UID Isolation for Fast Application Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Fast applications, particularly those based on JavaScript, pose significant security threats due to weak boundaries and lack of prior checks, allowing malicious code to manipulate permissions and access sensitive resources.
Innovation Solution
The implementation of UID isolation, privilege-less JavaScript engine sandboxing, and a JavaScript Integrity Measurement Agent (JIMA) to enforce stronger barriers against malicious fast applications, ensuring they do not gain the same permissions as the host application and detecting any changes in the fast application code that may indicate malicious behavior.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If fast applications are allowed to run freely within host applications, then ease of use and rapid deployment are improved, but security risks and attack surface increase
Solution Approach 1:
The patent segments the application execution environment by introducing a sandbox that isolates fast applications from the host application and underlying operating system. This segmentation allows fast applications to run freely within their confined sandbox environment while preventing them from affecting the host system, thus resolving the contradiction between ease of use and security risks.
Solution Approach 2:
The patent introduces a sandbox as an intermediary layer between fast applications and the host application/operating system. This intermediary provides controlled access and enforcement of security policies, allowing fast applications to operate with ease of use while the sandbox mediates and prevents security risks by blocking unauthorized operations.
2Adaptability or versatility
If JavaScript engine provides full access to host application resources, then functionality and adaptability are improved, but vulnerability to malicious code increases
Solution Approach 1:
The patent applies local quality by providing different access rights to different parts of the system. Within the sandbox, fast applications receive full functionality and adaptability to access necessary resources. However, at the boundary of the sandbox, access rights are restricted to prevent malicious code from affecting the host application or operating system, thus resolving the contradiction between functionality and vulnerability.
3Use of energy by moving object
If fast applications share the same process space as host application, then resource efficiency is improved, but boundary enforcement and security checking become weaker
Solution Approach 1:
The patent implements a nested structure where the sandbox (containing fast applications) is embedded within the host application process space. This nesting allows resource efficiency by sharing the host process space, while simultaneously enforcing strong boundaries through the sandbox's isolation mechanisms that prevent fast applications from accessing unauthorized resources or affecting the host application.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method and system for application security. The methods and systems of the present disclosure improve application security and may be used to secure a host application and operating system from malicious fast applications. A request to access resources of the computing device is received from an application adapter of a fast application operating within a host application on the computing device. In response to a determination that the request is associated with resources included in a permission list of the fast application, the unique user identifier (UID) of the application adapter to the UID of the host application is translated by the operating system, which determines whether to allow the request based on the UID of the host application. Otherwise, the operating system determines whether to allow the request based on the UID of the application adapter.