Host-Based Isolation Firewall for Data Exfiltration Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing solutions for preventing malware from exfiltrating data from computer systems are often costly and difficult to maintain, and they still fail to effectively block malware from reaching and transmitting sensitive information to untrusted networks.
Innovation Solution
A host computer system is configured with a processor to implement an isolated computing environment and internal isolation firewall, which segregates operations into sandboxed memory spaces, using a host-based firewall, border firewall, and proxy device to prevent unauthorized data communication, classifying network destinations as trusted or untrusted based on whitelists and blacklists.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If hardware-based firewalls and elaborate defensive protections are implemented, then data security is improved, but system complexity and maintenance difficulty increase
Solution Approach 1:
The patent introduces a sandbox environment as an intermediary layer between the untrusted network and the protected network. This sandbox acts as a mediator that isolates malicious activities, allowing the system to maintain security without requiring complex hardware firewalls and defensive protections throughout the entire system.
Solution Approach 2:
The network environment is segmented into distinct zones: an untrusted network, a sandbox environment with isolated computing devices, and a protected network. This segmentation allows security measures to be concentrated where needed while simplifying the overall system architecture.
2Reliability
If sandboxed computing environment with internal isolation firewall is implemented, then malware containment is improved, but device complexity increases
Solution Approach 1:
The patent implements a nested structure where isolated computing devices are contained within a sandbox environment, which itself is contained within the host computer system. Each nested layer provides additional isolation and containment, with the internal isolation firewall enforcing boundaries between layers. This nesting approach improves malware containment while keeping individual components relatively simple.
3Reliability
If host-based firewall with strict blocking rules is implemented, then data exfiltration prevention is improved, but network accessibility deteriorates
Solution Approach 1:
The patent applies different network access policies to different locations or zones. The sandbox environment has strict blocking rules preventing data exfiltration, while the protected network maintains normal accessibility. This local differentiation allows the system to prevent data exfiltration where needed without compromising overall network accessibility.
Data Source
AI summary
A host computer system may be configured to connect to a network. The host computer system may be configured to implement a workspace and an isolated computing environment. The host computer system may be configured to isolate the isolated computing environment from the workspace using an internal isolation firewall. The internal isolation firewall may be configured to prevent data from being communicated between the isolated computing environment and the workspace, for example, without an explicit user input. When malware is received by the isolated computing environment, the internal isolation firewall may be configured to prevent the malware from accessing data on the workspace of the host computer system. The host computer system may be configured to implement one or more mechanisms that prevent malware received by the host computer system from exfiltrating, to a network destination, data from the host computer system and data from other devices on the network.