Secure Container Isolation for Guest User Applications
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current endpoint security solutions are inadequate for environments with temporary user access, as they fail to prevent persistent threats and require administrative support, leading to managerial burdens and legal risks due to exposure of private information.
Innovation Solution
A method and system that automatically contains all applications run by users within a secure container, isolating them from the host system and allowing for reset at the end of each session, eliminating persistent threats and administrative burdens.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If regular endpoint protection solutions are installed to detect and prevent attacks, then security detection capability is improved, but the solutions are not fine-tuned for hostile environments where users have high access options and file transfer capabilities
Solution Approach 1:
The system segments the endpoint environment into two distinct zones: a restricted guest zone with controlled access and a protected host zone. Guest users are provided with a virtualized or containerized environment that isolates their activities from the underlying system, allowing high access options and file transfer capabilities within the guest zone without compromising the host system's security.
Solution Approach 2:
An intermediary security layer is introduced between the guest user environment and the host system. This intermediary manages file transfers, application executions, and system access requests, filtering and controlling interactions to prevent malicious activities from reaching the host while maintaining useful functionality for legitimate user needs.
2Reliability
If endpoint protection solutions are deployed without session persistence, then security against persistent threats is improved, but user changes are lost between sessions causing operational inefficiency
Solution Approach 1:
The system separates persistent storage into two distinct segments: volatile guest environment storage that is cleared at session end to prevent persistent threats, and persistent host system storage that maintains security configurations and approved applications. This segmentation allows the guest zone to be reset while preserving necessary system state in the host zone.
Solution Approach 2:
The system creates a virtual copy or snapshot of the guest environment at session start and maintains this isolated copy throughout the user session. At session end, this copied environment can be discarded or reset without affecting the original host system, enabling both security through non-persistence and operational efficiency through environment preservation.
3Reliability
If system image restoration is used to protect endpoints, then security against infections is improved, but administrative support is required to create and maintain images creating managerial burden
Solution Approach 1:
The system implements automated self-service mechanisms where the security client on each endpoint automatically creates, updates, and manages restricted guest environments without requiring administrative intervention. The system self-configures isolation parameters, manages session lifecycles, and automatically resets guest zones, eliminating the need for manual image creation and maintenance by administrators.
Solution Approach 2:
The system performs preliminary configuration of security policies, isolation parameters, and environment templates in advance during system deployment or initial setup. These pre-configured settings are then automatically applied and managed by the security client, reducing ongoing administrative burden while maintaining security effectiveness.
4Ease of operation
If guest users are allowed to download and install applications freely, then user access flexibility is improved, but vulnerability to intentional infections and drive-by downloads increases
Solution Approach 1:
The system segments the software execution environment into a restricted guest zone where users can freely download and install applications, and a protected host zone where system-critical applications run. The guest zone isolation prevents malicious code from the guest zone from affecting the host system or persisting beyond the session, maintaining both user flexibility and system security.
Solution Approach 2:
An intermediary security client acts as a mediator between the user's application installation requests and the actual system. This intermediary monitors, filters, and controls application executions in the guest zone, blocking known malware and suspicious behaviors while allowing legitimate applications to run, thus maintaining user flexibility without exposing the system to infections.
Data Source
AI summary
There are provided methods and systems for providing security on endpoints which are used on environment where temporary user access is needed without any session persistence. When a file is requested to be executed on any endpoint, the execution source would be checked for user information. If the file execution is requested by guest and/or pre-configured user accounts or any of the parent process is launched by guest and/or pre-configured user accounts, it is launched inside the secure container to isolate the all resource usage of that application from the rest of the system and user applications. This achieves the isolated data and application execution between temporary session/user files and persistent or system users session files. It enables a secure computing environment on an endpoint for shared and temporary user access enabled endpoints.