App-Based Identity Module for Secure App-to-App Trust
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computing devices face challenges in ensuring app-to-app secure communication and mutual trust, as secure elements or TEEs are vulnerable to tampering when the operating system is compromised, leading to trust gaps and potential misuse.
Innovation Solution
A secure module cryptographically binds to an application to verify its integrity statically and dynamically, using cryptographic bonds based on app-checksums and digital signatures, and processes actions through a cryptographic sandbox to ensure authenticity and trust attributes are maintained.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a secure element or TEE is used as a common resource shared among all apps, then cryptographic operations can be performed, but the system is vulnerable to tampering when the operating system is compromised
Solution Approach 1:
The patent divides the secure element into application-specific secure environments, where each authenticated application receives a dedicated cryptographic bond and isolated secure computing resources. This segmentation prevents a compromised application from affecting other applications or the overall secure element, resolving the vulnerability to OS compromise while maintaining cryptographic security.
2Adaptability or versatility
If apps are allowed to communicate freely, then collaboration and data exchange can occur, but malicious third parties can tamper with apps to circumvent licensing or redirect authorizations
Solution Approach 1:
The patent implements preliminary authentication and cryptographic bond establishment before any app-to-app communication occurs. The secure module verifies application integrity and establishes trusted relationships in advance, creating cryptographic bonds that prevent tampering and ensure that only authenticated applications can communicate securely, thus preventing malicious circumvention of licensing or authorization.
3Ease of operation
If the operating system enforces access control to the secure element, then resource management is simplified, but the secure element cannot detect when the OS or apps are compromised
Solution Approach 1:
The patent implements continuous feedback mechanisms where the secure module monitors application integrity through cryptographic verification and behavioral analysis. The system provides real-time feedback on the authenticity of applications attempting to access the secure element, enabling detection of compromise while maintaining OS-managed access control. This feedback loop allows the secure element to identify and reject compromised applications without requiring complex OS-level access control changes.
Data Source
AI summary
This document discloses a module and method for establishing application-to-application (app-to-app) mutual trust so that exchange of information and data between applications takes place in a secure manner. This document discloses a secure module that comprises an identification and trusted-storage modules. The identification module is configured to establish a cryptographic bond between an application provided within a standard operating system of a computing device and the secure module. Secure communication may then be established between the application and the secure module. The application may then make use of the cryptographic keys in the secure module to establish secure communications with other applications. The integrity of the application is authenticated based on the cryptographic bond and information contained in the trusted-storage module. The application may then proceed to process an action as an authenticated application bearing a set of trust attributes issued by a trusted third party.