Secure Browser Execution via Virtual Machine Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Internet browsers pose a risk of malicious processes and software execution on end-user devices, despite sandboxing and security measures, due to vulnerabilities that allow malicious content to access the computing system.
Innovation Solution
A secure browsing service is implemented, where internet browser instances execute on virtual machines separate from the local device, providing a remote connection to the end-user device, with file storage mapping and rule-based download management to ensure secure browsing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If internet browser executes on end user device with sandboxing, then browsing functionality is provided, but security vulnerabilities allow malicious content to access the computing system
Solution Approach 1:
The system segments the browsing environment by creating a virtual machine instance that is isolated from the host computing system. The browser executes within this segmented virtual environment, allowing security policies to be applied independently without affecting the host system. This resolves the contradiction by providing browsing functionality while preventing malicious content from accessing the main computing system through the sandboxing mechanism.
Solution Approach 2:
The virtual machine acts as an intermediary layer between the internet browser and the end user computing system. It mediates all interactions, allowing the browser to execute and access online resources while the VM's security policies and isolation mechanisms prevent direct access to the host system. This intermediary approach enables browsing functionality while blocking harmful factors from reaching the computing system.
2Reliability
If browser is sandboxed and monitored, then security is improved, but vulnerabilities still exist that allow malicious content access
Solution Approach 1:
The system implements nested security by placing the internet browser within a virtual machine instance, which itself is nested within the host computing system. This nested structure creates multiple layers of security boundaries, where the VM provides an additional containment layer beyond traditional browser sandboxing. This resolves the contradiction by ensuring that even if browser-level sandboxing is penetrated, the malicious content remains confined within the nested VM environment and cannot access the host system.
Solution Approach 2:
The virtual machine instance is configured with pre-established security policies, isolation mechanisms, and monitoring capabilities before the browser executes. This beforehand cushioning prepares the environment to prevent malicious content penetration in advance. Security boundaries and protection mechanisms are in place prior to any browsing activity, ensuring that vulnerabilities in the browser cannot directly compromise the host system.
3Reliability
If virtual machine with remote connection is allocated, then security vulnerabilities are limited to remote machine, but system complexity increases
Solution Approach 1:
The system extracts the browsing functionality from the end user device by allocating it to a separate virtual machine instance. This extraction removes the security risks associated with browser execution from the host system, limiting vulnerabilities to the isolated VM environment. The remote connection capability allows users to access the browser on the VM as if it were local, maintaining usability while achieving security isolation despite the added complexity of VM management.
Data Source
AI summary
Described herein are systems, methods, and software to provide secure browsers to end user devices. In one implementation, a secure browsing service receives, over a network, a request for an internet browser from an end user device. The secure browsing service further, in response to the request, allocates a virtual machine with an instance of the internet browser executing thereon to the end user device, and provide a remote connection to the internet browser on the virtual machine to the end user device.


