Secure Multivisor Biometric Access for Mobile OS Intrusion Mitigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional mobile devices are vulnerable to security intrusions from user space applications, as their operating systems were not designed with security in mind, leading to potential compromises through malicious software interacting with hardware and OS.
Innovation Solution
Implementing a secure multivisor with secure service partitions and a biometric security service on a mobile device, which runs a secure real-time operating system, isolates user space applications and requires biometric verification for interactions with the secure RTOS, preventing unauthorized access and ensuring dedicated hardware resources for each partition.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If mobile devices are designed for consumer convenience and usability, then ease of operation is improved, but security vulnerability increases
Solution Approach 1:
The system divides the mobile device into distinct partitions: a secure partition running a secure RTOS with critical services and data, and a user partition running the conventional mobile OS with user applications. This segmentation isolates security-critical functions from potentially malicious user space applications, allowing the device to maintain both consumer convenience in the user partition and security in the secure partition simultaneously
2Adaptability or versatility
If the OS and user space are both able to interact with hardware, then functionality is improved, but security risk increases
Solution Approach 1:
The secure multivisor acts as an intermediary layer between the user space partition and the secure partition. It controls and mediates all interactions between user applications and secure services, allowing necessary functionality while preventing unauthorized access. The multivisor enforces security policies and filters interactions, enabling the system to maintain both hardware accessibility and security
3Reliability
If biometric verification is required for secure RTOS interactions, then security is improved, but device complexity increases
Solution Approach 1:
The biometric verification functionality is extracted as a separate secure service within the secure partition, independent from the user OS. This extraction allows biometric security to be implemented without modifying or complicating the user space applications or main OS, containing the complexity within the secure partition while maintaining security enhancements
Data Source
AI summary
A method for mitigating intrusions to a mobile operating system (OS) that begins with the instantiation of secure services and corresponding data in secure service partitions by a secure multivisor running on a mobile device running a secure real-time operating system (RTOS). One of the secure services can be a biometric security service having corresponding biometric data defining a user's identity. The secure multivisor can instantiate a user space partition running a virtual machine with a guest OS having installed client software applications. When the virtual machine, a client software application, or a user requests interaction with the secure RTOS that meets a predefined privilege threshold, the biometric security service can determine the biometric identity of the user. When the determined biometric identity of the user matches a required biometric identity of the interaction, the biometric security service can allow the interaction with the secure RTOS.