Risk-Based Remote Browser Isolation With Threat-Segmented Pools
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing remote browser isolation (RBI) systems face challenges in effectively isolating web content based on varying threat levels and user identities, leading to potential malware execution and compromised security.
Innovation Solution
A computer-implemented method for orchestration of RBI requests, which assigns requests to container pools based on threat levels and user identifiers, generating non-executable representations of network content to enhance security and efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all RBI requests are handled by a single container pool, then resource utilization is simplified, but security is compromised due to potential malware access to previously stored information from different web pages
Solution Approach 1:
The system segments the container pool into multiple isolated pools based on threat levels. High-threat requests are directed to dedicated high-threat container pools, while low-threat requests use separate low-threat pools. This segmentation prevents malware in high-threat containers from accessing information from other containers, resolving the security vulnerability while maintaining manageable complexity through structured organization.
2Reliability
If multiple container pools are used to isolate different threat levels, then security is improved by preventing malware spread, but system complexity and request routing overhead increase
Solution Approach 1:
The system performs preliminary threat level assessment and container pool assignment when the RBI request first arrives. By pre-determining the appropriate container pool based on the requested URL's threat level before the request enters the container system, the routing overhead is minimized. This preliminary action ensures security isolation is maintained without adding significant complexity to the request handling process.
3Productivity
If containers are reused across different users, then resource efficiency is improved, but security is compromised as user-specific information may be accessed by other users
Solution Approach 1:
The system applies local quality by making containers user-specific within each threat level pool. Each user has dedicated containers that store only their user-specific information such as cookies and cache data. This ensures that even when containers are reused, they maintain user-specific security boundaries. The local quality approach allows resource efficiency through controlled reuse while preventing unauthorized access to other users' information.
4Productivity
If high-threat content is processed with the same resources as low-threat content, then resource utilization is maximized, but the system becomes vulnerable to malware attacks affecting overall performance
Solution Approach 1:
The system segments resources into separate container pools for high-threat and low-threat content processing. High-threat requests are isolated in dedicated pools with their own containers, preventing malware from impacting the performance of low-threat processing. This segmentation maintains high resource utilization within each pool while protecting the overall system from malware-induced performance degradation.
Data Source
AI summary
The present disclosure relates to a computer-implemented method for orchestration of remote browser isolation requests at a server. The method comprises receiving a first remote browser isolation (RBI) request associated with a first request to access a first network content at a first user device. A threat level associated with the first RBI request is determined and a container pool is assigned to the first RBI request based on the determined threat level. Using a first RBI container within the assigned container pool, a non-executable representation of the first network content is generated and returned for access at the first user device.