Object Ownership Transfer Between Isolated Execution Contexts
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In computing environments with isolated execution contexts, passing objects between applications is limited, especially for arrays, due to security restrictions, resulting in performance issues and restricted data sharing, particularly in secure platforms like smart cards.
Innovation Solution
Transferring ownership of objects between isolated execution contexts by changing their associated unique identifiers, allowing secure and high-performance sharing of objects between applications, including arrays, through the use of shareable interface objects and firewall-managed ownership transfers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If objects are passed as parameters between isolated execution contexts via SIO, then data sharing between applications is enabled, but performance deteriorates due to repeated firewall invocations and method calls
Solution Approach 1:
The patent segments the object access process into two distinct phases: (1) a one-time firewall rule registration phase where the SIO declares which objects it needs access to, and (2) a high-performance access phase where objects are retrieved without repeated firewall invocations. This segmentation allows the system to balance security (through initial firewall control) with performance (through subsequent direct access).
Solution Approach 2:
The firewall rule registration is performed in advance before the actual object access operations. By pre-registering the SIO's object access requirements with the firewall, the system eliminates the need for repeated firewall checks during runtime, thereby improving performance while maintaining security oversight.
2Reliability
If firewall rules are enforced to protect objects from unauthorized access between isolated execution contexts, then security is improved, but ease of operation deteriorates due to restricted object passing
Solution Approach 1:
The SIO acts as an intermediary between the isolated execution contexts. It registers its object access requirements with the firewall and retrieves objects on behalf of the target application. This intermediary approach maintains firewall-enforced security while simplifying the operation for developers, as they can pass objects through the SIO without manually managing complex firewall rules.
Solution Approach 2:
The SIO serves multiple functions: it acts as a firewall rule registration interface, an object retrieval mechanism, and a data transfer bridge between isolated contexts. This multi-functionality consolidates what would otherwise require separate security management and object passing mechanisms into a single unified interface.
3Adaptability or versatility
If arrays are accessed element-by-element through wrapper SIO methods, then data sharing is enabled, but performance deteriorates due to repeated method invocations and firewall checks
Solution Approach 1:
The patent implements a copying mechanism where the array data is retrieved once through the SIO and then copied to a local buffer or cache in the target application's execution context. Subsequent accesses operate on this local copy, eliminating repeated firewall invocations and method calls while maintaining data integrity through the initial secure transfer.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
An approach for making an object owned by a first application that executes in a first isolated execution context accessible to a second application that executes in a second isolated execution context is described herein. According to this approach the object is associated with the first isolated execution context. A request is received to render the object accessible to the second application. Ownership of the object is transferred to the second application by changing the isolated execution context that is associated with the object to the second isolated execution context, thereby rendering the object accessible to the second application.