Trust-Based Web Content Containerization for Malware Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional sandboxing solutions fail to adequately distinguish between trustworthy and untrustworthy sources of web content, leaving client devices vulnerable to malware and other security threats.
Innovation Solution
Implementing a containerization architecture that maps web content to execution environments based on trust levels, using a trust level database and real-time assessments to organize content into high, medium, low, and blacklist containers, and selectively offloading content to different execution environments based on trust and latency considerations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional sandboxing solutions are used to protect web content execution, then basic isolation is provided, but the ability to distinguish between trustworthy and untrustworthy sources is insufficient
Solution Approach 1:
The patent implements differentiated sandboxing by creating distinct execution environments with varying levels of access permissions. Each sandbox is configured with specific quality attributes (access rights, resource limits, isolation levels) tailored to the trust level of the web content source, allowing precise control over what each sandboxed application can do rather than applying uniform restrictions to all content.
Solution Approach 2:
The system dynamically adjusts sandbox parameters such as access permissions, resource allocation limits, and isolation strength based on the assessed trust level of the web content. High-trust content receives sandboxes with more permissive parameters, while low-trust content is confined to sandboxes with stricter parameters, enabling adaptive security that responds to the actual risk level of each content source.
2Device complexity
If web content is executed in a single unified environment, then resource utilization is simplified, but security risks from untrustworthy content increase
Solution Approach 1:
The patent divides the execution environment into multiple segmented sandboxes, each isolated from others. Web content is distributed across these segmented environments based on their trust levels, so that if one sandbox is compromised by malware, the segmentation prevents the harm from spreading to other sandboxes or the host system. Each segment operates independently with its own resource constraints and access controls.
3Adaptability or versatility
If all web content is allowed full access to client device resources, then functionality is maximized, but security protection is compromised
Solution Approach 1:
The patent implements dynamic access control where resource permissions are not fixed but adjust based on the trust level assessment of each web content source. High-trust content dynamically receives broader resource access rights, while low-trust content is dynamically restricted to minimal necessary access. This dynamic allocation allows the system to maximize functionality for safe content while maintaining security against potentially harmful content.
Data Source
AI summary
Systems and methods may provide for receiving web content and determining a trust level associated with the web content. Additionally, the web content may be mapped to an execution environment based at least in part on the trust level. In one example, the web content is stored to a trust level specific data container.