Container Application Isolating Hosted Apps via Permission Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computing systems face widespread attacks through malicious applications that access native device capabilities without restrictions, posing risks to user privacy and data security by accessing hardware components like cameras, microphones, and location services.
Innovation Solution
A container application is implemented to execute hosted applications while limiting access to native device capabilities, enforcing restrictions on which capabilities are accessible, thereby controlling and managing access to hardware components such as file systems, cameras, microphones, and location services.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If hosted applications are allowed to access native device capabilities without restrictions, then application functionality and versatility are improved, but security and privacy protection deteriorate
Solution Approach 1:
The patent segments native device capabilities into distinct permission categories (camera, microphone, location, file system, etc.) and grants access to hosted applications on a per-capability basis rather than all-or-nothing. This segmentation allows the container application to provide specific functionality while limiting exposure to harmful factors.
Solution Approach 2:
The container application serves as an intermediary layer between hosted applications and native device capabilities. It mediates access requests by enforcing permission policies, thereby enabling application functionality while protecting against security risks through controlled intermediate access.
2Object-affected harmful factors
If container application enforces strict limits on hosted application access to native device capabilities, then security and privacy protection are improved, but application functionality and versatility deteriorate
Solution Approach 1:
The permission enforcement mechanism is dynamic rather than static. The container application can adjust permission levels based on the specific hosted application, user context, and operational state, allowing functionality to be enabled when safe and restricted when risky, thereby balancing security with versatility.
Solution Approach 2:
The system changes permission parameters (access rights to specific capabilities) based on the hosted application's identity, user preferences, and security policies. This parameter adjustment allows the same container application to provide different levels of functionality to different hosted applications while maintaining security.
3Manufacturing precision
If permission information is stored and enforced by container application, then access control precision is improved, but device complexity increases
Solution Approach 1:
The container application implements a universal permission management system that handles multiple native device capabilities (camera, microphone, location, file system, etc.) through a single standardized interface and enforcement mechanism, reducing complexity compared to implementing separate control systems for each capability.
Data Source
AI summary
Limiting access to native device capabilities. A method includes, at a container application installed at the computing device, the container application configured to execute hosted script based applications, identifying a hosted application to execute. The method further includes, at the container application, obtaining information identifying a limited set of capabilities from among the native device capabilities indicating which of the native device capabilities the hosted application has been granted access to. The method further includes, at the container application, executing the hosted application and enforcing limits on the hosted application such that the hosted application is only able to access the native device capabilities identified in the limited set of capabilities.