Secure Display Path via Decryption Module
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Trusted services in mobile applications face vulnerabilities as displayed user information traverses un-trusted host OS environments, making it susceptible to snooping and modification by malware.
Innovation Solution
A secure path is established between a secure element and a display using a display controller with a decryption module, preventing malware from bypassing the decryption functionality and ensuring encrypted data is transmitted securely.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If display information traverses the host OS stack for rendering, then display functionality is achieved, but security is compromised due to vulnerability to snooping and modification by malware
Solution Approach 1:
The display path is segmented into two separate paths: a secure path for trusted services that bypasses the host OS stack, and a regular path for untrusted applications. This segmentation isolates secure data transmission from the untrusted environment, preventing malware from intercepting or modifying secure display information while maintaining overall display functionality.
Solution Approach 2:
A display controller is introduced as an intermediary component that receives encrypted display information from the secure element, decrypts it, and sends it to the display device. This intermediary enables secure data transmission by managing the encryption/decryption process and controlling the data flow between the secure element and display, without requiring the data to traverse the untrusted host OS stack.
2Reliability
If a secure path is established to protect encrypted data transmission, then data integrity is improved, but device complexity increases due to additional security components
Solution Approach 1:
The secure element and display controller are integrated into a unified secure display system where the secure element handles encryption and the display controller handles decryption. This merging of security functions into dedicated hardware components rather than software layers reduces overall system complexity while maintaining strong data integrity protection.
Solution Approach 2:
Data is encrypted in advance by the secure element before being transmitted to the display controller. This preliminary encryption action ensures that data integrity is maintained throughout transmission, and the decryption only occurs at the final destination in a controlled manner, preventing unauthorized access or modification during transit.
3Reliability
If decryption module is made bypass-proof to prevent malware attacks, then security is improved, but ease of operation deteriorates due to restricted access control
Solution Approach 1:
The decryption module implements dynamic access control where the secure element and display controller establish a trusted relationship through cryptographic verification. This dynamic mechanism allows the decryption function to be accessed only when proper authentication and authorization are established, balancing security requirements with operational flexibility for legitimate uses.
Data Source
AI summary
Methods and systems may include a computing system having a display, a display controller with a decryption module, and a security element with security logic. The security logic can be configured to establish a secure path between the secure element and the display in response to a secure output mode request, wherein the secure path includes the display controller. In addition, the security logic may be configured to prevent the decryption module from being bypassed, and transmit encrypted data from the secure element to the display via the secure path.