SE Proxy Deployment Across Secure Containers for Tenant Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing secure element platform runtime environments struggle to efficiently deploy and manage multiple instances of applets in a multi-tenant environment while maintaining logical isolation and security between tenants.
Innovation Solution
The system deploys instances of SE application objects to separate secure containers using SE proxy applications, which extend or redirect from the executable components, ensuring each instance is isolated and secure, and manages their lifecycle operations including termination and memory release.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multiple instances of SE application objects are deployed to separate secure containers, then security isolation between tenants is improved, but device complexity increases
Solution Approach 1:
The system segments the SE platform runtime environment into multiple secure containers, with each container hosting isolated instances of SE application objects for different tenants. This segmentation enables security isolation while managing complexity through structured organization of application instances across separate execution environments.
Solution Approach 2:
The patent introduces intermediary components including the SE proxy application and installation module that mediate between the deployment request and the secure containers. These intermediaries simplify the deployment process by handling the complexity of instance creation, configuration, and isolation automatically, reducing the burden on users while maintaining security.
2Ease of manufacture
If SE application objects are deployed via SE proxy applications, then ease of deployment is improved, but device complexity increases
Solution Approach 1:
The SE proxy application serves multiple functions: it acts as a deployment intermediary, extends the executable component functionality, and facilitates instance creation in secure containers. This multi-functionality simplifies deployment operations while consolidating system structure, as the proxy handles diverse deployment tasks through a single unified component rather than requiring separate mechanisms for each function.
3Reliability
If multiple tenants execute applets in separate partitions, then security isolation is improved, but productivity decreases
Solution Approach 1:
The system dynamically manages secure containers and SE application object instances, allowing flexible creation, termination, and resource allocation based on tenant needs. This dynamic approach enables efficient deployment and management of multiple isolated instances without static overhead, improving productivity while maintaining security isolation through runtime container management.
Solution Approach 2:
The patent utilizes parameter changes in the deployment process, where the installation module and SE proxy application adjust configuration parameters to automatically provision secure containers and deploy application instances. By changing deployment parameters dynamically rather than requiring manual configuration, the system maintains strong tenant isolation while significantly improving deployment efficiency and reducing manual intervention requirements.
Data Source
AI summary
A system deploys an instance of a secure element (SE) application object to each of a plurality of secure containers of an SE platform runtime environment. The system generates an SE proxy application that includes an extension component that redirects to an executable component of an SE application installation file. The system additionally generates a secure container in the SE platform runtime environment. The secure container includes a partition that logically isolates the secure container from other secure containers of the SE platform runtime environment. The system deploys an SE application object to the secure container based on the extension component of the SE proxy application. Upon having deployed the SE application object to the secure container, the system executes the SE application object within the secure container.