Per-App VPN Tunnel via Proxy Interception for Isolated Processes

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing VPN technologies fail to provide selective access between applications on mobile devices, leading to potential data loss and malware risks due to the inability to hook functions in isolated processes, as seen in newer Android versions like ANDROID Nougat, which run networking functions in separate isolated processes.

Innovation Solution

Implementing a per-app VPN tunnel by starting a proxy server within the application process to intercept and reroute network requests from isolated processes, using runtime function hooking and a tunnel server to ensure secure communication with enterprise resources, even when networking functions are isolated.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If networking functions are run in isolated processes for security and performance, then system security and performance are improved, but the ability to hook functions for per-app VPN is lost

Engineering Contradiction:

Improvesystem securityVSAvoidper-app VPN capability

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The patent introduces a proxy server as an intermediary component that runs within the application process and intercepts network requests before they reach the isolated networking functions. This mediator enables the application to monitor and control network traffic without requiring direct access to the isolated process, thus preserving per-app VPN capabilities while maintaining the security benefits of process isolation.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Ease of operation

If common device-level VPN technologies are used for widespread access, then access to enterprise data is improved, but security control between different applications is lost

Engineering Contradiction:

Improveaccess to enterprise dataVSAvoiddata loss and malware risk

Core Design Contradiction:

Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The patent segments the VPN connection at the application level rather than device level. Each application process establishes its own VPN tunnel through the proxy server, allowing selective control of network traffic on a per-app basis. This segmentation enables granular security policies where different applications can have different VPN configurations, preventing malware from compromising the entire device while maintaining easy access for legitimate applications.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent implements local quality by allowing different security characteristics for different applications. The proxy server enables each application to have customized VPN parameters, authentication methods, and network routing rules tailored to its specific security requirements and data sensitivity, rather than applying a uniform VPN configuration across all applications.

Inventive Principle:

Principle #3Local quality

Data Source

PatentUS11356295B2Per-app virtual private network tunnel for multiple processes

Publication Date: 2022.06.07 OMNISSA LLC

AI summary

Examples described herein include systems and methods for creating a per-app virtual private network (“VPN”) using hooking, even though an isolated process is used for networking functions. The isolated process can include networking functions of the WebView class for ANDROID. The application can start an HTTP proxy server to receive local HTTP requests. Then, the application can trigger a broadcast to the isolated process, causing the isolated process to route its HTTP requests to the HTTP proxy of the application. The application can then hook HTTP requests and send them to a virtual private network (“VPN”) tunnel server. This can allow an application to securely connect to enterprise files or data even though the networking functions occur in the isolated process.