Mobile Messaging Encryption via Trusted Execution Environment
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current messaging systems, such as SS7 and RCS, lack end-to-end encryption, making them insecure for transmitting sensitive information like One-Time Passwords (OTPs), which are crucial for authentication in financial and healthcare applications.
Innovation Solution
Implementing public/private key encryption within a trusted execution environment (TEE) on mobile devices, where a trusted application generates a key pair, stores the private key securely, and uses the public key to encrypt messages, ensuring secure transmission and decryption only on the subscriber device.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional SS7 and RCS messaging protocols are used for message transmission, then message delivery ubiquity and compatibility are achieved, but message security and encryption capability deteriorate
Solution Approach 1:
The patent embeds a Trusted Execution Environment (TEE) within the mobile device's existing operating system and hardware architecture. The TEE acts as a nested secure container that hosts cryptographic operations without requiring complete system redesign. This allows traditional SS7/RCS messaging infrastructure to remain unchanged while adding encryption capabilities through the nested TEE layer, resolving the contradiction between maintaining protocol compatibility and enhancing security.
Solution Approach 2:
The patent introduces a Trusted Application (TA) as an intermediary layer between the messaging application and the TEE hardware. The TA manages key generation, storage, and cryptographic operations, mediating between the high-level messaging needs and the low-level hardware security features. This intermediary approach enables secure messaging without requiring direct modification of existing messaging protocols or infrastructure.
2Reliability
If public/private key encryption is implemented in a trusted execution environment, then end-to-end message encryption is achieved, but device complexity and provisioning overhead increase
Solution Approach 1:
The patent implements automatic key pair generation and provisioning within the TEE when the device is first activated or when the messaging application is installed. The system self-configures the cryptographic infrastructure without requiring manual user setup or complex administrative provisioning. The Trusted Application automatically manages the lifecycle of cryptographic keys, including generation, storage, and rotation, making the complex encryption system transparent and simple to use for end users.
3Reliability
If private keys are stored securely in a trusted execution environment, then decryption security is improved, but access control complexity increases
Solution Approach 1:
The patent designs the Trusted Execution Environment to provide universal cryptographic services that can be accessed by multiple applications and messaging protocols through a standardized interface. The TEE's key management system is not application-specific but provides general-purpose cryptographic operations that serve SMS, RCS, and other messaging formats uniformly. This multi-functional approach reduces the need for separate key management systems for different messaging types, thereby reducing overall system complexity while maintaining high security standards.
Data Source
AI summary
This invention provides a method and system for secure messaging on a mobile network, leveraging public/private key encryption. The method includes steps for deploying a trusted application by a mobile carrier on a device with a Trusted Execution Environment (TEE). A wireless Software Development Kit (SDK) on the subscriber device interacts with the trusted application and a wireless original equipment manufacturer (OEM) cloud service for mutual attestation, confirming the identity and trustworthiness of the device. A pair of public and private keys are generated, with the private key secured on the device. Messages are encrypted with the public key at a cloud messaging application, and decrypted with the private key at the device, enabling secure, viewable messages. The system can support secure transmission of one-time-passwords (OTPs) from an enterprise application, as well as encrypted chat functionality for device responses to the enterprise application.