Content-based isolation for computing device security
AssigneeMicrosoft Technology Licensing, LLC
InventorsAlexander Nikolaevich Moshchuk, Jiahe H. Wang, Yunxin Liu
Life of this patent
Estimating the term…
Abstract
The subject disclosure is directed towards securing a computing device using content-based isolation. When the computing device requests content data having different ownership, a monitor component identifies and groups trusted portions of the content data into one or more isolation containers such that only trusted programs are permitted access. Other programs are, therefore, untrusted and can be denied access in order to prevent malicious activity, unless access is approved by the content owner.
Claims20
In a computing environment, a method for providing content-based isolation for a computing device performed at least in part on at least one processor, comprising:
- monitoring user activity at the computing device;
- identifying content data corresponding to the user activity;
- accessing at least one isolation container for processing the content data based upon content owner information, wherein each isolation container comprises an execution instance of which a first portion corresponds to trusted content and one or more other portions correspond to one or more trusted programs, the first portion operative to request the trusted content from a remote resource for processing by the one or more trusted programs;
- and
- preventing at least one program outside the isolation container from accessing content data within the isolation container.
In a computing environment, an apparatus, comprising:
- a processing unit;
- a system memory;
- a monitor component executing on the processing unit to secure a computing device from malicious activity, wherein the monitor component is configured to:
- store content owner information for sets of trusted content,
- isolate each set of trusted content within one or more isolation containers,
- request access to data provided by one or more resources using the content owner information,
- process returned content from the one or more resources based upon the content owner information,
- insert the returned content into an isolation container that maintains a content processing stack for the returned content, the content processing stack comprising a top layer corresponding to the returned content and one or more lower layers corresponding to one or more trusted programs, and
- prevent at least one program outside the isolation container from accessing the returned content within the isolation container.
An article of manufacture comprising one or more computer-readable storage devices having computer-executable instructions, which when executed perform steps, comprising:
- processing resource access requests for addressable content that are communicated from computing devices, wherein addressable content is located at a remote resource;
- communicating the resource access requests to the remote resources, the resource access requests comprising header information identifying content owners of content data within an isolation container, the content data corresponding to a portion of the addressable content;
- returning responses to the computing devices that correspond to the resource access requests;
- dispatching the content data to the isolation container that includes at least one trusted program corresponding to a content owner identifier stored in the responses;
- and
- preventing at least one program outside the isolation container from accessing the content data within the isolation container.
Dependencies are inferred from the claim text.