Secure Workspace Endpoint Protection via OS Hooking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing solutions for creating a secure workspace environment on untrusted endpoints, such as public kiosks or home computers, are either easily bypassed or inconvenient, failing to provide comprehensive protection against unauthorized access and data theft.
Innovation Solution
A method and system that intercepts key operating system functions to encrypt sensitive information and control access, allowing only authorized requests to decrypt and access data, while maintaining a secure virtual desktop environment.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing VPN solutions are used to encrypt traffic between end-point and corporate gateway, then traffic encryption is improved, but the end-point computer becomes vulnerable to attacks (keyloggers, credential spoofing, cache analysis, file analysis) that can bypass the encryption
Solution Approach 1:
The patent implements a nested security architecture where a secure workspace environment is embedded within the existing untrusted operating system. The secure workspace acts as a contained environment that isolates sensitive applications and data, allowing encryption and security controls to be applied at multiple levels - both at the network level (VPN) and at the application level (secure workspace), thereby addressing the vulnerability to endpoint attacks while maintaining traffic encryption.
Solution Approach 2:
The patent introduces an intermediary security layer between the untrusted end-point applications and the corporate network. This intermediary component (the secure workspace environment with its own virtual file system and process management) mediates all access to sensitive data, ensuring that even if the end-point computer is compromised, the intermediary layer prevents attackers from accessing encrypted data or injecting malware into corporate applications.
2Reliability
If security policies are deployed to endpoints to manage remote users, then security control is improved, but the complexity of managing untrusted end-points increases
Solution Approach 1:
The secure workspace environment is designed to be self-managing and self-enforcing. It automatically applies security policies, manages its own encryption keys, controls access to resources, and isolates applications without requiring manual configuration or intervention from the centralized security team. This self-service capability maintains strong security control while significantly reducing the operational complexity of managing untrusted end-points.
Solution Approach 2:
The patent changes the fundamental parameters of how security is applied at the endpoint. Instead of requiring manual installation and configuration of multiple security tools and policies on each untrusted device, the system transforms security into an automated parameter that is applied through the secure workspace environment itself, which dynamically adapts to different end-point conditions while maintaining consistent security controls.
3Object-affected harmful factors
If a secure environment is created within existing OS, then protection against data theft is improved, but the ease of operation may be reduced due to additional security layers
Solution Approach 1:
The patent segments the operating system into distinct trusted and untrusted zones. The secure workspace environment is isolated from the rest of the untrusted OS, creating a dedicated sandbox where sensitive applications run. This segmentation provides strong data theft protection by containing potential breaches within the secure workspace while allowing users to access the secure environment through simple, user-friendly interfaces without needing to understand or interact with the underlying security architecture.
Data Source
AI summary
System and methodology providing a secure workspace environment is described. In one embodiment, for example, in a computer system, a method is described for creating a secured workspace within an existing operating system for allowing users to run applications in a secured manner, the method comprises steps of: creating a policy for configuring the secured workspace, the policy specifying how information created during operation of the applications may be accessed; hooking particular functions of the operating system in order to obtain control over the information created during operation of the applications; during operation of the applications, encrypting the information to prevent unauthorized access; in response to a request for access to the information, determining whether the request complies with the policy; and if the request complies with the policy, satisfying the request by providing access to a decrypted copy of the information.