Component-Level Sandboxing for Enterprise Rights Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Virtualization technologies impose overhead that negatively impacts user experience, necessitating a method to provide virtualization benefits while minimizing this impact.
Innovation Solution
A method and system for component-level sandboxing, which monitors and evaluates data access requests to determine if sandboxing is necessary, allowing only the data access request to be sandboxed while keeping the application intact, thereby reducing overhead and maintaining user experience.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If virtualization is used to provide data security by sandboxing applications, then data security is improved, but system overhead increases and user experience deteriorates
Solution Approach 1:
The patent segments the virtualization approach by distinguishing between sandboxing the entire application versus sandboxing only specific data access requests. This segmentation allows selective application of security measures to critical operations rather than the whole application, reducing overhead while maintaining security for sensitive data access.
Solution Approach 2:
The patent applies local quality by implementing sandboxing with different levels of strictness for different data access requests. Critical data access requests receive full sandboxing protection, while non-critical requests use lighter verification, optimizing the balance between security and performance based on local needs.
2Reliability
If full application sandboxing is implemented, then data security is improved, but system performance and user experience deteriorate due to overhead
Solution Approach 1:
The patent applies partial action by implementing sandboxing only for specific data access requests that require security protection, rather than sandboxing the entire application. This partial approach maintains security for critical operations while avoiding the performance penalty of comprehensive application sandboxing.
Solution Approach 2:
The system segments data access requests into different categories (critical vs. non-critical) and applies sandboxing selectively. This segmentation enables the system to maintain high performance for non-critical operations while ensuring security for critical data access, resolving the contradiction between security and performance.
3Reliability
If sandboxing is applied to data access requests, then data security is improved, but complexity of the system increases
Solution Approach 1:
The patent introduces an intermediary component that acts as a mediator between applications and data access resources. This intermediary evaluates data access requests and applies sandboxing selectively, simplifying the overall system architecture by centralizing security logic rather than embedding complex sandboxing mechanisms throughout the entire application stack.
Data Source
AI summary
Component-level sandboxing is implemented in the example context of an enterprise rights management system. A policy enforcement module monitors an application executing on a client to detect and evaluate data access requests in view of a rights policy. The policy enforcement module determines how to handle the request based on the whether the policy permits the request. If the request is permitted, the policy enforcement module allows the requests and sandboxes it using virtualization. The sandbox virtualizes the thread making the request and/or a data access component involved in the request. Other aspects of the application that do not implicate the rights policy are not sandboxed. In this way, sandboxing is used to enforce the rights policy in a manner that is transparent to the user and consumes relatively few resources of the client.