Containerized Secure Computing Resources Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current computing devices face challenges in securely managing access to sensitive data across multiple execution environments, particularly in segregating personal and professional data, while preventing unauthorized access and data leakage between containers.
Innovation Solution
A computing device architecture with two operating systems, one providing rich execution environments and the other a trusted execution environment, uses a software module to manage access requests through container access rules, ensuring secure data access and operations by trusted applications, and maintaining a concordance between containers to enforce access controls.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multiple execution environments are provided for different purposes (personal and professional), then data segregation and security are improved, but system complexity and access management burden increase
Solution Approach 1:
The system divides the execution environment into multiple isolated containers (first container for personal data, second container for professional data), each with its own secure computing resources. This segmentation allows data to be separated into distinct security domains while maintaining manageable access control through container-specific rules.
Solution Approach 2:
The patent introduces an intermediary access management layer that mediates between applications and secure computing resources. This layer enforces access rules and policies, simplifying the burden on developers by automatically managing cross-container access control without requiring complex application-level security implementation.
2Reliability
If access control rules are enforced between containers, then unauthorized access is prevented, but access management complexity and developer burden increase
Solution Approach 1:
The access management system provides universal access control mechanisms that work across all containers and secure computing resources. By implementing a standardized access rule enforcement layer, the system handles diverse access scenarios (personal to professional, professional to personal) through a single unified framework, reducing the need for application-specific security code.
Solution Approach 2:
The system enables self-service access management where the access control layer automatically evaluates and enforces rules based on container identifiers and access policies. This automation reduces developer burden by eliminating manual security configuration and allowing the system to autonomously manage access decisions between containers.
3Reliability
If container concordance is implemented for access management, then data leakage is prevented, but system complexity and access rule management increase
Solution Approach 1:
The patent introduces a new dimension of container identification and concordance mapping between containers. By adding this identification layer, the system can track and enforce access rules based on container relationships without requiring complex point-to-point security configurations. The concordance mechanism operates in this additional dimensional space, simplifying the management of data protection rules.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A computing device has first and second operating systems with access to separate first and second memories. The second operating system hosts containers which provide separate execution environments. The containers have secure computing resources. A software module in the second operating system receives access requests from applications in the first operating system and selectively passes the requests based on rules for accessing the containers.