Hybrid TEE Android Security Framework for Dynamic Task Offloading
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing Android devices using TrustZone technology face limitations in updating security services, require pre-designed hardware, and suffer performance degradation due to limited resource allocation and frequent memory mapping, especially when processing tasks that require large computations.
Innovation Solution
A hybrid trusted execution environment is implemented using a virtualized trusted execution environment (VTEE) within the rich execution environment (REE), allowing for dynamic task execution between the VTEE and TEE based on computation needs, enabled by container technology and Over-the-Air updates, without pre-provisioning hardware resources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If TrustZone technology is used to implement TEE by isolating hardware resources, then security task processing is enabled, but hardware performance degrades due to frequent memory mapping and NS bit switching
Solution Approach 1:
The patent segments the execution environment into multiple modes (user mode, kernel mode, TEE mode) that can be dynamically switched. The containerized TEE environment divides security task processing into discrete, isolated units that can be managed independently, reducing the overhead of frequent context switching and memory mapping operations.
Solution Approach 2:
The patent introduces a container management service and intermediary layers that mediate between applications and the TEE environment. This intermediary architecture reduces direct interactions requiring memory mapping and NS bit switching, as the container layer handles task scheduling and resource management, minimizing the frequency of hardware-level context transitions.
2Reliability
If TEE is pre-designed at device fabrication level using TrustZone, then trusted execution environment is established, but subsequent security service updates become very difficult
Solution Approach 1:
The patent implements a dynamic TEE environment using containerization technology that allows security services to be updated, installed, and removed at runtime. The containerized architecture enables flexible deployment of security services without requiring hardware reconfiguration, making the system adaptable to new security requirements while maintaining the trusted execution environment.
Solution Approach 2:
The patent creates a universal containerized TEE framework that can host multiple different security services and applications. The standardized container interface allows various security services to be deployed on the same hardware platform, enabling the system to perform multiple security functions and be updated with new services without changing the underlying hardware architecture.
3Reliability
If TEE isolates a smaller amount of resources than REE, then hardware isolation is achieved, but performance degrades when executing tasks requiring large computations
Solution Approach 1:
The patent implements a nested architecture where containerized TEE environments are embedded within the Android operating system's execution environment. This nesting allows the TEE to access additional computational resources from the host system when needed, while maintaining isolation for security-critical operations. The container can dynamically allocate resources from the parent environment, enabling large computations without sacrificing hardware isolation.
Solution Approach 2:
The patent adds a virtualization dimension to the traditional hardware isolation model. Instead of relying solely on hardware-level resource partitioning, the system introduces a software-based virtualization layer that creates additional resource dimensions. This allows the TEE to access pooled computational resources dynamically while maintaining security boundaries, effectively increasing computational capability without compromising isolation.
Data Source
AI summary
Provided is a hybrid trusted execution environment based android security framework, an android device equipped with the same and a method of executing a trusted service in the android device. The hybrid trusted execution environment based android security framework includes a hardware resource that comprises a rich execution environment (REE) where an android operating system (OS) runs, and a secure container which implements a virtualized trusted execution environment (VTEE) that processes a security task in the rich execution environment (REE) when an application running on the rich execution environment requests the security task.