Secure Element Containers for Multi-Tenant Applet Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing secure element platform runtime environments struggle to efficiently manage multiple instances of applets for different tenants in a multi-tenant environment while maintaining logical isolation and security.
Innovation Solution
The system deploys instances of SE application objects to separate secure containers using SE proxy applications, which extend or redirect from the executable component, ensuring each instance is isolated and secure, and allows for the termination and deletion of these objects with memory release.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Quantity of substance
If multiple instances of applets are deployed to the same partition for different tenants, then resource utilization is improved, but data isolation and security between tenants deteriorates
Solution Approach 1:
The patent divides the SE platform runtime environment into multiple secure containers, each acting as an isolated partition. Each secure container can hold one or more applet instances and provides logical isolation through its own partition mechanism. This segmentation allows multiple tenants to share the same physical hardware while maintaining strict data isolation and security boundaries between them.
Solution Approach 2:
The patent introduces secure containers as intermediary structures between the hardware resources and the applet instances. These secure containers act as mediators that provide a standardized interface for tenant isolation while enabling efficient resource sharing. The secure containers manage the partitioning and isolation mechanisms, allowing multiple applet instances to coexist securely.
2Reliability
If separate partitions are created for each tenant to ensure isolation, then security is improved, but device complexity and memory usage worsen
Solution Approach 1:
The patent designs secure containers that can serve multiple functions: they provide tenant isolation, manage applet instances, handle memory allocation, and enforce security policies. This multi-functionality reduces the need for separate dedicated structures for each function, thereby reducing overall system complexity while maintaining strong security isolation between tenants.
Solution Approach 2:
The patent implements dynamic secure container management where containers can be created, destroyed, and reconfigured at runtime based on tenant needs. This dynamic approach allows the system to adjust the number and configuration of partitions according to actual workload requirements, reducing complexity by only creating necessary isolation structures when needed rather than maintaining fixed complex partitioning.
3Productivity
If multiple applet instances are executed simultaneously for different tenants, then productivity is improved, but memory management complexity and security risks worsen
Solution Approach 1:
The patent segments the memory space into separate secure containers, each with its own memory region allocated for specific tenant applet instances. This segmentation enables simultaneous execution of multiple applets across different tenants while maintaining simple and secure memory management through clear memory boundaries and isolation mechanisms.
Solution Approach 2:
The patent employs a copying mechanism where secure container images or templates can be replicated and instantiated multiple times for different tenants. This allows rapid deployment of multiple applet instances without manually configuring each one, improving productivity while maintaining consistent security and memory management patterns across all instances.
Data Source
AI summary
A system deploys an instance of a secure element (SE) application object to each of a plurality of secure containers of an SE platform runtime environment. The system generates an SE proxy application that includes an extension component that redirects to an executable component of an SE application installation file. The system additionally generates a secure container in the SE platform runtime environment. The secure container includes a partition that logically isolates the secure container from other secure containers of the SE platform runtime environment. The system deploys an SE application object to the secure container based on the extension component of the SE proxy application. Upon having deployed the SE application object to the secure container, the system executes the SE application object within the secure container.