (anti-virus, firewall, patch management) are used to protect client and server systems, then basic security coverage is provided, but they cannot protect against unknown threats, zero-day attacks, or vulnerabilities that lack patches
Solution Approach 1:
The system segments the client system into two distinct execution environments: a normal execution environment for standard applications and a protection space (sandboxed environment) for executing untrusted client applications. This segmentation isolates potentially harmful code from the core system, preventing unknown threats from compromising system reliability while maintaining basic security coverage.
Solution Approach 2:
The protection space acts as an intermediary layer between untrusted client applications and the server system. By requiring all network packets to originate from within this controlled environment, the system mediates communication to ensure only verified, safe packets reach the server, effectively blocking unknown threats and zero-day attacks that would otherwise bypass conventional security measures.
2Ease of operation
If client applications are executed directly in the operating system environment, then application functionality is fully accessible, but the system becomes vulnerable to malicious codes and viruses
Solution Approach 1:
The system divides the execution environment into separate spaces: the normal OS environment for trusted system operations and a sandboxed protection space for untrusted client applications. This segmentation allows applications to execute with full functionality within their designated space while preventing malicious codes from affecting the broader system, thus maintaining ease of operation without exposing the system to harm.
Solution Approach 2:
The protection space creates a flexible containment environment that allows client applications to execute as if they have full system access, while an invisible protective barrier (similar to a thin film) prevents malicious codes from penetrating into the core OS. This shell maintains application functionality while blocking harmful factors.
3Productivity
If the server trusts all network packets from client systems, then service provision is simple and efficient, but the server becomes vulnerable to hacking attacks from compromised clients
Solution Approach 1:
The protection space serves as an intermediary that verifies the origin and integrity of network packets before they reach the server. By requiring packets to originate from within this controlled environment, the system maintains efficient service provision (packets flow smoothly from approved sources) while enhancing server security (compromised clients cannot generate trusted packets outside the protection space).
Solution Approach 2:
The server implements a verification mechanism that checks whether incoming packets originate from the protected execution environment. This feedback loop ensures that only packets from verified, secure sources are processed, maintaining service efficiency for legitimate clients while blocking attacks from compromised systems.
4Reliability
If a protection space is created to isolate client applications, then security against unknown threats is improved, but system complexity increases
Solution Approach 1:
The protection space is designed to be self-contained, with its own execution environment and resource isolation mechanisms. This self-service architecture reduces the need for complex external management systems, as the protected environment manages its own security and execution, thereby improving protection from unknown threats without proportionally increasing overall system complexity.
Solution Approach 2:
The protection space implementation is designed to work across different operating systems and application types using universal sandboxing techniques. By creating a multi-functional security layer that can contain various types of untrusted applications through standardized isolation mechanisms, the system achieves comprehensive protection without requiring complex, application-specific security architectures.
Data Source
AI summary
A service provider provides a service to a service user using a client server based system executed in network, such as Internet, Intranet and Extranet. If the service user request a service to the service provider, the service provider installs a protection space within system of the service user and executes programs requested by the service user within the protection space, thereby both the system of the service user and the system of the service provider are securely protected. A software distritution based on distribution of virtual machine makes a user who is not familiar with a computer use the PC in a easy and speedy way.