Virtual Machine Isolation for Application Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional configurations do not effectively secure downloaded applications and device drivers from malicious access, allowing malicious applications and device drivers to potentially leak or tamper with information from other applications.
Innovation Solution
An information processing device with multiple virtual machines, managed by a virtual machine managing unit that creates separate virtual machines for executing programs, preventing malicious applications and device drivers from accessing information held by other applications, and allowing the use of a common operating system across virtual machines to reduce storage capacity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If downloaded applications and device drivers are allowed to access device resources freely, then application functionality and ease of operation are improved, but security and information protection deteriorate
Solution Approach 1:
The system segments the execution environment by creating separate virtual machines for downloaded applications and device drivers. Each virtual machine is isolated from the host system and other applications, allowing applications to function freely within their own sandboxed environment while preventing unauthorized access to device resources and information.
2Object-affected harmful factors
If execution environments are separated using conventional virtualization, then information security is improved, but device complexity and storage requirements worsen
Solution Approach 1:
The patent implements a common operating system that serves multiple virtual machines simultaneously. This single operating system instance provides core functions (memory management, process scheduling, device abstraction) to multiple isolated application environments, eliminating the need for separate operating system copies in each virtual machine and significantly reducing storage requirements while maintaining security isolation.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A device (110) according to an implementation of the present invention, having a plurality of virtual machines (1002, 1003, 1004, and 1005), includes a virtualization software (1001) which manages the virtual machines. The virtualization software includes an application VM creating unit (1300) which creates a virtual machine for executing a program. A first virtual machine (1002) determines whether a first program is to be executed on the first virtual machine or to be executed on a virtual machine other than the first virtual machine. When the first virtual machine determines that the first program is to be executed on the other virtual machine, the application VM creating unit creates a second virtual machine for executing the first program.