Virtualized Application Policy Generation via Sandbox Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current software applications restrict file system access and program execution based on manual input, lacking automated verification for security vulnerabilities, which can lead to potential malicious behavior from newly installed applications.
Innovation Solution
A virtualized environment is used to execute new applications, with a program execution restrictor generating policies to allow or restrict operations, confining potentially malicious actions within the virtual environment before applying these policies to the host system, ensuring secure execution.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual input is used to specify allowed files and programs, then policy configuration is simple and direct, but security verification is lacking and potential malicious behavior cannot be detected
Solution Approach 1:
The system performs preliminary security verification by executing the application in a virtualized sandbox environment before allowing it to run on the host system. During this preliminary execution, the system monitors and logs all file system operations and program element activities, then analyzes these logs to determine whether to generate allow policies. This preliminary action detects malicious behavior before it can affect the host system, resolving the contradiction between security verification and system complexity.
Solution Approach 2:
The patent introduces a virtualized sandbox environment as an intermediary between the application and the host system. This intermediary captures and analyzes application behavior without exposing the host system to potential threats. The sandbox acts as a mediator that enables security verification while maintaining system simplicity, as the analysis is automated and the sandbox isolates complex security checks from the main system.
2Reliability
If applications are executed immediately on the host system, then productivity is high and deployment is fast, but security risks increase due to undetected malicious behavior
Solution Approach 1:
The system performs a preliminary execution phase in a virtualized sandbox before deploying the application to the host system. During this preliminary phase, the application's behavior is monitored and logged to detect malicious activities. Only after successful verification does the system generate allow policies and permit host execution. This preliminary action ensures system protection while minimizing productivity impact, as the verification process is automated and occurs in parallel with policy generation.
Solution Approach 2:
The patent creates a copy of the application in a virtualized sandbox environment for security verification. This copy executes in isolation, allowing the system to analyze behavior without risking the host system. The copying approach enables concurrent verification and policy generation, maintaining productivity while ensuring reliability through automated security checks before host deployment.
3Reliability
If restrictive policies are applied to all applications, then security is maintained, but legitimate application functionality is blocked
Solution Approach 1:
The system implements a feedback mechanism where application behavior during sandbox execution is monitored and logged, then analyzed to determine appropriate policy decisions. Legitimate operations observed during verification lead to the generation of allow policies, while malicious operations result in block decisions. This feedback-driven approach ensures security assurance by verifying actual behavior while maintaining application functionality through automated policy generation based on observed legitimate operations.
Solution Approach 2:
The application effectively performs self-verification through its own execution in the sandbox environment. By monitoring the application's own behavior during controlled execution, the system allows legitimate functionality to emerge naturally from the verification process. Applications that behave legitimately during sandbox execution automatically receive allow policies, eliminating the need for manual configuration and ensuring both security and functionality.
4Reliability
If virtualized environment verification is implemented, then malicious behavior is detected, but system complexity and verification time increase
Solution Approach 1:
The system maintains continuous monitoring and logging of application operations throughout the sandbox execution phase. Rather than performing discrete security checks, the system continuously captures all file system operations and program element activities, enabling comprehensive malicious behavior detection. This continuous verification approach detects threats reliably while optimizing verification time by processing logs efficiently and generating policies automatically upon completion of the verification phase.
Data Source
AI summary
Provided herein are systems and methods for generating policies for a new application using a virtualized environment. Prior to allowing a new application to operate on a host system, the new application may be installed in a virtual environment. A first program execution restrictor of the virtualized environment may determine a set of policies for the new application. The set of policies may allow the new application to add specific program elements during installation and execution in the virtualized environment. The first program execution restrictor may verify an absence of malicious behavior from the new application while the new application executes in the virtualized environment. The new application may be executed on the host system responsive to the verification. The host system may have a second program execution restrictor that applies the set of policies when the new application is allowed to execute on the host system.