NFC Wallet Data Backup with SE–TEE Key Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data backup and restoration methods lack sufficient security measures, allowing unauthorized access and decryption of sensitive data by third parties or mobile devices, compromising user privacy.
Innovation Solution
A data encryption and decryption method utilizing a secure element (SE) and trusted execution environment (TEE) with multiple key factors generated by trusted service managers and servers to encrypt and decrypt sensitive data, ensuring only authorized parties can access the data during backup and restoration processes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If data is encrypted using a single backup key for cloud backup, then backup simplicity is improved, but security is worsened because unauthorized parties can decrypt the data
Solution Approach 1:
The backup key is segmented into multiple key factors (first key factor from TSM, second key factor from card server, third key factor from cloud server). Each key factor is stored separately in different secure entities (SE, TEE, cloud server), and none of them alone can decrypt the encrypted data. This segmentation resolves the contradiction by maintaining security while enabling simple backup operations through coordinated key combination during restoration.
2Reliability
If multiple key factors are used for data encryption, then data security is improved, but system complexity is worsened
Solution Approach 1:
The patent introduces a trusted service manager (TSM) as an intermediary that coordinates the distribution and management of key factors between the secure element, TEE, and cloud server. The TSM simplifies the complex key management process by providing a trusted intermediary that handles key factor generation, distribution, and combination, thereby maintaining security without proportionally increasing system complexity.
Solution Approach 2:
The secure element (SE) and trusted execution environment (TEE) autonomously perform key factor generation, storage, and combination operations without requiring external intervention for each cryptographic operation. The system components self-manage their respective key factors and automatically combine them during data restoration, reducing the operational complexity burden on the overall system.
3Speed
If all key factors are stored in one location for easy retrieval, then access speed is improved, but security is worsened due to single point of failure
Solution Approach 1:
Key factors are segmented and distributed across multiple secure storage locations: the first key factor is stored in the secure element (SE), the second key factor is stored in the trusted execution environment (TEE) of the cloud server, and the third key factor is stored in the TEE of the electronic device. This spatial segmentation maintains security through distributed storage while enabling fast access through parallel retrieval operations during data restoration.
Solution Approach 2:
The key factors are pre-generated and pre-stored in their respective secure locations before data encryption or restoration operations are needed. The TSM pre-distributes key factors to appropriate storage locations during initial setup, and the system maintains readiness for fast retrieval by keeping key factors in accessible secure memory, thereby achieving both security and speed without requiring real-time key generation.
Data Source
Figure 1~2
Figure 3(a)
Figure 3(b)
AI summary
This application provides a data encryption method, a data decryption method, a secure data backup method, a secure data restoration method, and an electronic device. A process of backing up NFC card data written into a Huawei wallet application is used as an example. Different types of data packets in the card data are separately encrypted by using a secure element SE and a trusted execution environment TEE. In the encryption process, a user and a third-party card data provider are introduced, and are separately responsible for generation, storage, and delivery of one of key factors. Then, a real backup key is generated with reference to a key factor provided by a mobile phone party. After being encrypted in the SE and the TEE by using the backup key, the card data is uploaded to a cloud server for backup. In the method, a plurality of parties are involved, so that backup data of the user cannot be independently decrypted by the mobile phone party, the third-party card data provider, or a trusted third party including the Huawei wallet application. This ensures data backup security in the SE and the TEE.