VM Isolation for Untrusted Code via Dynamic Micro-virtualization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cyber-security infrastructure is insecure due to a mismatch in user interaction models and lack of appropriate isolation of code and data from trusted and untrusted sources in modern computer systems, leading to vulnerabilities that can be exploited by cyber-criminals, especially in internet-connected devices.
Innovation Solution
Implementing dynamic operating system micro-virtualization with multiple independent virtual machines, where a trusted virtual machine (VMO) serves as the root of trust, and untrusted code is executed in separate virtual machines (UCVMs) with restricted access to prevent malicious code from compromising the system, while maintaining compatibility with typical usage scenarios.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If code and data from different sources are allowed to run on a general purpose system, then system versatility and functionality are improved, but security and isolation are worsened
Solution Approach 1:
The system segments code and data into trusted and untrusted sources using virtual machine isolation. Each source operates in its own isolated environment, allowing multiple sources to coexist without compromising security. The virtual machine manager creates separate execution contexts that prevent untrusted code from accessing or affecting trusted system components.
Solution Approach 2:
A virtual machine manager acts as an intermediary between trusted and untrusted code sources. This mediator layer provides controlled access and enforcement of isolation policies, allowing versatile system functionality while maintaining security boundaries. The intermediary manages resource allocation and access control between different code sources.
2Reliability
If virtual machines are used to isolate untrusted code, then security is improved, but system complexity and management overhead are worsened
Solution Approach 1:
The virtual machine manager automatically identifies and isolates untrusted code sources without requiring manual user configuration. The system self-services by dynamically creating virtual machine instances for untrusted code, managing their lifecycles automatically, and enforcing isolation policies without increasing user-facing complexity.
Solution Approach 2:
The virtual machine manager provides universal functionality by handling multiple types of untrusted code sources (web applications, plugins, scripts) through a single unified interface. This multi-functional approach simplifies management by providing consistent isolation mechanisms across different code types rather than requiring separate management for each source.
3Reliability
If manual virtual machine management is required, then security control is improved, but user experience and ease of operation are worsened
Solution Approach 1:
The system automatically performs security control functions without user intervention. The virtual machine manager monitors incoming code, determines trust levels, and creates appropriate isolation environments automatically. This self-service approach maintains strong security controls while presenting a simple, seamless user experience without manual configuration or awareness of the underlying complexity.
Data Source
AI summary
Approaches for transferring data to a client by safely receiving the data in or more virtual machines. In response to the client determining that digital content, originating from an external source, is to be received or processed by the client, the client identifies, without human intervention, one or more virtual machines, executing or to be executed on the client, into which the digital content is to be stored. In doing so, the client may consult policy data to determine a placement policy, a containment policy, and a persistence policy for any virtual machine to receive the digital content. In this way, digital content, such as executable code or interpreted data, of unknown trustworthiness may be safely received by the client without the possibility of any malicious code therein from affecting any undesirable consequence upon the client.