Task Isolation via Secondary User Account Provisioning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current mechanisms for content isolation in computer devices are insecure, resource-intensive, and difficult for ordinary users to implement effectively, often requiring advanced knowledge and preparation of content.
Innovation Solution
A computer system and method that intercepts tasks from a primary user account before execution, provisioning a task isolation environment by creating a secondary user account and mapping network drives, with an agent controlling access to ensure secure and isolated execution of untrusted content.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If virtual machines are used for content isolation, then security is improved, but resource consumption increases
Solution Approach 1:
The system segments the user account into isolated task environments. Each untrusted task is executed in a separate, automatically created user account context, providing security isolation without requiring full virtual machine overhead. This segmentation approach divides the computing space into secure compartments while maintaining shared system resources.
Solution Approach 2:
The system dynamically changes the execution context parameters by switching between different user account contexts. Instead of maintaining persistent isolated environments like virtual machines, the system creates temporary isolated contexts only when needed for untrusted tasks, then cleans them up afterward, reducing overall resource consumption while maintaining security during execution.
2Reliability
If content isolation mechanisms are implemented, then security is improved, but ease of operation deteriorates
Solution Approach 1:
The content isolation system operates automatically without requiring user intervention. The agent monitors task execution and automatically creates isolated user account contexts, manages network drive mappings, and enforces access policies. Users simply interact with tasks normally, and the isolation mechanism handles itself transparently in the background.
Solution Approach 2:
The system introduces an intermediary agent that sits between the user and the isolated task environments. This agent automatically manages the complexity of isolation mechanics, translating user actions into appropriate isolated context operations. Users don't need to understand or configure isolation parameters; the intermediary handles all complexity behind the scenes.
3Reliability
If content isolation is implemented with proper security, then reliability is improved, but device complexity increases
Solution Approach 1:
The system uses a universal mechanism based on existing user account and network drive infrastructure to achieve content isolation. Instead of implementing separate complex isolation subsystems, it leverages the operating system's existing user context and network drive mapping capabilities, making the isolation mechanism simpler and more integrated with the overall system architecture.
Solution Approach 2:
The system creates simplified copies of the user account context and network drive mappings for isolated tasks. Rather than implementing complex virtualization, it copies the essential isolation elements (user context, drive mappings) into temporary isolated environments, providing sufficient security separation with minimal added complexity.
4Reliability
If manual content preparation for isolation is required, then security is improved, but productivity deteriorates
Solution Approach 1:
The system performs preliminary actions by automatically creating the isolated user account context and network drive mappings before executing untrusted tasks. The agent prepares the isolation environment proactively, so when a task needs isolation, the infrastructure is already in place and ready to use, eliminating any preparation overhead for the user or the task execution process.
Solution Approach 2:
The isolation mechanism is self-configuring and self-preparing. The agent automatically detects when isolation is needed, creates appropriate user contexts, and sets up network drive mappings without requiring external preparation of the content. The system serves itself by managing the entire isolation lifecycle automatically, from creation to cleanup.
Data Source
AI summary
A computer system and method are provided to intercept a task from a primary user account 121 prior to execution of the task by the computer device 200, where the task relates to an untrusted content. A task isolation environment 350 is provisioned for executing the task, including programmatically creating a secondary user account 121b on the computer device. A mapped network drive 420 of the primary user account 121 is determined and is automatically provisioned in the secondary user account 121b. Access to the mapped network drive 420 is controlled by an agent 300 on the computer device 200.