IoT Device Application Authentication via Digital Fingerprint Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
IoT devices face security vulnerabilities due to inadequate protection of encryption/decryption keys, making them susceptible to malicious attacks, even when using trusted execution environments (TEE) like TrustZone.
Innovation Solution
Implementing a method where an authentication agent generates a digital fingerprint of an application, which is verified by a trusted application on a TEE, allowing secure access to a secure storage, thereby enhancing the security and usability of IoT devices by ensuring the integrity of the authentication process.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encryption/decryption technologies are used to protect data, then data security is improved, but the device becomes vulnerable to sham attacks using malware
Solution Approach 1:
The system divides the execution environment into two separate domains: a Rich Execution Environment (REE) for general application execution and a Trusted Execution Environment (TEE) for secure key management and authentication. This segmentation isolates critical security functions from potential malware in the REE, preventing sham attacks while maintaining data security.
Solution Approach 2:
An authentication agent is introduced as an intermediary component that bridges the REE and TEE. The authentication agent generates digital fingerprints of applications in the REE and verifies them against enrolled fingerprints in the TEE, acting as a mediator that prevents direct access to encryption keys while enabling secure authentication.
2Reliability
If a trusted execution environment (TEE) is used to store encryption keys, then key security is improved, but the system remains vulnerable to attacks
Solution Approach 1:
The system performs preliminary authentication by generating and enrolling digital fingerprints of applications before they can access encryption keys. The authentication agent creates a digital fingerprint of the application code and enrolls it in the TEE during a setup phase, establishing a trusted relationship before actual key access is needed, thereby preventing attacks.
Solution Approach 2:
The patent replaces traditional mechanical key protection mechanisms with a cryptographic authentication system. Instead of relying solely on physical security of key storage, the system uses digital fingerprint verification and cryptographic protocols to authenticate applications, substituting physical security measures with software-based cryptographic verification.
3Reliability
If digital fingerprint verification is implemented, then application authentication is improved, but system complexity increases
Solution Approach 1:
The authentication agent performs multiple functions within a single component: it generates digital fingerprints of applications, enrolls them in the TEE, verifies fingerprints during authentication, and manages the authentication workflow. This multi-functionality reduces the need for separate components for each task, thereby limiting the increase in system complexity while maintaining strong authentication.
Data Source
AI summary
A method for operating an electronic device is provided. The method includes generating, by an authentication agent, a digital fingerprint of an application, transmitting, by an authentication agent, the generated digital fingerprint to a trusted application on a trusted execution environment (TEE), verifying, by the trusted application, the digital fingerprint, and permitting, by the trusted application, the application to access a secure storage, when the trusted application succeeds in verifying the digital fingerprint.