Workspace Manager for Enterprise Application Security Isolation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Enterprises face security vulnerabilities as applications installed on devices can potentially allow unauthorized access to enterprise resources, despite existing security measures like SDKs and application wrapping, which require access to modify and repackage applications.

Innovation Solution

A managed application package is generated that includes a loader to initiate the execution of target applications and an enforcer to monitor compliance with specified rules, preventing unauthorized actions and isolating enterprise resources from personal workspaces.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If security libraries are integrated into applications using SDKs, then application security is improved, but application complexity and redistribution requirements increase

Engineering Contradiction:

Improveapplication securityVSAvoidapplication complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent introduces a workspace manager as an intermediary component that runs independently of the target application. This manager enforces security policies and compliance rules without requiring modification of the original application code, thus improving security while avoiding the complexity and redistribution issues associated with integrating security libraries directly into applications.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If applications are wrapped with security libraries, then application security is improved, but access to modify and repackage applications is required

Engineering Contradiction:

Improveapplication securityVSAvoidease of deployment

Core Design Contradiction:

ReliabilityVSEase of manufacture

Solution Approach 1:

The patent segments the security functionality from the application itself by creating a separate managed application package that includes both the target application and the enforcer component. This allows the application to be deployed in its original form while security enforcement is handled by the separate package, eliminating the need to modify and repackage the original application.

Inventive Principle:

Principle #1Segmentation

3Reliability

If multiple workspaces are created for resource isolation, then security isolation is improved, but device resource management complexity increases

Engineering Contradiction:

Improvesecurity isolationVSAvoidresource management complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent merges the application execution environment with the security enforcement mechanism by creating a unified managed application package. This package automatically creates and manages isolated workspaces when the application is installed, combining resource isolation functionality with the application distribution process and reducing the perceived complexity for users.

Inventive Principle:

Principle #5Merging (Combining)

Data Source

PatentEP3298534B1Creating multiple workspaces in a device

Publication Date: 2020.07.22 AIRWATCH LLC

Figure 1
Figure 2~3
Figure 4

AI summary

Embodiments relate to a system that includes a managed application and a workspace manager that are executable by a computing device. The workspace manager obtains a component invocation message from the managed application and determines whether the component invocation message is intended to invoke a public component in a workspace managed by the workspace manger. The workspace manager provides an instruction to the managed application in response to determining whether the component invocation message is intended to invoke the public component in the workspace managed by the workspace manager.