Secure OS Virtualization for Message Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for securely creating, sending, and receiving electronic messages in military and confidential contexts are vulnerable to malware and data interception due to the use of standard communication paths and operating systems that may have inherent security risks, such as viruses and Trojans.
Innovation Solution
Implementing a method that uses a secure operating system within a virtualization unit to create and send electronic messages, where the messages are stored on internal storage accessible only by the secure operating system and virtualization unit, and using a second application to poll and transmit the messages, ensuring separation and monitoring of communication paths, and optionally encrypting messages with a recipient-specific key.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If standard operating systems and communication paths are used, then ease of operation is improved, but security against malware and data interception deteriorates
Solution Approach 1:
The system divides the operating system into separate containers (e.g., Windows container and secure Linux container) that are isolated from each other. Each container runs independently with its own file system and memory space, preventing malware in one container from affecting another. This segmentation maintains operational ease within each container while achieving high security through isolation.
Solution Approach 2:
A virtualization layer acts as an intermediary between the standard operating system containers and the secure communication functions. This intermediary layer provides controlled access to hardware resources and manages communication between containers, enabling secure message transmission while maintaining the ease of using standard OS applications.
2Reliability
If physically separate systems are used, then security is improved, but device complexity and infrastructure costs worsen
Solution Approach 1:
The secure operating system container is nested within the standard operating system container, with the virtualization layer providing an additional containment level. This nested structure allows multiple secure environments to coexist within a single physical system, reducing the need for completely separate physical systems while maintaining security isolation.
Solution Approach 2:
The virtualization layer provides universal access to hardware resources (graphics memory, storage, network interfaces) for multiple containers simultaneously. This multi-functional approach allows a single physical system to support multiple secure communication functions and standard applications without requiring separate dedicated hardware for each function.
3Reliability
If virtualization layer is introduced, then security control is improved, but device complexity worsens
Solution Approach 1:
The virtualization layer automatically manages resource allocation, access control, and communication between containers without requiring manual configuration. The system self-manages the virtualized hardware resources and provides transparent access to applications, reducing the operational burden despite the added complexity of the virtualization infrastructure.
4Reliability
If internal storage accessible only by secure OS is used, then data security is improved, but ease of operation worsens
Solution Approach 1:
The virtualization layer acts as an intermediary that provides controlled access to the internal storage of the secure container from external applications. This intermediary enables secure data retrieval and processing while maintaining the security isolation of the internal storage, balancing data accessibility with security requirements.
Data Source
Figure 1
Figure 2
AI summary
The invention relates to a method for securely creating and sending an electronic message, whereby the message is created using a first application running in a secure operating system, the created message is stored in a storage means that can only be accessed by the secure operating system and a virtualization unit. In a second application executed by the virtualization unit, the internal storage means is analyzed for the presence of a message and, if the message is present, said message is transmitted to a receiver. The invention also relates to a method for securely receiving and processing an electronic message, whereby an external storage means is analyzed for the presence of a message using a second application and, if the message is present, said message is transmitted to the internal storage means. The presence of the message is polled using the first application and, if the message is present, said message is transmitted from the internal storage means to the first application for processing. The invention further relates to a transmitting device for carrying out the method for securely creating and sending the electronic message and a receiving device for carrying out the method for securely receiving and processing the electronic message.