PerAppContainer Android Sandbox Isolation via SEAMS and MAC
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for sandboxing Android applications on mobile devices fail to provide adequate isolation between applications within and outside the sandbox, and do not support dynamic grouping of applications at runtime, leading to security vulnerabilities and performance issues with virtual machines.
Innovation Solution
The implementation of a lightweight container solution, known as PerAppContainer, which allows for the dynamic grouping and isolation of Android applications at runtime using the SEAndroid Manager Service (SEAMS) and Mandatory Access Control (MAC) mechanisms, ensuring that applications within the container cannot be accessed by those outside it, and resources are shared only among included applications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If virtual machines are used to sandbox Android applications, then isolation between applications is improved, but device complexity and performance overhead increase
Solution Approach 1:
The patent uses Linux cgroups, which are lightweight kernel-level resource management tools, instead of heavy virtual machine infrastructure. Cgroups provide application sandboxing through manageable resource control groups that can be created and destroyed efficiently, reducing both complexity and performance overhead while maintaining isolation.
Solution Approach 2:
The patent replaces the virtual machine mechanical system with a policy-based control system using SEAndroid Manager Service and Mandatory Access Control mechanisms. This substitution uses software policy enforcement rather than hardware-level virtualization, reducing device complexity while achieving the same isolation goals.
2Reliability
If virtual machines are used to sandbox Android applications, then isolation between applications is improved, but performance deteriorates
Solution Approach 1:
The patent uses Linux cgroups, which are lightweight kernel-level resource management tools, instead of heavy virtual machine infrastructure. Cgroups provide application sandboxing through manageable resource control groups that can be created and destroyed efficiently, reducing both complexity and performance overhead while maintaining isolation.
3Loss of time
If sandbox configuration is done in advance, then setup time is reduced, but adaptability to runtime changes is worsened
Solution Approach 1:
The patent implements dynamic sandbox configuration through the SEAndroid Manager Service, which allows applications to be added to or removed from sandboxes at runtime based on policy files. This dynamic approach enables the system to adapt to changing requirements while maintaining pre-configured base policies for quick setup.
Solution Approach 2:
The patent uses pre-configured policy files that define sandbox parameters and application categories in advance. These policy files are processed at runtime by the SEAndroid Manager Service, combining the benefits of pre-prepared configurations with the flexibility of runtime adjustments.
4Ease of operation
If existing sandbox methods are used, then application grouping is simplified, but isolation effectiveness is worsened
Solution Approach 1:
The patent replaces the virtual machine mechanical system with a policy-based control system using SEAndroid Manager Service and Mandatory Access Control mechanisms. This substitution uses software policy enforcement rather than hardware-level virtualization, reducing device complexity while achieving the same isolation goals.
Data Source
AI summary
An apparatus and method for generating an application container are provided. The method includes selecting a target application from among a plurality of applications included in an electronic device, acquiring a policy file corresponding to the target application, determining whether the policy file includes a category of the target application, and executing the application container which includes the target application.