Mobile Media Authentication Using TEE-Governed Editing Phases
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing media authentication and editing systems in mobile devices face security risks due to processing in the Rich Execution Environment (REE), which are exacerbated when no network connection is available, and there is a challenge in maintaining media integrity without cloud-based solutions.
Innovation Solution
Implementing a three-phase processing method using a Trusted Execution Environment (TEE) for media assets, where the first phase allows REE read-only access, the second phase allows REE read-write access, and the third phase reverts to REE read-only access, with TEE ensuring security through perceptual hash validation and timestamp checks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If media processing occurs in the Rich Execution Environment (REE), then processing flexibility and ease of operation are improved, but security and media integrity are compromised
Solution Approach 1:
The system segments media processing into two distinct environments: REE for flexible editing operations and TEE for secure authentication and integrity verification. This segmentation allows each environment to specialize in its strength while mitigating its weaknesses through controlled interaction between the two phases.
Solution Approach 2:
The TEE acts as an intermediary that verifies media authenticity and manages security credentials. It mediates between the REE's editing capabilities and the requirement for media integrity, using perceptual hash validation and cryptographic signatures to ensure trusted media handling.
2Reliability
If cloud-based authentication is used, then media verification capability is improved, but dependency on network connection increases
Solution Approach 1:
The TEE implements self-service authentication by performing all verification operations locally on the device. It uses embedded cryptographic keys and perceptual hash algorithms to authenticate media without requiring external cloud services, enabling offline verification while maintaining security.
3Ease of operation
If REE read-write access is granted for editing, then editing capability is improved, but risk of media tampering increases
Solution Approach 1:
The system performs preliminary authentication in the TEE before allowing REE editing access. By verifying media integrity upfront and establishing a trusted state, the system enables editing while maintaining the ability to detect and prevent unauthorized tampering through continuous integrity monitoring.
Solution Approach 2:
The TEE provides continuous feedback on media integrity during and after REE editing operations. Through perceptual hash comparison and cryptographic verification, the system monitors for tampering and can alert users or reject modified media, creating a feedback loop that maintains security awareness throughout the editing process.
Data Source
AI summary
In general, one aspect disclosed features a media asset capture and processing method, implemented via a computer-based state machine executing on a computer processor, the method comprising: implementing a first phase including media asset capture and frame processing limited to Rich Execution Environment (REE) read-only (RO) frame access; implementing a second phase including processing with REE read-write (RW) frame access; and implementing a third phase including processing with REE read-only (RO) frame access.