Secure Browser Execution via Virtual Machine Isolation

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Internet browsers pose a risk of malicious processes and software execution on end-user devices, despite sandboxing and security measures, due to vulnerabilities that allow malicious content to access the computing system.

Innovation Solution

A secure browsing service is implemented, where internet browser instances execute on virtual machines separate from the local device, providing a remote connection to the end-user device, with file storage mapping and rule-based download management to ensure secure browsing.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If internet browser executes on end user device with sandboxing, then browsing functionality is provided, but security vulnerabilities allow malicious content to access the computing system

Engineering Contradiction:
Improvebrowser securityVSAvoidmalicious content access
Core Design Contradiction:
ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The system segments the browsing environment by creating a virtual machine instance that is isolated from the host computing system. The browser executes within this segmented virtual environment, allowing security policies to be applied independently without affecting the host system. This resolves the contradiction by providing browsing functionality while preventing malicious content from accessing the main computing system through the sandboxing mechanism.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The virtual machine acts as an intermediary layer between the internet browser and the end user computing system. It mediates all interactions, allowing the browser to execute and access online resources while the VM's security policies and isolation mechanisms prevent direct access to the host system. This intermediary approach enables browsing functionality while blocking harmful factors from reaching the computing system.

Inventive Principle:
Principle #24Intermediary (Mediator)

2Reliability

If browser is sandboxed and monitored, then security is improved, but vulnerabilities still exist that allow malicious content access

Engineering Contradiction:
Improvesecurity protectionVSAvoidmalicious content penetration
Core Design Contradiction:
ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The system implements nested security by placing the internet browser within a virtual machine instance, which itself is nested within the host computing system. This nested structure creates multiple layers of security boundaries, where the VM provides an additional containment layer beyond traditional browser sandboxing. This resolves the contradiction by ensuring that even if browser-level sandboxing is penetrated, the malicious content remains confined within the nested VM environment and cannot access the host system.

Inventive Principle:
Principle #7Nested doll (Nesting)

Solution Approach 2:

The virtual machine instance is configured with pre-established security policies, isolation mechanisms, and monitoring capabilities before the browser executes. This beforehand cushioning prepares the environment to prevent malicious content penetration in advance. Security boundaries and protection mechanisms are in place prior to any browsing activity, ensuring that vulnerabilities in the browser cannot directly compromise the host system.

Inventive Principle:
Principle #11Beforehand cushioning (Prior cushioning)

3Reliability

If virtual machine with remote connection is allocated, then security vulnerabilities are limited to remote machine, but system complexity increases

Engineering Contradiction:
Improvesecurity isolationVSAvoidvirtual machine allocation
Core Design Contradiction:
ReliabilityVSDevice complexity

Solution Approach 1:

The system extracts the browsing functionality from the end user device by allocating it to a separate virtual machine instance. This extraction removes the security risks associated with browser execution from the host system, limiting vulnerabilities to the isolated VM environment. The remote connection capability allows users to access the browser on the VM as if it were local, maintaining usability while achieving security isolation despite the added complexity of VM management.

Inventive Principle:
Principle #2Taking out (Extraction)

Data Source

PatentUS10333975B2Enhanced computing system security using a secure browser
Publication Date: 2019.06.25 OMNISSA LLC
  • US10333975B2 patent drawing
  • US10333975B2 patent drawing
  • US10333975B2 patent drawing

AI summary

Described herein are systems, methods, and software to provide secure browsers to end user devices. In one implementation, a secure browsing service receives, over a network, a request for an internet browser from an end user device. The secure browsing service further, in response to the request, allocates a virtual machine with an instance of the internet browser executing thereon to the end user device, and provide a remote connection to the internet browser on the virtual machine to the end user device.