Multi-domain Container Isolation for Mobile Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current mobile device management solutions fail to provide multi-level security and accessibility across different domains, compromising device security due to untrustworthy applications and risky online behaviors.
Innovation Solution
The implementation of software-based systems using operating system-level virtualization (OSLV) technologies to create isolated security containers, allowing for multi-level access and security controls, enabling applications to execute in multiple security domains with fine-grained isolation policies and domain-specific encryption methods.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If applications are executed in a shared environment without isolation, then device accessibility and ease of operation are improved, but security and reliability deteriorate due to untrustworthy applications and risky online behaviors
Solution Approach 1:
The system segments the computing device into multiple isolated containers, each with its own policy set. Applications are executed within specific containers based on their security requirements, allowing untrusted applications to run in restricted environments while trusted applications have appropriate access. This segmentation resolves the contradiction by maintaining ease of operation through multi-application support while improving reliability through isolation-based security.
2Reliability
If applications are isolated in separate containers with different policies, then security and reliability are improved, but device complexity increases due to multiple container management and policy enforcement mechanisms
Solution Approach 1:
The container manager implements a universal interface for creating, managing, and enforcing policies across multiple containers. This multi-functional system handles diverse application types (secure, non-secure, enterprise, personal) through a single unified mechanism, reducing the perceived complexity while maintaining robust multi-level security. The system provides consistent policy enforcement regardless of the specific container or application type.
3Reliability
If multiple domain-specific policies are enforced, then security controls and reliability are improved, but ease of operation deteriorates due to restricted access controls and communication limitations
Solution Approach 1:
The system applies local quality by enforcing different policy sets in different containers based on their specific security requirements. Secure containers have strict access controls, while non-secure containers have more permissive policies. This allows each application domain to operate with appropriate security controls without unnecessarily restricting other applications, maintaining ease of operation for non-critical applications while ensuring security for sensitive operations.
4Object-affected harmful factors
If applications are executed in isolated containers, then harmful factors from untrustworthy applications are contained, but loss of information increases due to restricted resource access and communication controls
Solution Approach 1:
The container manager acts as an intermediary between applications and system resources, mediating access requests based on policy rules. This intermediary approach contains harmful factors by blocking unauthorized access while minimizing information loss by allowing legitimate resource access through controlled channels. The mediator enables necessary communication between containers and resources while enforcing security policies, resolving the contradiction between threat containment and information accessibility.
Data Source
AI summary
An example method includes selecting, based at least on first and second policies, first and second containers in which to execute first and second applications, respectively. The example method further includes isolating execution of the first application in the first container, and isolating execution of the second application in the second container. The example method also includes applying, based at least on the first policy, a first group of security controls to the first application executing in the first container, wherein the first container defines a first domain in which the first application is executed, and applying, based at least on the second policy, a second group of security controls to the second application executing in the second container, wherein the second container defines a second domain in which the second application is executed.