Process-Based Virtualization for Secure Application Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Container-based systems relying on operating systems are vulnerable to security threats due to their dependence on the OS, exposing them to potential security vulnerabilities despite isolation through software concepts like namespaces and control groups.
Innovation Solution
A process-based virtualization system that utilizes a firmware to execute secure applications independently of the OS, isolating them from non-secure applications by using separate memory components and operating modes, with the firmware controlling the execution and encryption of secure applications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If container-based virtualization using operating system concepts (namespaces and control groups) is used to isolate applications, then application isolation is achieved, but security vulnerability increases due to dependence on the operating system
Solution Approach 1:
The patent introduces a firmware layer (trusted execution environment) as an intermediary between the operating system and secure applications. This firmware acts as a mediator that provides true isolation for security-critical applications, eliminating their dependence on the potentially vulnerable operating system while maintaining the ability to run both secure and non-secure applications on the same hardware platform.
Solution Approach 2:
The patent segments the system into distinct execution environments: a first mode for non-secure applications running under the operating system, and a second mode for secure applications running under firmware control. This segmentation creates hard boundaries that prevent security vulnerabilities in the operating system from affecting secure applications, while maintaining system-wide functionality.
2Reliability
If separate execution environments are created for secure applications using firmware and separate memory components, then security is enhanced, but device complexity increases
Solution Approach 1:
The patent makes the data processing unit universal by enabling it to operate in multiple modes (first mode for non-secure applications, second mode for secure applications) without requiring separate hardware for each environment. The same data processing unit dynamically switches between execution contexts, reducing hardware complexity while maintaining security boundaries through firmware-controlled mode switching and memory access restrictions.
Data Source
AI summary
The present disclosure relates to a process-based virtualization system comprising a data processing unit. The system comprises a computer readable storage media, wherein a first memory component of the computer readable storage media is configured for access by an OS, secure and non-secure applications and the firmware, and wherein a second memory component of the computer readable storage media is configured for access by the firmware and not by the OS and the non-secure application. The data processing unit is configured to operate in a first mode of operation that executes a non-secure application process using the OS, and to operate in a second mode of operation that executes the secure application using the firmware, thereby executing application code using the second memory component.