Secure Software Installation via Dynamic Container Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The increasing openness of mobile devices for software installation poses security risks due to malware threats, and existing security architectures deter developers with high signature costs and complex user interaction requirements, often leaving users uninformed about privilege implications.
Innovation Solution
A method for securely installing software on mobile devices by using an installer to configure secure containers with randomly assigned identifiers unknown to the software, managed by an installation framework that restricts execution and enforces container restrictions, potentially using digital signatures for authorization.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If code signing and explicit user approval are used to grant privileges to software, then security is improved, but developer participation is deterred due to high signature costs and complex user interaction requirements
Solution Approach 1:
The system automatically manages security containers and privilege assignment without requiring manual user approval for each software installation. The installation framework automatically creates isolated containers, assigns appropriate privileges, and manages the correspondence between applications and containers, enabling self-service security that reduces both cost and complexity barriers for developers.
Solution Approach 2:
The system segments the software execution environment into isolated containers, each with its own security context and privilege level. This segmentation allows different security policies to be applied to different applications without affecting the entire system, reducing the complexity of security management while maintaining high security standards.
2Reliability
If users are prompted to decide whether to grant privileges to software, then security control is improved, but usability deteriorates due to tedious user interaction and insufficient information about privilege implications
Solution Approach 1:
The system performs preliminary security assessments and container configurations automatically during the installation process, before user interaction is required. The installation framework pre-evaluates security requirements, creates appropriate containers, and prepares privilege assignments, so that users only need to approve pre-analyzed security decisions rather than making informed choices about complex privilege implications.
Solution Approach 2:
The system automatically manages the complex task of security container creation and privilege assignment without requiring user intervention. The installation framework self-services the security configuration by automatically determining appropriate containers, assigning privileges, and managing the application-container correspondence, eliminating tedious user interactions while maintaining security control.
3Adaptability or versatility
If software is installed with full system access, then functionality is improved, but security risks increase due to malware threats from open device platforms
Solution Approach 1:
The system segments the software execution environment into isolated containers that provide full functionality within their own security context but prevent access to other applications' resources. Each container acts as an independent execution environment with its own file system, process space, and system access controls, enabling software to function fully while containing potential malware threats within isolated boundaries.
Solution Approach 2:
The system applies different security characteristics to different parts of the system by creating localized security contexts for each application. Each container has its own security policies, privilege levels, and access controls tailored to the specific application's requirements, allowing full functionality where needed while restricting access where security risks exist.
Data Source
AI summary
Embodiments of the present disclosure provide methods and systems for securely installing software on a computing device, such as a mobile device. In one embodiment, the device executes an installer that securely installs the software. In order to perform installations securely, the installer configures one or more secure containers for the software and installs the software exclusively in these containers. In some embodiments, the installer randomly determines the identifiers for the containers. These identifiers remain unknown to the software to be installed. Instead, an installation framework maintains the correspondence between an application and its container. Other methods and apparatuses are also described.