Encrypted Code Deployment in a TEE for Trust Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
There is a lack of trust in technology supplied by third-party vendors due to the reluctance of vendors to allow open inspection or auditing, which is critical for ensuring the quality, safety, and security of the technology, particularly in sensitive infrastructure like telecommunications.
Innovation Solution
A trusted execution environment (TEE) is used to receive and decrypt encrypted source code, analyze it for trust metrics, and compile executable code without revealing the decrypted source code externally, allowing recipients to trust the technology without needing direct trust in the vendor.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the vendor allows open inspection or auditing of the source code, then the recipient can verify the quality, safety, and security of the technology, but the vendor's intellectual property is exposed and potentially compromised
Solution Approach 1:
The patent introduces a trusted execution environment (TEE) as an intermediary between the vendor and recipient. The TEE securely receives the source code, performs verification and analysis, and generates verification reports without exposing the actual source code to the recipient. This mediator enables trust verification while protecting intellectual property.
Solution Approach 2:
The patent extracts the verification and analysis functions from the source code itself and performs them within the isolated TEE environment. The TEE extracts necessary verification information (trust metrics, security properties) without revealing the underlying source code to external parties.
2Loss of information
If the vendor protects their intellectual property by not allowing access to source code, then the recipient cannot verify the functionality, safety, or security of the supplied technology
Solution Approach 1:
The TEE acts as a trusted intermediary that the recipient can rely on for verification. Instead of requiring direct access to source code, the recipient trusts the TEE's verification process and its generated reports, which provide sufficient assurance of technology quality without exposing IP.
Solution Approach 2:
The TEE provides feedback in the form of verification reports and trust metrics that inform the recipient about the quality, safety, and security of the supplied technology. This feedback mechanism enables verification without direct source code access.
3Reliability
If conventional auditing approaches are used to verify functionality and safety, then the auditing process can confirm standards compliance, but security issues require additional trusted third party examination
Solution Approach 1:
The patent merges functionality verification, safety verification, and security verification into a single unified TEE process. The TEE simultaneously performs code analysis, security scanning, and trust metric generation, eliminating the need for separate auditing and third-party examination processes.
Data Source
AI summary
A method of operating a trusted execution environment for analysing source code from a third-party vendor is disclosed. The method comprises receiving an encrypted source code and using a secure key stored within the trusted execution environment to decrypt the encrypted source code to produce a decrypted source code. The decrypted source code is analyzed to determine a trust metric for the decrypted source code. The decrypted source code is disallowed from being communicated to an external entity outside of the trusted execution environment.