Sandboxing via OS Component Extraction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing sandboxing solutions using virtual machines are resource-intensive due to the overhead of emulating low-level hardware interfaces and maintaining a complete operating system, making them impractical for most applications except the largest ones, as they consume excessive computer resources and memory.
Innovation Solution
The architecture refactors core operating system components to run within the application process, utilizing existing host operating system services like virtual memory and threads, and introduces a remote user I/O server to isolate and provide necessary abstractions, reducing overhead by separating basic computation services from rich application APIs and moving rich APIs into the application isolation environment.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If virtual machines are used to isolate applications, then security isolation is achieved, but computer resource overhead becomes too high
Solution Approach 1:
The patent segments the operating system functionality by separating the Win32 subsystem and relevant system registry portions into a distinct sandboxed environment. This allows only the necessary components for application isolation to be copied into the sandbox, rather than emulating an entire virtual machine with complete OS functionality. The segmentation enables security isolation while reducing resource overhead by including only essential subsystems.
Solution Approach 2:
The patent extracts the Win32 subsystem and system registry from the host operating system and places them into the sandboxed application environment. By taking out only these specific components needed for application execution and isolation, rather than copying the entire OS, the solution achieves security boundaries while minimizing the resource overhead associated with maintaining a complete virtual machine.
2Reliability
If a complete operating system is included in the virtual machine, then application isolation is achieved, but storage resource overhead becomes too high
Solution Approach 1:
The patent segments the operating system into essential components (Win32 subsystem, system registry) that are copied into the sandbox, separating them from the full OS remaining on the host. This segmentation allows application isolation to be achieved with only the necessary subsystems, dramatically reducing storage overhead compared to including a complete operating system in the virtual machine.
3Adaptability or versatility
If virtual machines emulate low-level hardware interfaces, then hardware abstraction is provided, but memory overhead increases significantly
Solution Approach 1:
The patent extracts only the necessary hardware abstraction components (Win32 subsystem) from the full operating system and places them in the sandboxed environment. By taking out only these essential abstraction layers needed for application execution rather than emulating complete hardware interfaces, the solution maintains adaptability while significantly reducing memory overhead.
Solution Approach 2:
The sandboxed Win32 subsystem acts as an intermediary layer between the application and the host operating system. This intermediary provides the necessary hardware abstraction and system services that applications expect, while allowing the full power of the host OS to remain outside the sandbox, thus maintaining versatility without the memory overhead of complete VM emulation.
Data Source
AI summary
The disclosed architecture facilitates the sandboxing of applications by taking core operating system components that normally run in the operating system kernel or otherwise outside the application process and on which a sandboxed application depends on to run, and converting these core operating components to run within the application process. The architecture takes the abstractions already provided by the host operating system and converts these abstractions for use by the sandbox environment. More specifically, new operating system APIs (application program interfaces) are created that include only the basic computation services, thus, separating the basic services from rich application APIs. The code providing the rich application APIs is copied out of the operating system and into the application environment—the application process.