Secure Virtual Partition for Malware Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Malware attacks compromise the security of computing devices by modifying software programs, leading to unauthorized execution, data tampering, and privacy breaches, with existing solutions failing to effectively isolate and protect against such threats.
Innovation Solution
A security management system that creates a secure virtual partition independent of the operating system, performs integrity checks on software applications, and grants access to data based on user credentials, using a hypervisor to isolate applications and load verified versions, thereby protecting against malware attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a traditional operating system is used to access data, then ease of operation is maintained, but security against malware attacks deteriorates
Solution Approach 1:
The system divides the operating system into multiple isolated partitions, each with its own security context. The trusted partition contains the security module and verified applications, while untrusted partitions can be isolated from malware infections. This segmentation allows secure data access without requiring the entire OS to be compromised-free, resolving the contradiction between security and ease of operation.
Solution Approach 2:
A security module acts as an intermediary between the data and the applications that need to access it. This module verifies application integrity, manages authentication credentials, and controls access rights. By introducing this intermediary layer, the system maintains ease of operation through automated security checks while improving reliability through enforced security policies.
2Reliability
If software applications are executed without isolation, then adaptability is maintained, but protection against malware attacks deteriorates
Solution Approach 1:
Each application is executed in its own isolated partition with dedicated memory and system resources. This segmentation prevents malware in one application from affecting others or the host system. The system maintains adaptability by allowing different applications to run simultaneously in separate partitions, each with its own execution context and security policies.
Solution Approach 2:
Each partition has its own security policies, access controls, and execution environments tailored to the specific application requirements. This local quality approach allows flexible application execution while maintaining protection, as each partition can be configured with appropriate security measures without affecting other applications.
3Adaptability or versatility
If data is made accessible to multiple users, then adaptability is improved, but security against unauthorized access deteriorates
Solution Approach 1:
The security module serves as an intermediary that manages authentication and authorization for all data access requests. It verifies user credentials, checks access rights, and enforces security policies before allowing access. This intermediary approach maintains adaptability by allowing multiple users to access data while improving security through centralized, automated authorization control.
Solution Approach 2:
Each user or application group has its own access rights and security context defined in its partition. This local quality approach enables fine-grained control over data accessibility, allowing flexible multi-user access while maintaining strong security through individualized authorization policies.
4Reliability
If application integrity is not verified, then ease of manufacture is maintained, but protection against tampered software deteriorates
Solution Approach 1:
Applications are verified for integrity and authenticity before being loaded into execution partitions. The security module checks digital signatures, verifies code hashes, and ensures applications have not been tampered with. This preliminary verification action maintains reliability by preventing tampered software execution while maintaining ease of manufacture through automated verification processes that occur during deployment.
Data Source
AI summary
A security manager receives a request for data that is subject to data security management. The security manager operates independently of a host partition and is not directly accessible or detectable by the host partition. The security manager determines whether to grant or deny access to the requested data based at least in part on a requesting user's authentication credentials. If the data request is approved, a security policy associated with the data is determined. In addition, instructions are sent to a system hypervisor to create a secure partition. The hypervisor loads the requested data and a verified version of an application necessary to access the data into the secure partition creating a secure environment for accessing the data.