Virtualized Object Sharing Between Isolated and Non-Isolated Applications
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Isolation layers are ineffective for executing and monitoring applications that need to communicate or share objects with applications outside the layer, as potentially malicious applications quarantined within cannot access external objects, limiting their functionality and monitoring capabilities.
Innovation Solution
A method to bring non-isolated applications and their associated objects into an isolation layer in virtualized forms, allowing them to share objects and maintain isolation while enabling more realistic execution and monitoring.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If an application is executed in an isolation layer to ensure security and prevent malicious behavior, then the application's isolation and security protection are improved, but the application's ability to access and share objects with external applications deteriorates
Solution Approach 1:
The patent introduces a gateway as an intermediary component between the isolation layer and the external environment. This gateway receives object access requests from isolated applications, validates them against security policies, and facilitates controlled communication with external applications. The gateway acts as a mediator that maintains security isolation while enabling necessary object sharing capabilities.
Solution Approach 2:
The system segments the object sharing mechanism into distinct components: isolated applications within the containment environment, a gateway layer for policy enforcement and request management, and external applications in the host environment. This segmentation allows each component to operate independently with clearly defined interfaces, maintaining security boundaries while enabling controlled interaction.
2Object-affected harmful factors
If an application is quarantined in an isolation layer for monitoring, then the potential malicious behavior containment is improved, but the application's functionality and execution realism deteriorate
Solution Approach 1:
The gateway serves as an intermediary that restores functional realism by allowing isolated applications to access and share objects with external applications under controlled conditions. This enables the application to execute with more realistic behavior patterns while the gateway continuously monitors and enforces security policies, maintaining containment of malicious activities.
Solution Approach 2:
The system dynamically adjusts the level of isolation and object sharing based on security policies and runtime conditions. The gateway can modify access permissions, enable or disable specific object sharing capabilities, and adjust monitoring intensity based on the application's behavior and security requirements, balancing containment effectiveness with execution realism.
3Reliability
If strict isolation is enforced to prevent malicious applications from modifying external systems, then the system security is improved, but the monitoring capability and detection accuracy deteriorate
Solution Approach 1:
The gateway acts as a monitoring intermediary that intercepts and analyzes all object access requests between isolated and external applications. By examining these requests and interactions through the gateway, the system gains detailed visibility into application behavior, improving detection accuracy while maintaining security isolation through policy enforcement.
Solution Approach 2:
The system implements feedback mechanisms where the gateway monitors object sharing interactions and reports suspicious behaviors to the security management system. This feedback loop enables continuous monitoring and dynamic adjustment of security policies, improving detection capabilities while maintaining system security through automated response to detected anomalies.
Data Source
AI summary
Bringing a non-isolated computer application into an isolation layer with an isolated computer application. In one embodiment, a method may include isolating a first computer application by executing the first computer application as a virtualized first computer application in an isolation layer. The method may also include receiving a request, from the virtualized first computer application, to share a computer object with a second computer application that is not executing in the isolation layer. The method may further include, in response to the receiving of the request, several acts. These acts may include executing, in real-time, at least a portion of the second computer application as a virtualized second computer application in the isolation layer. These acts may also include creating a virtualized computer object based on the computer object in the isolation layer. These acts may further include sharing the virtualized computer object in the isolation layer.