Secured Container for Enterprise Data Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Modern enterprise systems face challenges in securing business data as employees access it from various locations, with compromised Information Handling Systems (IHS) vulnerable to malicious software that can lead to data theft and ransomware attacks, particularly due to the complexity of securing operating systems with multiple features and functionalities.
Innovation Solution
Implementing a secured container on IHS using a symmetric key for encryption, with out-of-band communication for secure storage isolated from the operating system and in-band communication for digital signing, supported by a trusted agent within the operating system, ensuring secure deployment and migration of the container.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If employees access business data from various locations using different IHSs, then employee productivity is improved, but the security risk of data compromise increases
Solution Approach 1:
The system segments enterprise data into a secure container (virtual environment) that is isolated from the host operating system. This container can be deployed across multiple IHSs, allowing employees to access data from various locations while maintaining security boundaries that prevent compromise of the entire system if one IHS is breached.
Solution Approach 2:
A trusted agent operating within the secure container acts as an intermediary between the untrusted host environment and the protected enterprise data. This intermediary manages cryptographic operations and enforces security policies, enabling productive remote access while mitigating security risks through controlled interaction.
2Ease of operation
If the operating system supports multiple features and functionalities, then ease of operation is improved, but the attack surface increases making the system more vulnerable
Solution Approach 1:
The system extracts enterprise data and critical operations from the host operating system into a separate secure container. This extraction removes the vulnerable data from the attack surface of the full-featured OS, while the container maintains necessary functionality through a minimal trusted environment with cryptographic protections.
Solution Approach 2:
The secure container implements localized security measures including isolated file systems, restricted network access, and mandatory cryptographic operations. These local quality enhancements protect the specific area where enterprise data resides without requiring the entire operating system to be secured against all threats.
3Reliability
If data is isolated from the operating system using a secure container, then data protection is improved, but device complexity increases
Solution Approach 1:
The secure container implementation provides multiple security functions within a single architectural component: data isolation, cryptographic key management, trusted execution, and secure communication. This multi-functionality reduces overall system complexity compared to implementing separate mechanisms for each security requirement.
Data Source
AI summary
A secured container provides access to enterprise data while isolated from the operating system of an Information Handling System (IHS). The secured container remains secured during its delivery and deployment. A secured container is configured to provide a user of the IHS with access to enterprise data. The secured container is encrypted using a symmetrical key that is transmitted to a secured storage that is isolated from the operating system of the IHS via out-of-band communications. The encrypted secured container is digitally signed using an asymmetric key pair. The digital signature and the encrypted secured container are transmitted to the IHS via in-band communications. At the IHS, the public key of the asymmetric key pair is used to validate the digital signature and the private symmetric key is retrieved from secured storage to decrypt the secured container. Additional embodiments provide a technique for securely migrating a secured container between IHSs.