Secure Element Host Memory Segmentation for NFC Scalability
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional NFC-enabled mobile devices face scalability issues with integrated non-volatile memory in their Secure Elements (SEs), limiting the number of NFC applications that can be securely stored and executed, and are vulnerable to attacks due to the lack of secure storage and execution environments for sensitive data.
Innovation Solution
The proposed solution involves storing and executing NFC applications using an embedded Secure Element (eSE) with non-volatile memory external to the eSE, where code and state data are encrypted and decrypted as needed, and using a secure element replay counter to prevent replay attacks, allowing for secure and scalable storage and execution of multiple NFC applications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If integrated non-volatile memory is used in the Secure Element, then security protection is provided, but scalability is limited and manufacturing process options are restricted
Solution Approach 1:
The patent divides the storage system into two separate components: a secure element for security-sensitive operations and host non-volatile memory for scalable storage. The secure element contains only the security-critical processing logic, while application data and code are stored externally in the host memory, allowing the system to scale without compromising security.
Solution Approach 2:
The patent extracts the non-volatile memory from the secure element architecture and places it in the host system. This extraction allows the secure element to maintain its security properties while the host system provides scalable storage capacity, resolving the contradiction between security and scalability.
2Reliability
If integrated non-volatile memory is used in the Secure Element, then security is maintained, but manufacturing process scalability is reduced
Solution Approach 1:
By segmenting the secure element from the non-volatile memory, the patent allows each component to be manufactured independently using optimal processes. The secure element can be manufactured using specialized secure processes while the host memory uses standard scalable processes, improving overall manufacturing flexibility.
3Adaptability or versatility
If NFC applications are stored in host non-volatile memory, then scalability is improved, but security vulnerability increases
Solution Approach 1:
The patent introduces the secure element as an intermediary between the host memory and the NFC application execution. The secure element verifies and protects the execution of applications stored in host memory, allowing scalable storage while maintaining security through the mediating protective layer.
Solution Approach 2:
The secure element performs preliminary security verification of applications before they are executed, even though the applications are stored in the less secure host memory. This preliminary action ensures that security checks occur before potential vulnerabilities can be exploited.
4Adaptability or versatility
If more NFC applications are stored in the Secure Element, then application variety increases, but memory capacity requirements increase
Solution Approach 1:
The patent segments the storage capacity requirements from the secure element to the host system. The secure element maintains only the minimal memory needed for security operations, while the host system provides the additional capacity needed for multiple applications, allowing application variety to increase without increasing secure element memory capacity.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Embodiments of a security architecture for securely storing applications, such as Near Field Communication (NFC) applications, in host memory of a mobile device are provided. The mobile device includes a host application processor, a non-volatile memory, a NFC controller, and an embedded Secure Element (eSE). The eSE is configured to encrypt code and state data associated with a NFC application; store the code and the state data, after having been encrypted, in the non-volatile memory as a binary large object (blob); load the blob from the non-volatile memory in response to an action performed by the host application processor or the NFC controller; decrypt and authenticate the code and the state data; and execute the code to exchange data with a contactless communication device via the NFC controller. The non-volatile memory is external to the eSE.