Virtual Machine Authentication Isolation for Secure Data Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data security technologies face issues with password leakage and unauthorized access, particularly in file-specific encryption, leading to potential data exposure and loss of control over encrypted documents.
Innovation Solution
Implementing a virtual machine architecture with a hypervisor to manage authentication, where a host operating system identifies user inputs and sets control authority to a guest operating system, performing external authentication procedures to secure data access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If file-specific encryption technology is used to secure data, then data security is improved, but password leakage risk increases during password transformation
Solution Approach 1:
The system segments the authentication process into two separate virtual machines: the first VM handles the host operating system and application execution, while the second VM (trusted VM) handles password transformation and authentication. This segmentation ensures that the password transformation process is isolated in a secure environment, preventing password leakage while maintaining data security.
Solution Approach 2:
The patent introduces a trusted virtual machine as an intermediary between the user and the encrypted data. This trusted VM performs the password transformation and authentication processes in a secure, isolated environment, acting as a mediator that prevents direct exposure of passwords to the host system or external attackers, thereby eliminating password leakage risks while maintaining encryption security.
2Ease of operation
If user passwords are shared for encrypted file access, then data accessibility is improved, but unauthorized processing and distribution by users increases
Solution Approach 1:
The system performs preliminary authentication and authorization checks within the trusted virtual machine before allowing any data access or processing. The trusted VM verifies user credentials and establishes controlled access permissions in advance, ensuring that even authenticated users can only perform authorized operations on the decrypted data, thereby preventing unauthorized processing and distribution while maintaining accessibility.
Solution Approach 2:
The trusted virtual machine implements a feedback mechanism that continuously monitors and controls data access operations. After authentication, the system provides feedback to users about their authorized actions and actively prevents any operations that exceed their permissions. This real-time feedback and control mechanism ensures data accessibility for authorized users while blocking unauthorized processing and distribution attempts.
3Reliability
If a hypervisor-based virtual machine architecture is implemented for authentication, then authentication security is improved, but system complexity increases
Solution Approach 1:
The patent utilizes virtual machine copying technology to create isolated authentication environments. Instead of building a completely new complex authentication system from scratch, the system copies and configures existing virtual machine infrastructure to serve as a trusted authentication VM. This approach leverages proven virtualization technologies while maintaining authentication security, reducing the complexity burden compared to designing a novel authentication architecture.
Data Source
AI summary
A method for authentication using a virtual machine by an electronic device is provided. The method includes identifying, in a first virtual machine in which a host operating system (OS) is implemented, a user input for an application or data requiring authentication, in response to the user input, setting, by the first virtual machine through a hypervisor, a control authority for the application or the data to a second virtual machine in which a guest operating system (OS) is implemented, and performing, based on control of the second virtual machine, an external authentication procedure for the application or the data, wherein the hypervisor is a platform for concurrently executing the host OS and the guest OS on the electronic device.