Secure Runtime Isolates VM Data via Sandboxed Copy
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing virtual machine environments lack robust security measures to isolate and protect virtual machine operations from malicious code and ensure data integrity, leading to potential data breaches and operational disruptions.
Innovation Solution
A secure runtime system is implemented that sandboxes app execution and provides apps with a copy of virtual machine data instead of direct access, using containerized runtimes and targeted APIs to manage data access and prevent unauthorized modifications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If apps are given direct access to virtual machine data, then data access efficiency is improved, but security and data integrity are compromised
Solution Approach 1:
The patent introduces a secure runtime environment as an intermediary layer between apps and virtual machine data. This runtime sandboxed environment mediates all data access operations, allowing apps to access data efficiently through controlled interfaces while preventing malicious or unauthorized modifications. The intermediary runtime enforces security policies and validates all access requests, thus maintaining data integrity without sacrificing access efficiency.
Solution Approach 2:
The patent creates a copy of the virtual machine data within the secure runtime environment for apps to operate on. Instead of giving direct access to the original data, apps work with replicated data copies in the sandboxed runtime. This copying approach allows efficient data manipulation by apps while the original data remains protected in the virtual machine, preventing any potential corruption or unauthorized changes.
2Reliability
If sandboxing and data copying mechanisms are implemented, then security and data integrity are improved, but system complexity increases
Solution Approach 1:
The secure runtime environment is designed as a universal platform that handles multiple functions: data access mediation, security policy enforcement, data copying and management, and app sandboxing. By consolidating these diverse security and data management functions into a single multi-functional runtime system, the patent reduces overall system complexity compared to implementing separate mechanisms for each function.
Solution Approach 2:
The secure runtime environment implements self-service mechanisms where the runtime automatically manages data copying, access control, and security validation without requiring external intervention. The runtime autonomously handles security policies and data integrity checks, reducing the complexity burden on external system components and simplifying the overall architecture.
3Reliability
If secure runtime environment is introduced, then security measures are improved, but computational overhead increases
Solution Approach 1:
The secure runtime environment performs preliminary actions by pre-establishing security policies, pre-copying data to the sandboxed environment, and pre-configuring access controls before apps need to access data. This preliminary setup eliminates the need for repeated security checks and data copying operations during app execution, thereby reducing computational overhead while maintaining strong security measures.
Data Source
AI summary
A computer-implemented method at a data management system comprises: generating, with one or more processors, a containerized runtime in a memory in communication with the one or more processors; instantiating, with the one or more processors, an app in the runtime; receiving, with the one or more processors, a request from the app for data; retrieving, with the one or more processors, a copy of the requested data from a data source; and transmitting, with the one or more processors, the data to the containerized runtime for the app to operate on.