External Device Sandbox Isolation for Secure Connection Switching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Electronic devices are vulnerable to infection by malicious programs when connected to external devices with unknown security, which can turn them into zombie hosts for hackers to steal secrets.
Innovation Solution
Implement a sandbox analyzation module to maintain external devices in an isolation status initially, perform security analysis, and switch to a connection status only if the device meets de-isolation conditions, using whitelist or blacklist filtering to enhance security while minimizing performance impact.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If external devices are connected to the electronic device for data reading, storage, or extended functions, then the functionality and convenience of the electronic device is improved, but the security risk increases due to potential malicious programs
Solution Approach 1:
The patent introduces a sandbox environment as an intermediary layer between the external device and the electronic device's file system. This sandbox acts as a mediator that isolates the external device, allowing it to access only permitted files through controlled interfaces while preventing direct access to the entire file system, thus enabling functionality while mitigating security risks
Solution Approach 2:
The patent segments the file system access by creating a sandboxed environment that divides the file system into accessible and inaccessible portions. The sandbox structure separates permitted files (those the external device can access) from the rest of the file system, implementing fine-grained access control through directory structure segmentation and permission-based isolation
2Reliability
If a sandbox analyzation module is implemented to perform security analysis on external devices, then the security of the electronic device is improved, but the device complexity increases
Solution Approach 1:
The sandbox environment provides self-service security analysis by automatically monitoring and analyzing the behavior of external devices within the isolated sandbox. The system autonomously detects malicious activities, analyzes file access patterns, and makes access control decisions without requiring extensive manual intervention or complex external security infrastructure
Solution Approach 2:
The sandbox analyzation module serves as an intermediary that simplifies security implementation by providing a standardized, pre-configured analysis environment. This intermediary layer handles the complexity of security analysis internally, presenting a simple interface to users while managing sophisticated security checks in the background
3Object-affected harmful factors
If external devices are maintained in isolation status for security analysis, then the security risk is reduced, but the working performance of the electronic device may be impacted
Solution Approach 1:
The patent implements dynamic access control within the sandbox, where the isolation level and permitted access rights are adjusted based on the external device's behavior and security assessment. The system dynamically modifies the sandbox constraints, permitting broader access for trusted devices while maintaining strict isolation for suspicious devices, thus optimizing performance based on real-time security needs
Solution Approach 2:
The sandbox implementation applies partial isolation rather than complete isolation, allowing external devices to access specific permitted files and functions while blocking only the necessary malicious activities. This partial action approach maintains sufficient security protection while minimizing the performance impact by allowing legitimate operations to proceed without excessive restriction
Data Source
AI summary
Provided are a device security analyzation method and an electronic device. The method includes the following. In response to an external device being connected to the electronic device, the external device is maintained in an isolation status, and it is determined whether the external device meets a de-isolation condition. If the external device does not meet the de-isolation condition, in a time period of the external device being in the isolation status, a security analyzation is performed on the external device through a sandbox analyzation module. Also, it is determined whether to switch the external device to a connection status according to an execution result of the security analyzation.