Mobile Data Encryption with TEE-Isolated Master Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing encryption methods for mobile applications are vulnerable to key extraction and reverse engineering, leading to security risks, as the keys are often pre-embedded in the code and lack independent protection, making them susceptible to static analysis and illegal decryption.
Innovation Solution
A data encryption and decryption method utilizing a trusted execution environment (TEE) to generate one-time security data, where the primary key is stored and managed in a secure, isolated region, ensuring the security data is generated and used only once, preventing reverse cracking and illegal access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the primary key is pre-embedded in the application code for encryption, then the encryption function can be implemented, but the key becomes vulnerable to extraction and reverse engineering
Solution Approach 1:
The patent extracts the primary key from the application code and stores it separately in a trusted execution environment (TEE). The TEE generates security data by encrypting reference data with the primary key, but the primary key itself never leaves the TEE. This separation prevents attackers from extracting the key through reverse engineering of the application code.
Solution Approach 2:
The patent introduces the trusted execution environment as an intermediary between the application and the primary key. The TEE acts as a secure mediator that handles key management and security data generation without exposing the primary key to the untrusted execution environment. This intermediary layer protects the key while enabling encryption functionality.
2Reliability
If the primary key is stored in a trusted execution environment to prevent extraction, then security is improved, but the system complexity increases
Solution Approach 1:
The trusted execution environment is self-contained and autonomously manages the primary key and security data generation. It provides self-service capabilities for key protection, encryption, and decryption without requiring external security infrastructure. This reduces the need for additional complex security systems while maintaining high security standards.
3Reliability
If one-time security data is generated for each encryption operation, then decryption security is improved, but computation overhead increases
Solution Approach 1:
The patent performs preliminary actions by pre-generating and storing reference data in the untrusted execution environment before actual encryption is needed. The reference data is prepared in advance and can be quickly combined with security data during encryption operations. This preliminary preparation reduces the computational burden during actual encryption while maintaining the security benefits of one-time security data.
Data Source
Figure 1~2
Figure 3~4
Figure 5
AI summary
Disclosed in embodiments of the present application are a data encryption method and apparatus, a data decryption method and apparatus, a terminal, and a storage medium. The data encryption method comprises: in a non-trusted execution environment, determining source data requested to be encrypted by an application; in the non-trusted execution environment, generating reference data corresponding to the source data; in a trusted execution environment, reading a master key generated for the application; in the trusted execution environment, encrypting the reference data by using the master key to obtain security data; and in the non-trusted execution environment, encrypting the source data by using the security data to obtain target data.