NFC Module in Trusted Execution Environment for Secure Communication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing NFC communication technologies compromise security by implementing NFC functions within rich execution environments, which can lead to sensitive information being stolen or tampered with during transactions, as they are not securely isolated from insecure environments.
Innovation Solution
Implementing an NFC module within a Trusted Execution Environment (TEE) that only uses part of the traditional protocol stack, allowing for enhanced security and flexibility in NFC communication by separating it from the rich execution environment, and utilizing a virtual NFC module in the rich execution environment to simulate NFC hardware for non-security applications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If NFC function is implemented under rich execution environment, then flexibility and ease of operation are improved, but security and reliability deteriorate
Solution Approach 1:
The NFC system is segmented into two distinct execution environments: a rich execution environment (REE) for non-security applications requiring flexibility, and a trusted execution environment (TEE) for security-sensitive operations. This segmentation allows each environment to operate independently with appropriate security levels, resolving the contradiction between operational flexibility and security reliability.
Solution Approach 2:
A virtual NFC module acts as an intermediary between the REE and TEE. It receives requests from the REE, forwards security-sensitive operations to the TEE, and returns results. This intermediary mechanism enables the REE to maintain flexibility while the TEE ensures security, allowing both requirements to coexist.
2Adaptability or versatility
If complete traditional NFC protocol stack is implemented in TEE, then NFC functionality is improved, but storage load and device complexity increase
Solution Approach 1:
Only the essential security-related components of the NFC protocol stack are extracted and implemented in the TEE (such as key management, secure authentication, and encrypted data processing). Non-security-critical components remain in the REE, reducing the storage load and complexity of the TEE while maintaining complete NFC functionality through the collaboration between both environments.
3Reliability
If NFC module is set in TEE, then security is improved, but communication flexibility and adaptability may be reduced
Solution Approach 1:
The system merges the strengths of both execution environments by combining the TEE's security capabilities with the REE's flexibility and adaptability. The virtual NFC module orchestrates this merger, allowing the system to leverage secure processing when needed while maintaining full access to diverse NFC applications and protocols through the REE, thus achieving both security and flexibility simultaneously.
Data Source
Figure 1~2
AI summary
The present invention discloses a NFC-based communication apparatus, comprising: a NFC module set in a trusted execution environment of the communication apparatus, the trusted execution environment being independent of a rich execution environment of the communication apparatus, the NFC module comprises a communication module, which is used for establishing a connection with another NFC apparatus, and a protocol module, which is used for resolving the communication data between the communication apparatus and the another NFC apparatus.