Guest OS Container Isolation via Namespace Tool Privilege Dropping

Solution Overview

Problem

Implementing a guest operating system on mobile devices while maintaining security and conserving power and processing resources, as traditional methods like rooting or virtualization compromise security and efficiency.

Innovation Solution

The system employs a name space tool (NST) to spawn a container for the guest OS with dedicated domain mapping, dropping root privileges and using CAP kernel reinforcement to isolate and manage privileges, ensuring secure and efficient operation.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If traditional virtualization or rooting methods are used to implement a guest OS on mobile devices, then the guest OS can run on the device, but security is compromised and power/processing resources are consumed inefficiently

Engineering Contradiction:

Improvedevice securityVSAvoidpower consumption

Core Design Contradiction:

ReliabilityVSUse of energy by moving object

Solution Approach 1:

The system segments the operating system into a host OS and a guest OS running in isolated containers. Each container has its own namespace and resource limits, allowing the guest OS to run independently without compromising the host OS security. This segmentation enables secure multi-OS operation while optimizing resource usage through controlled isolation.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent changes the parameter of privilege management by implementing a privilege dropping mechanism. The NST process initially runs with root privileges to set up containers, then drops these privileges after container creation. This parameter change from high to low privilege state maintains security while enabling guest OS functionality, directly addressing the security concern without requiring continuous high resource consumption.

Inventive Principle:

Principle #35Parameter changes

2Adaptability or versatility

If traditional virtualization or rooting methods are used to implement a guest OS on mobile devices, then the guest OS can run on the device, but security is compromised

Engineering Contradiction:

Improveguest OS functionalityVSAvoiddevice security

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The NST (Namespace Tool) acts as an intermediary between the host OS and guest OS. It manages container creation, namespace isolation, and privilege dropping, serving as a security mediator that enables guest OS functionality while maintaining host OS security. This intermediary approach allows versatile multi-OS operation without direct security compromises.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The system segments the operating system into a host OS and a guest OS running in isolated containers. Each container has its own namespace and resource limits, allowing the guest OS to run independently without compromising the host OS security. This segmentation enables secure multi-OS operation while optimizing resource usage through controlled isolation.

Inventive Principle:

Principle #1Segmentation

3Adaptability or versatility

If traditional virtualization methods are used to implement a guest OS, then the guest OS can run on the device, but processing resources are consumed inefficiently

Engineering Contradiction:

Improvemulti-OS capabilityVSAvoidprocessing efficiency

Core Design Contradiction:

Adaptability or versatilityVSProductivity

Solution Approach 1:

The system segments the operating system into a host OS and a guest OS running in isolated containers. Each container has its own namespace and resource limits, allowing the guest OS to run independently without compromising the host OS security. This segmentation enables secure multi-OS operation while optimizing resource usage through controlled isolation.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The container infrastructure provides universal support for running multiple operating systems on a single mobile device. The same container mechanism handles both security isolation and resource management, making the system versatile for different guest OS types while maintaining efficient processing through unified resource control.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Data Source

PatentUS11042398B2System and method for guest operating system using containers

Publication Date: 2021.06.22 SAMSUNG ELECTRONICS CO LTD

AI summary

A method for operating an electronic device, the method including spawning a name space tool (NST) as part of a boot process of a host OS, wherein the NST is a process with a plurality of root privileges of the host OS. The method further includes spawning, by the NST, a container for a guest OS, wherein the container for the guest OS is mapped to a dedicated domain in the host OS, and dropping, by the NST, a root privilege of the host OS in response to spawning the container for the guest OS.