Application Remoting via Network Vector Rendering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for securing web browsers, such as pixel pushing and DOM mirroring, face challenges like high bandwidth usage, server cost, latency, and security vulnerabilities due to the interception of malicious code, which are not effectively addressed in providing a secure and efficient user experience across different operating systems and devices.
Innovation Solution
The Adaptive Rendering Application Isolation System (AR AIS) enables web browsers to run in an isolated execution environment, using draw commands instead of pixels for rendering, which reduces bandwidth consumption and eliminates rendering artifacts, and provides a self-contained delivery mechanism for existing applications to be isolation-ready without additional coding, ensuring secure execution and rendering locally.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If pixel pushing protocol is used to remote desktop, then desktop can be secured in a sandbox, but bandwidth consumption increases and rendering artifacts occur
Solution Approach 1:
The patent extracts the rendering process from the remote desktop protocol by implementing a separate rendering service that generates draw commands independently. This separates the security sandboxing function from the pixel transmission function, allowing draw commands to be sent without transmitting full pixel data, thereby reducing bandwidth consumption while maintaining security.
Solution Approach 2:
The patent introduces a rendering service as an intermediary between the remote desktop system and the display. This intermediary converts the rendering output into draw commands that can be executed locally, avoiding the need to transmit large amounts of pixel data over the network while still providing secure remote access.
2Adaptability or versatility
If RDP protocol is used, then desktop can be remoted, but it is specific to desktop operating systems and requires GDI interface which is not available on non-Windows devices
Solution Approach 1:
The patent implements a universal rendering interface that works across different operating systems by using draw commands instead of OS-specific graphics interfaces like GDI. The rendering service can be implemented on any platform and generates platform-independent draw commands that can be executed on the client device regardless of the underlying operating system.
3Reliability
If sandboxing is implemented on client computing system, then application can be isolated, but should an attack escape the sandbox, it can attack the entire client computing system
Solution Approach 1:
The patent extracts the rendering process from the client computing system and moves it to a remote rendering service. This extraction ensures that even if the client system is compromised, the actual rendering and potential attack vectors remain isolated on the remote server, limiting the scope of any potential attacks.
4Productivity
If pixel pushing is used to send rendering output, then remote desktop can be displayed, but high bandwidth usage increases server costs
Solution Approach 1:
The patent changes the parameter of rendering output from pixel data to draw commands. This parameter change significantly reduces the amount of data that needs to be transmitted and processed, thereby reducing bandwidth usage and server costs while maintaining rendering efficiency and quality.
Data Source
AI summary
Methods, systems, and techniques for application isolation by remote-enabling applications are provided. Example embodiments provide an Adaptive Rendering Application Isolation System (“ARAIS”), which transparently and dynamically enables applications to run in an isolated execution environment yet be rendered locally in a manner that minimizes the amount of data to be transferred and the latency caused by expensive computation and/or by overburdening available bandwidth by remoting rendering using draw commands over rendering using pixel pushing or other techniques. In one embodiment, the ARAIS includes an orchestrator server which comprises remoting level determination logic and rules engine, pre-computed graphics libraries, connection support logic, data repositories for objects such as a render cache, whitelists, blacklists, client privileges, and application information, and one or more secure containers running remote application instances. These components cooperate to deliver isolation-ready technology to client applications.