Mobile App Adaptation for Partitioned Secure Zones
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Mobile devices lack the ability to create separate security zones for different data sets accessible by different applications, especially in corporate environments, leading to inadequate data protection and potential data leakage.
Innovation Solution
A method to adapt mobile applications to a partitioned environment by modifying or replacing them to exhibit secure behaviors such as encrypted data storage, secure network communications, and restricted access, without requiring a virtual instance of the mobile operating system, using a compliance server to generate modified apps that adhere to security policies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a virtual machine application is used to create separate secure zones, then data security is improved, but device complexity and performance overhead increase
Solution Approach 1:
The patent introduces a secure zone manager as an intermediary component that mediates between applications and the file system. This manager enforces security policies, controls file access, and manages encrypted storage without requiring full virtualization. The secure zone manager acts as a lightweight intermediary that provides security functionality while avoiding the complexity of virtual machine implementations.
Solution Approach 2:
The patent creates a simplified copy of the virtualization concept by implementing secure zones as logical partitions within the existing file system rather than creating full virtual machine instances. Each secure zone is a copied abstraction of a traditional file system hierarchy, but implemented with additional security layers and access control mechanisms, avoiding the overhead of complete OS virtualization.
2Reliability
If application modification is performed to enforce security policies, then data protection is improved, but ease of operation deteriorates
Solution Approach 1:
The patent performs preliminary security assessments and modifications during the application installation process rather than requiring post-installation changes. The secure zone manager evaluates applications against security policies before installation, automatically modifies necessary components, and configures access controls in advance. This preliminary action ensures data protection is built-in without requiring users to perform complex operations later.
Solution Approach 2:
The patent implements self-service mechanisms where the secure zone manager automatically modifies applications and configures security settings without requiring user intervention. The system autonomously performs code analysis, applies security transformations, and manages zone configurations, reducing the operational burden on users while maintaining strong data protection.
3Reliability
If encrypted data storage is implemented, then data security is improved, but processing speed decreases
Solution Approach 1:
The patent applies encryption selectively to specific data regions and files within secure zones rather than encrypting all data uniformly. The secure zone manager identifies sensitive data based on security policies and applies encryption only to those specific locations, leaving non-sensitive data in plaintext for faster access. This local quality approach maintains security for critical data while preserving processing speed for general operations.
Solution Approach 2:
The patent dynamically changes encryption parameters such as encryption algorithms, key lengths, and modes based on the sensitivity and access patterns of data. For frequently accessed data, the system may use faster encryption algorithms or pre-computed keys, while for highly sensitive data, stronger encryption is applied. This parameter adaptation balances security requirements with performance constraints.
Data Source
AI summary
Adapting a mobile or other application (“app”) to a partitioned environment is disclosed. In various embodiments, a “secure zone” or other logical partition is created and enforced at least in part by adapting a mobile or other app to behave in a manner required by and/or otherwise associated with the secure zone or other partition and which behavior is or in various embodiments may be different than a native behavior of the mobile or other app as designed and written by an application developer of the app.