Secure Element TUI Interaction via Trusted Execution Environment
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing TEE+SE security architecture requires different trusted applications (TAs) to be developed for different services, increasing service development difficulty when an applet in the Secure Element (SE) needs to interact with a user in sensitive service scenarios, as it lacks the capability to interact with users directly.
Innovation Solution
An interaction method where an applet in the SE determines a TUI identifier to identify a TUI template, sends a TUI call request to a TUI agent, which then instructs the Trusted Execution Environment (TEE) to draw an image based on the template, allowing user interaction without the need for multiple TAs, thereby reducing service development complexity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If different TAs are developed for different services in the TEE+SE security architecture, then user interaction capability is provided, but service development difficulty increases
Solution Approach 1:
The patent introduces a universal TUI template mechanism that can be shared across multiple services. Instead of developing separate TAs for each service, a single TUI template can serve multiple services through parameterized configuration. The TUI agent in the SE device can dynamically instantiate different service interfaces using the same template, thereby providing user interaction capability across diverse services without increasing development complexity.
Solution Approach 2:
The patent introduces a TUI agent as an intermediary component in the SE device that mediates between the applet and the TUI template. The TUI agent handles the complexity of template instantiation, parameter binding, and interface rendering, allowing service developers to focus on business logic while the agent manages the interaction framework. This intermediary absorbs the development complexity, making the system easier to operate.
2Reliability
If a dedicated TA is installed in the TEE for each service, then secure user interaction is achieved, but service development time increases
Solution Approach 1:
The patent pre-configures TUI templates with all necessary security parameters, interface structures, and interaction logic before service deployment. The templates are prepared in advance with placeholder parameters that can be dynamically bound to specific services. This preliminary preparation eliminates the need for time-consuming TA development and customization for each new service, while maintaining security through pre-validated template structures.
Solution Approach 2:
The patent enables service developers to reuse existing TUI templates across multiple services through parameterized copying. Instead of creating new TAs from scratch for each service, developers can instantiate copies of validated templates with service-specific parameters. This copying mechanism dramatically reduces service development time while maintaining security through the use of proven, pre-audited template structures.
3Adaptability or versatility
If multiple TAs are developed for different services, then specific TUI functions are provided, but the number of components increases
Solution Approach 1:
The patent designs TUI templates with universal structures that can accommodate multiple service types through parameterized configuration. A single template framework can render different service interfaces (payment, transit, authentication, etc.) by binding different parameters, eliminating the need for separate TAs for each service function. This universal template approach maintains high adaptability while minimizing the number of components.
Solution Approach 2:
The patent merges the functionality of multiple service-specific TAs into a single unified TUI template system. The TUI agent consolidates the roles of multiple TAs by dynamically selecting and instantiating appropriate template configurations based on service requirements. This merging reduces the total number of components from many service-specific TAs to a single reusable template framework plus the TUI agent.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
An interaction method and an apparatus are provided. The method is applied to an SE disposed in a terminal. The method includes: receiving a service request from a CA (201), where the CA is an application that is installed on the terminal and that runs in an REE; determining a to-be-used TUI identifier (202); sending a TUI call instruction carrying the TUI identifier to a TEE (204), where the TUI call instruction is used to indicate the TEE to obtain a stored TUI template or TUI function module corresponding to the TUI identifier, drawing an image based on the TUI template or the TUI function module (205), and calling a TUI to display the drawn image (206); receiving response information from the TEE (207), where the response information is information entered by a user for the displayed image by using the TUI or information generated by the TEE based on interaction between the user and the image displayed by the TUI (208); and executing a corresponding service procedure based on the response information (209). In this way, service development difficulty can be reduced.