Hardware Virtualized Security Isolation for Untrusted Network Resources
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Computing devices are vulnerable to infections when accessing untrusted network resources, leading to security risks and productivity limitations, particularly in workplace environments where disabling network access is not feasible due to administrative complexities and costs.
Innovation Solution
Implementing hardware-based virtualized security isolation by using containers to isolate untrusted network resources from the host operating system, allowing trusted resources to be accessed directly while untrusted resources are contained within isolated environments, monitored, and managed to prevent malicious activity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If network access is disabled to protect against infections, then security is improved, but functionality and productivity are severely limited
Solution Approach 1:
The system segments network access by creating isolated container environments for untrusted resources. Applications run in containers that are separated from the host operating system, allowing network access to untrusted resources without exposing the host system. This segmentation enables both security (host protection) and functionality (application network access).
Solution Approach 2:
The container acts as an intermediary between the host operating system and untrusted network resources. The container provides a controlled environment that mediates network access, allowing applications to reach untrusted resources while preventing direct exposure of the host system. This intermediary layer resolves the contradiction by enabling communication without direct connection.
2Reliability
If limited network access is enforced by blocking untrusted resources, then security is improved, but administration costs increase due to continuous policy updates
Solution Approach 1:
The containerization approach enables self-service security isolation. Each application runs in its own container with predefined isolation boundaries, automatically protecting the host system without requiring continuous administrative intervention. The container infrastructure provides built-in security mechanisms that operate autonomously, reducing the burden of manual policy updates and security management.
3Reliability
If containers are activated for every untrusted resource access, then security isolation is maintained, but system resource overhead increases
Solution Approach 1:
The system merges multiple container instances into a shared container infrastructure. Instead of creating completely separate isolated environments for each access, the system uses a shared container base image and common runtime resources. This consolidation maintains security isolation while significantly reducing the per-instance resource overhead by sharing common components across multiple container instances.
Solution Approach 2:
The system uses container base images as templates that can be copied and instantiated multiple times. Rather than creating full duplicate environments, the base image is copied to create new container instances that share the underlying infrastructure. This copying approach allows rapid deployment of isolated environments with minimal resource duplication, balancing security isolation with resource efficiency.
Data Source
AI summary
A host operating system running on a computing device monitors network communications for the computing device to identify network resources that are requested by the computing device. The host operating system compares requested network resources against security policies to determine if the requested network resources are trusted. When an untrusted network resource is identified, the host operating system accesses the untrusted network resource within a container that is isolated from the host operating system kernel using techniques discussed herein. By restricting access to untrusted network resources to isolated containers, the host operating system is protected from even kernel-level attacks or infections that may result from an untrusted network resource.