Virtual Network Adapter for Multi-User Session Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Multi-user operating systems face challenges in associating network activities and events with specific users, leading to issues like data corruption and security breaches, as existing applications assume unique host addresses per user session, which is not feasible in multi-user environments.
Innovation Solution
A system and method that allocates a unique host address to each user session on a multi-user device, intercepting and modifying network requests to ensure all communication uses this session-specific address, allowing multiple instances of applications to run without modifying existing applications or the operating system.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a global network adapter is used in multi-user operating systems, then network resources are shared across all user sessions, but multiple applications cannot run concurrently because they all compete for the same host address
Solution Approach 1:
The patent segments the global network adapter into virtual network adapters, with each user session having its own virtual adapter. This segmentation allows multiple applications in different user sessions to bind to unique host addresses simultaneously, resolving the conflict where multiple applications competed for the same global adapter resources.
Solution Approach 2:
The patent introduces a virtual network adapter as an intermediary between the physical network adapter and the applications. This virtual adapter mediates network resource access by translating global network requests into session-specific virtual adapter requests, enabling isolated network connections for each user session while sharing the physical hardware.
2Reliability
If applications request exclusive access to ports on host addresses, then network resource exclusivity is maintained, but multiple instances of the same application cannot run on multi-user devices
Solution Approach 1:
The patent creates separate virtual network adapters for each user session, which in turn have separate port spaces. This segmentation allows applications in different sessions to request exclusive port access without conflict, as each session's ports are isolated in its own virtual adapter namespace.
Solution Approach 2:
The patent adds a virtualization dimension to network address space by introducing virtual network adapters that wrap the physical adapter. This dimensional layering creates independent address spaces for each user session, allowing multiple application instances to coexist by binding to different virtual host addresses.
3Device complexity
If network packets are associated only with host addresses, then network communication is simplified, but associating network traffic with specific users becomes difficult in multi-user environments
Solution Approach 1:
The patent introduces virtual network adapters as intermediaries that carry user session identification information. By embedding session context in the virtual adapter layer, network packets can be associated with both the host address and the specific user session, enabling traffic correlation without significantly complicating the packet structure.
Solution Approach 2:
The patent creates virtual copies of the network adapter for each user session, where each virtual adapter maintains the necessary network communication functionality while adding session identification. This copying approach allows network traffic to be tagged with session information through the virtual adapter layer.
Data Source
AI summary
A method and system for associating a process on a multi-user device with a host address unique to a user session associated with the process begins by allocating a unique host address for the user session and assigning it to a network adapter. Requests that may bind network resources are intercepted, and relevant bind request parameters are manipulated to specify the host address associated with the user session. The original target of the request is invoked with potentially modified parameters.