Secure Element Page Migration for Limited Memory
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The secure element in mobile terminals lacks sufficient memory to accommodate the increasing system image and service requirements due to the inability to directly access larger external storage, leading to inefficiencies in dynamic loading and security risks.
Innovation Solution
The secure element processor divides the secure operating system into multiple pages, performs security processing on each page, and migrates them to external storage for secure execution, ensuring secure loading and execution by using encryption and authentication codes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Quantity of substance
If dynamic loading is implemented to increase memory space for running applications, then the memory capacity is improved, but security risks increase due to potential unauthorized access to external storage
Solution Approach 1:
The secure operating system image is divided into multiple pages, with the first page containing critical security data (authentication codes, encryption keys) and subsequent pages containing the remaining system image. This segmentation allows selective loading and verification of pages, ensuring that even if external storage is compromised, only authorized pages can be executed.
Solution Approach 2:
Security processing (authentication and encryption) is performed on all pages before they are loaded into memory. The processor verifies authentication codes and decrypts pages in advance, ensuring that only verified and authorized content is loaded into the secure element's memory, preventing runtime security violations.
2Reliability
If the secure element uses only internal RAM for running applications, then security is maintained, but the memory capacity is insufficient for growing service requirements
Solution Approach 1:
External storage is introduced as an intermediary between the secure element's limited internal RAM and the need for larger memory capacity. The external storage holds the secure operating system image and application data, while the processor selectively loads verified pages into internal RAM for execution, maintaining security while enabling access to larger storage capacity.
3Speed
If the entire secure operating system image is loaded into internal memory at once, then execution speed is improved, but the memory requirements exceed the available internal RAM space
Solution Approach 1:
The system transitions from a static memory model (loading entire image at once) to a dynamic loading model where pages are loaded on-demand into internal RAM from external storage. This allows the system to maintain fast execution speeds for actively used pages while using external storage for less frequently accessed portions of the operating system image.
Data Source
Figure 1
Figure 2
Figure 3a
AI summary
The present invention provides a secure element (101) and a related device, and relates to the field of mobile communications. The secure element (101) includes a processor (1011) and a memory (1012). The processor (1011) and the memory (1012) are integrated into a semiconductor chip; the memory (1012) is configured to provide a storage space for the processor (1011) to load and run a secure program, the secure program includes an image of a secure operating system, and the image of the secure operating system includes a system image resident segment and a system image dynamic loading segment. When the processor runs the secure operating system, the system image resident segment resides in the memory (1012). The processor (1011) is configured to: divide the system image dynamic loading segment into a plurality of pages, where each of the plurality of pages includes some content of the system image dynamic loading segment; perform security processing on each of the plurality of pages; and migrate each security-processed page to an external storage (108/109) of the secure element.