Extension Cryptographic Processing via TEE Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cryptographic key management systems face constraints in writing extension programs and are vulnerable to attacks, as the extension programs are loaded into the same memory space, potentially compromising the entire system if a vulnerability is exploited.
Innovation Solution
An extension cryptographic processing method that establishes a secure communication channel between a trusted execution environment (TEE) and an extension program platform, allowing cryptographic operations to be performed externally, reducing the risk of vulnerability spreading and enhancing language flexibility for extension program development.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If extension programs are loaded into the key management system's memory space, then the structure is simple and the encryption key is not exported, but the vulnerability of the extension program may spread to the entire key management system
Solution Approach 1:
The system is divided into two separate execution environments: the key management system (KMS) and the extension program platform (EPP). The KMS runs in a secure trusted execution environment while the EPP runs in a separate environment, allowing extension programs to be isolated from the core key management functions. This segmentation prevents vulnerability propagation while maintaining system functionality.
Solution Approach 2:
A secure communication channel acts as an intermediary between the KMS and EPP. This channel enables controlled interaction and data exchange while maintaining isolation between the two systems. The intermediary mechanism allows the extension programs to access cryptographic functions without compromising the security boundary.
2Device complexity
If extension programs are loaded into the key management system, then the structure is simple, but constraints exist on the language and external modules that can be used
Solution Approach 1:
The extension program execution environment is extracted from the key management system and placed in a separate EPP. This extraction removes the constraints on programming languages and external modules, as the EPP can support diverse languages (Python, Java, C++, etc.) and external libraries without affecting the core KMS architecture.
Solution Approach 2:
The extension program platform is designed with universal support for multiple programming languages and external modules. The platform can load and execute extension programs written in various languages and utilize external libraries, providing versatility while maintaining a relatively simple overall system structure through the separation of concerns.
3Adaptability or versatility
If extension programs are arbitrarily created and installed, then language flexibility is improved, but the probability of vulnerability increases
Solution Approach 1:
By segmenting the system into KMS and EPP with separate execution environments, the patent isolates the vulnerability risk to the EPP. Extension programs can be arbitrarily created and installed in the EPP with language flexibility, but any vulnerabilities are contained within this separate environment and cannot affect the secure KMS.
Solution Approach 2:
The secure communication channel serves as an intermediary that controls the interaction between EPP and KMS. Even though extension programs can be arbitrarily created in the EPP, the intermediary mechanism ensures that only authorized and controlled communications occur, preventing direct access to the KMS and mitigating vulnerability risks.
Data Source
AI summary
Disclosed are an extension cryptographic operation processing system and method. An extension cryptographic operation processing method of a processing device including a trusted execution environment can be performed by at least one processor constituting the trusted execution environment of the processing device.