Virtual Secure Desktop for Untrusted Endpoint Data Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Users accessing networked applications and data from untrusted computers face security issues due to data leakage and malicious code threats, as existing security measures do not protect against data remnants on untrusted devices after a session is concluded.
Innovation Solution
A virtual secure desktop is created on untrusted computers, using a secure vault for data storage, encrypting all data access and preventing direct writing to the hard drive, ensuring that no data is left on the device after the session, and allowing users to customize their environment for increased security and productivity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If users access networked applications and data from untrusted computers, then mobility and accessibility are improved, but security is worsened due to data leakage and malicious code threats
Solution Approach 1:
A virtual secure desktop is introduced as an intermediary layer between the user and the untrusted computer's file system. This virtual desktop captures all file system operations and redirects them to a secure remote location, preventing direct access to the untrusted device while maintaining full functionality. The virtual desktop acts as a mediator that isolates the user's data from the untrusted environment.
Solution Approach 2:
The file system access is segmented into two separate paths: a secure redirected path for the user's virtual desktop that sends data to a remote secure location, and the native untrusted file system that remains isolated. This segmentation ensures that even if the untrusted computer is compromised, the user's data remains protected in the separate secure channel.
2Reliability
If security measures are implemented on untrusted computers, then data protection is improved, but device complexity and ease of operation are worsened
Solution Approach 1:
The virtual secure desktop automatically manages security without requiring user intervention. All file system operations are automatically captured, redirected, and encrypted in the background. The system self-manages the security protocol, handling authentication, data redirection, and cleanup operations without user awareness or manual configuration.
Solution Approach 2:
The virtual desktop software acts as an intermediary that transparently handles all security operations. Users interact with a familiar desktop interface while the intermediary layer manages the complex security protocols, data redirection, and encryption in the background, shielding users from complexity.
3Object-affected harmful factors
If a virtual secure desktop is created with data redirection, then security is improved by preventing data leakage, but ease of operation is worsened due to customization limitations
Solution Approach 1:
The virtual secure desktop provides a universal environment that supports multiple applications and file types through a standardized interface. While the file system is redirected for security, the virtual desktop maintains universal compatibility with various applications, allowing users to access and manipulate data in a consistent manner across different programs without direct file system access.
4Object-affected harmful factors
If all data access is encrypted and redirected, then security is improved, but productivity is worsened due to potential performance overhead
Solution Approach 1:
Security measures are performed in advance and in parallel with user operations. The virtual desktop pre-configures secure channels and buffers data redirection operations to minimize latency. By preparing security infrastructure beforehand and using asynchronous buffering techniques, the system reduces the performance overhead of real-time encryption and redirection.
Data Source
AI summary
A method of providing endpoint security for a session on an untrusted computer accessing data on a networked server is disclosed. A virtual secure desktop is created on the untrusted computer that protects the user's applications running in the virtual secure desktop from malicious code and encrypts all data. Data to be written to the hard drive is stored in a secure vault. The secure vault is completely encrypted and erased at the end of the virtual secure desktop session. The virtual secure desktop may be created by creating a separate user session on the untrusted computer and linking the separate user session to the secure vault. Alternatively, the virtual secure desktop may be created by intercepting calls the Native API and redirecting requests from the virtual secure desktop session to the secure vault.