Secure Data Storage Architecture Using Shared Encrypted Memory
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing electronic devices face challenges in securely processing and storing sensitive data, particularly in environments where physical attachment/detachment of UICC is not feasible, such as M2M or IoT devices, requiring improved authentication and data security mechanisms.
Innovation Solution
The electronic device employs a dual-processor architecture with a first processor operating in a general non-secure environment and a second processor in a secure environment, along with dedicated memories for secure and non-secure data storage, enabling encryption and secure data management through a trusted application.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If secure data is stored in shared memory accessible by both secure and non-secure environments, then data accessibility and functionality are improved, but security risks increase due to potential unauthorized access
Solution Approach 1:
The patent segments memory into multiple regions with different security attributes: secure memory regions accessible only by the secure environment, non-secure memory regions accessible by the general environment, and shared memory regions with controlled access. This segmentation allows simultaneous optimization of security and accessibility by assigning appropriate access rights to each region.
Solution Approach 2:
The patent introduces a memory management unit (MMU) or buffer as an intermediary between the secure and non-secure environments. This intermediary controls and mediates access to shared memory regions, enabling secure data to be transferred to the non-secure environment only through controlled channels, thus maintaining security while enabling accessibility.
2Reliability
If encryption is applied to secure data, then security is improved, but processing complexity and time increase
Solution Approach 1:
The patent applies encryption preliminarily to secure data before it leaves the secure environment or is stored in shared memory. By pre-encrypting data at the source, the system reduces the need for repeated encryption operations during data processing and transmission, thereby lowering overall processing complexity while maintaining security.
Solution Approach 2:
The patent employs efficient encryption algorithms with optimized parameters, such as selecting appropriate key lengths and encryption modes based on security requirements and performance constraints. This parameter optimization balances security strength with processing efficiency, reducing complexity without compromising security.
3Reliability
If separate secure and non-secure processing environments are maintained, then security isolation is improved, but system complexity and resource requirements increase
Solution Approach 1:
The patent merges the secure and non-secure processing environments into a single integrated system with unified memory space and coordinated processing. This integration reduces system complexity compared to fully separate architectures while maintaining security isolation through software-based security boundaries, controlled access mechanisms, and secure memory management.
Solution Approach 2:
The patent designs a universal processor and memory system that can operate in both secure and non-secure modes. The same hardware resources are multi-functional, serving both secure and general-purpose tasks, thereby reducing the need for duplicate components and lowering overall system complexity while maintaining security isolation through software and control logic.
Data Source
AI summary
An electronic device comprises: a first processor operating in a general non-secure environment; a second processor operating in a secure environment; a first memory allocated to the general non-secure environment; a second memory allocated to the secure environment; and a third memory shared in the general non-secure environment and the secure environment, wherein the second processor is configured to: encrypt at least a portion of secure data to generate an encrypted portion, the secure data generated by a trusted application executed in the secure environment, store the encrypted portion in the third memory, and store first information used to encrypt the at least a portion of the secure data and second information generated while encrypting the at least the portion of the secure data in the second memory, and wherein the first processor is configured to, store the encrypted portion stored in the third memory in the first memory.