Secure Element Isolating User ID Data From Main Processor
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing technologies face challenges in securely storing and managing sensitive user ID information on mobile devices, particularly in ensuring that this information is accessible only to trusted applications and hardware while preventing unauthorized access.
Innovation Solution
The implementation of a secure hardware portion on mobile devices, referred to as the Enhanced Secure Element (eSE), which isolates sensitive user ID information and allows access only through trusted applications and processors. This secure area is not accessible by the main processors or most applications, including the operating system, and is protected against tampering and man-in-the-middle attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If sensitive user ID information is stored in the main memory of a mobile device, then accessibility and ease of operation are improved, but security and protection against unauthorized access deteriorate
Solution Approach 1:
The mobile device is divided into two separate memory systems: main memory for general operations and a secure element for storing sensitive user ID information. This segmentation isolates critical data from potential threats in the main system while maintaining controlled access through trusted applications and processors.
2Reliability
If sensitive user ID information is stored in a secure element, then security and protection against attacks are improved, but accessibility and ease of operation deteriorate
Solution Approach 1:
A trusted application acts as an intermediary between the secure element and external requests. This mediator verifies the authenticity of requesting devices through certificate validation and controls access to user ID information, maintaining security while enabling legitimate operations.
3Reliability
If the secure hardware portion is isolated from main processors, then protection against tampering and attacks is improved, but device complexity increases
Solution Approach 1:
The hardware architecture is segmented into a main processor system and a separate secure element with its own processor and memory. This physical separation protects sensitive operations from tampering while the standardized secure element design keeps implementation complexity manageable.
Data Source
AI summary
In one embodiment, a method includes receiving, at a mobile device of a user and from a server device having a database of trusted reader devices, one or more trusted reader root certificates, each pertaining to one or more particular trusted reader devices. The method further includes receiving, at the mobile device, a request from an external device to provide information regarding the user's identity, wherein this information is stored in a secure hardware portion of the mobile device; receiving, at the mobile device, a certificate chain from the requesting external device; evaluating the received certificate chain relative to one or more trusted reader root certificates; and in response to a determination that the received certificate chain matches a trusted reader root certificates, then granting, to a trusted application on the mobile device, access to the information regarding the user's identity.