Data Proxy Service for Application Sandboxing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems fail to effectively sandbox applications on devices, allowing undesirable access to user data during deployment, which compromises privacy and security.
Innovation Solution
Implementing a data access profile through a deployment mock data configuration interface to restrict and intercept data requests, providing mock data for sensitive types while allowing access to non-sensitive data types, thus deploying applications in a sandbox mode that protects user data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If applications are deployed without sandboxing, then applications can access all user data for normal operation, but user data privacy and security are compromised
Solution Approach 1:
The patent segments user data into different types (sensitive and non-sensitive) and implements granular access control through data access profiles. Each profile specifies which data types an application can access, allowing selective sanding of sensitive data while permitting access to non-sensitive data, thus resolving the contradiction between security and operational functionality
Solution Approach 2:
The patent introduces a data proxy service as an intermediary component that sits between applications and user data. This proxy service intercepts data requests, evaluates them against data access profiles, and selectively fulfills or blocks requests. The intermediary enables secure sanding without completely blocking application functionality, as the proxy can grant access to non-sensitive data while blocking sensitive data
2Reliability
If sandboxing is implemented after installation, then applications are protected from accessing sensitive data, but applications may have already accessed user data during deployment with undesirable access
Solution Approach 1:
The patent implements preliminary sanding by integrating the data proxy service and data access profile enforcement into the application deployment process itself. The sandbox environment is established before the application begins operating, and data access restrictions are in place during the entire deployment window. This preliminary action eliminates the time window where applications could access sensitive data without restrictions
3Reliability
If mock data is provided for sensitive data types, then application functionality is preserved while privacy is protected, but application cannot access real sensitive user data
Solution Approach 1:
The patent applies different data provisioning strategies to different data types based on their sensitivity. For sensitive data types, mock data is provided to maintain application functionality while protecting privacy. For non-sensitive data types, real user data is provided to maintain data accuracy and application performance. This local differentiation resolves the contradiction between privacy protection and application adaptability
Data Source
Figure 1
Figure 2
Figure 3
AI summary
One or more techniques and/or systems are provided for deploying an application according to a data access profile used to sandbox the application. For example, an event planner app may be identified for download from an app store. A deployment mock data configuration interface may be presented to a user prior to or as a preliminary operation of downloading and/or installing the event planner app. A data access profile, specifying that the event planner app has access to user age data, but is blocked from accessing user phone number data, for example, may be received through the deployment mock data configuration interface. The event planner app may thus be deployed in a sandbox mode on the device based upon the data access profile (e.g., real age data may be provided to the event planner app whereas mock phone number data may be provided to the event planner app).