Role-Based Data Isolation in Computing Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data security measures in computing systems are inadequate in isolating and protecting data from malicious attacks across different applications and instances, leading to data exfiltration and loss risks, especially when multiple users share devices or engage in various activities with the same application.
Innovation Solution
Implementing a role-based access system where each application instance is assigned a specific role with dedicated memory, allowing only authorized access and automatic switching to a new role upon detecting a data security threat, with data backup to secondary storage to prevent loss.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If data is stored in shared memory locations across multiple applications, then system resource utilization is improved, but data security and isolation between applications deteriorates
Solution Approach 1:
The patent segments data storage by creating separate sandboxed environments for each application instance. Each sandbox has its own isolated memory space, preventing other applications from accessing stored data. This segmentation maintains security while allowing multiple applications to run concurrently by utilizing system resources through controlled isolation rather than shared access.
2Device complexity
If traditional data storage methods are used without role-based isolation, then system complexity is reduced, but vulnerability to malicious attacks increases
Solution Approach 1:
The patent introduces a role-based access control intermediary layer between applications and their data storage. This intermediary manages authentication, authorization, and session control, mediating all access requests to data. The intermediary adds security functionality without fundamentally changing the underlying storage mechanism, thus protecting against attacks while maintaining reasonable system complexity.
3Ease of operation
If data is accessible across multiple application instances, then user convenience is improved, but data exfiltration risk increases
Solution Approach 1:
The patent implements local quality by providing each application instance with its own dedicated role and isolated data storage space. Data is locally accessible within the authorized role context, maintaining user convenience for legitimate operations. Simultaneously, the local isolation prevents data exfiltration to other applications, as each sandboxed instance can only access its own designated data space.
4Reliability
If role-based access control is implemented, then data isolation and security are improved, but system complexity and overhead increase
Solution Approach 1:
The patent implements a universal role-based access control framework that serves multiple functions: authentication, authorization, session management, and data isolation. This multi-functional approach achieves comprehensive data protection and isolation while avoiding the need for separate mechanisms for each function, thereby limiting the increase in system complexity despite the enhanced security capabilities.
Data Source
AI summary
The present subject matter relates to securing data on a computing system. In an example, a request to execute an application instance of the application is received. After receiving the request a role to be associated with the application instance may be identified based on one of user inputs, an object-role mapping, and a set of rules. Further, the application is executable in a plurality of application instances and the role of the application instance is indicative of a nature of activity to be performed in the application instance. The identified role is then associated with the application instance. Based on the role, data pertaining to the application instance may be stored in a memory location allocated to the role of the application instance. Further, each role has a dedicated memory location.