Remote Trusted Execution Environment for Mobile Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current mobile terminal security environments face challenges in providing secure and reliable security services due to complex management, resource limitations, and vulnerability to attacks, especially when the device is switched off, requiring a solution that enhances security, reliability, and ease of administration.
Innovation Solution
Implementing a runtime environment with a normal and secure runtime environment that establishes a communication link via a client/server protocol, where the secure runtime environment is external to the terminal, allowing for secure service requests and responses, even when the device is off, using agents for cryptographic security and key management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the secure runtime environment is implemented on the mobile device itself, then security services can be provided locally with fast response, but the device resources (memory and processing power) are consumed and management becomes complex
Solution Approach 1:
The secure runtime environment is extracted from the mobile device and relocated to a remote server. This extraction removes the burden of managing secure runtime environments from multiple devices, centralizing it on the server side where it can be managed more efficiently and securely, while still providing security services to mobile devices when needed.
2Speed
If security-critical information is stored on the mobile device, then quick access is possible, but the device becomes vulnerable to attacks and manipulation
Solution Approach 1:
Security-critical information is extracted from the mobile device and stored on the remote server instead. This extraction eliminates the vulnerability of storing sensitive data on potentially compromised mobile devices while still enabling quick access through secure communication channels when the device is available.
Solution Approach 2:
A remote server acts as an intermediary between the mobile device and security-critical information. The server mediates access requests, providing security services without requiring sensitive information to be stored locally on the mobile device, thus reducing vulnerability while maintaining access capability.
3Use of energy by moving object
If the device is switched off to save energy, then power consumption is reduced, but security-critical administrative tasks cannot be performed
Solution Approach 1:
The secure runtime environment is extracted from the mobile device and placed on a remote server that remains continuously operational. This allows security-critical administrative tasks to be executed on the server even when the mobile device is powered off, while the device consumes minimal energy in a low-power state.
Solution Approach 2:
The secure runtime environment is pre-established and maintained on the remote server in advance, so that when the mobile device needs to perform security tasks, the infrastructure is already in place and ready to serve requests, eliminating the need for the device to remain powered on continuously.
Data Source
Figure 1
Figure 2
AI summary
The invention relates to a runtime environment for a mobile terminal (D), comprising a normal runtime environment (REE) for client applications (CA) and a secure runtime environment (TEE) for trusted applications (TA). Service requests can be transmitted from the normal (REE) to the secure runtime environment (TEE). In response, security services can be transmitted from the secure (TEE) to the normal runtime environment (REE). The secure runtime environment (TEE) is implemented as an external secure runtime environment (TEEaaS) on a server (S) arranged outside of the terminal. The normal runtime environment (REE) and the external secure runtime environment (TEEaaS) are designed to carry out a client/server protocol between the normal execution environment (REE) and the external secure runtime environment (TEEaaS), for example a remote procedure call, in order to establish the communication connection.