Peripheral Device Trusted Execution Against Untrusted Hosts
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Peripheral devices used for processing sensitive code and data face security challenges due to the untrusted nature of the host computing device, which can compromise the confidentiality and integrity of the sensitive information transferred through it.
Innovation Solution
A peripheral device with a security module configured to create a trusted execution environment (TEE) for processing sensitive data, utilizing encryption units to encrypt and decrypt data, and perform attestation to ensure the sensitive code is correctly installed and executed, along with a key exchange process for secure communication between trusted entities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If peripheral devices are used to process sensitive code and data, then processing efficiency and concurrency are improved, but security and privacy of sensitive information are compromised due to the untrusted host
Solution Approach 1:
The system segments the computing environment into a trusted execution environment (isolated secure region) and an untrusted host environment. Sensitive code is partitioned into isolated segments that can only execute within the trusted boundary, while non-sensitive operations remain in the untrusted host. This segmentation allows efficient processing of sensitive data in the isolated environment while maintaining security isolation from the untrusted host.
Solution Approach 2:
A trusted execution environment acts as an intermediary between the untrusted host and the sensitive code. The host can submit processing requests and receive results through this intermediary without directly accessing the sensitive code. The intermediary verifies and controls all interactions, ensuring that the untrusted host cannot compromise the sensitive information while still enabling efficient processing.
2Productivity
If sensitive code is transferred via the host to the peripheral device, then processing can be offloaded, but the host can potentially obtain and compromise the sensitive information
Solution Approach 1:
The system applies preliminary protective actions by encrypting sensitive code before transfer and establishing security boundaries in advance. The trusted execution environment is pre-configured with security measures that prevent the host from accessing sensitive information during transfer and execution. These preemptive security measures ensure that even if the host is untrusted, the sensitive code remains protected throughout the offloading process.
Solution Approach 2:
Different security qualities are applied to different parts of the system. The sensitive code receives high-level security protection through encryption and isolation, while non-sensitive portions can be transferred and executed with standard security measures. This localized quality approach allows efficient offloading of only the necessary sensitive portions while maintaining appropriate security for each component.
3Reliability
If a trusted execution environment is created on the peripheral device, then security and privacy are protected, but device complexity increases
Solution Approach 1:
The trusted execution environment is implemented as a nested structure within the peripheral device architecture. Security functions are organized in concentric layers with the sensitive code at the core, surrounded by protection mechanisms, and finally integrated with the host interface. This nested organization provides comprehensive security while maintaining a manageable hierarchical structure that reduces overall system complexity.
Data Source
AI summary
A peripheral device, for use with a host, comprises one or more compute elements a security module and at least one encryption unit. The security module is configured to form a trusted execution environment on the peripheral device for processing sensitive data using sensitive code. The sensitive data and sensitive code are provided by a trusted computing entity which is in communication with the host computing device. The at least one encryption unit is configured to encrypt and decrypt data transferred between the trusted execution environment and the trusted computing entity via the host computing device. The security module is configured to compute and send an attestation to the trusted computing entity to attest that the sensitive code is in the trusted execution environment.