Sandboxed Application Wrapping for BYOD Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The increasing 'Bring-Your-Own-Device' (BYOD) environment in wireless networks poses challenges for enterprise security, as there is a lack of control over application software execution and usage, leading to potential malware threats and inappropriate content access.
Innovation Solution
A system and method for managing a sandboxed workspace with policy enforcement, where applications are 'wrapped' through binary instrumentation to enforce security policies, allowing controlled access and usage, and enabling automatic provisioning and de-provisioning of applications based on predefined policies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If wireless networks support Bring-Your-Own-Device environments with multiple personal devices, then device accessibility and user convenience are improved, but network security control and application usage management deteriorate
Solution Approach 1:
The system segments the network environment into a corporate-managed workspace and personal device environment. The workspace is further segmented into sandboxed applications that are isolated from each other and from the personal device's file system. This segmentation allows personal devices to access the network while maintaining security boundaries that prevent unauthorized access to corporate resources.
Solution Approach 2:
The patent introduces a workspace application and sandboxed application layer as an intermediary between the personal device and corporate network resources. This intermediary enforces security policies, controls application execution, and manages data access without requiring direct access to the personal device's operating system or file system, thus maintaining both accessibility and security.
2Productivity
If application software is allowed to execute freely on personal devices, then user productivity and application functionality are improved, but malware threats and inappropriate content access increase
Solution Approach 1:
The system segments applications into sandboxed applications that run within isolated environments. Each sandboxed application is confined to its own workspace with restricted access to the device's file system, other applications, and network resources. This segmentation enables applications to execute with full functionality while preventing malware from affecting the host device or other applications.
Solution Approach 2:
The system applies preliminary security measures by wrapping applications with policy enforcement code before they execute. Security policies are pre-configured to block malicious activities, control data access, and prevent inappropriate content. This preliminary anti-action occurs before any harmful behavior can manifest, allowing productive application execution while preemptively blocking threats.
3Reliability
If manual device registration and authentication processes are implemented, then network access control is improved, but IT labor intensity and registration complexity increase
Solution Approach 1:
The system enables self-service registration where personal devices automatically authenticate to the corporate network through the workspace application. Users simply install the workspace application and sign in with their corporate credentials, after which the system automatically provisions the appropriate sandboxed applications and security policies. This eliminates manual IT registration processes while maintaining secure access control.
Solution Approach 2:
The workspace application serves multiple functions: it acts as an authentication gateway, application launcher, security policy enforcer, and device registration system. This multi-functional approach consolidates what would otherwise require separate manual processes into a single automated system, reducing complexity while maintaining control.
4Reliability
If security policies are enforced through binary instrumentation and application wrapping, then application usage control and security compliance are improved, but system complexity and implementation difficulty increase
Solution Approach 1:
The security enforcement mechanism is segmented into modular components: policy definition, policy compilation, application wrapping, and runtime enforcement. Each component is independently developed and tested, reducing implementation complexity. The wrapping process adds policy enforcement code to applications in a systematic way that maintains the original application functionality while adding security controls.
Solution Approach 2:
The patent introduces a policy enforcer intermediary that sits between the sandboxed application and the device's operating system. This intermediary handles all security policy checks, file system access controls, and inter-application communication restrictions. By centralizing security enforcement in this intermediary layer, the system achieves comprehensive security compliance without requiring complex modifications to each individual application or the host operating system.
Data Source
AI summary
A method includes a particular user application, without operating system kernel access, performing the operations of: identifying a set of applications that a user has permission to access, receiving a request to a access a particular application of the set of applications, and causing execution of the particular application.