Secure Execution Environment Hash Validation Mechanism
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current secure execution environments lack runtime validation capabilities, making them vulnerable to attacks like session hijacking, as they rely on presumed isolation and do not detect malicious code injection or modifications during execution.
Innovation Solution
Incorporating a software development toolchain that generates and inserts hashing instructions into binary executable files, allowing processor hardware to validate functions at runtime by comparing generated hashes with stored hashes, and using encryption to secure these hashes in dedicated memory.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If isolation zones and privileged execution modes are used to create secure execution environments, then security isolation is improved, but runtime validation capability deteriorates
Solution Approach 1:
The patent applies preliminary action by pre-computing and storing hash values of function instructions during the binary executable generation phase. These pre-computed hashes are embedded in the binary file alongside the original code. At runtime, the secure execution environment can directly compare newly computed hashes against these pre-stored references, enabling rapid validation without complex runtime analysis. This resolves the contradiction by establishing validation capability in advance, allowing the system to maintain both strong isolation and effective runtime detection.
2Measurement precision
If hashing instructions are inserted into every function, then runtime validation capability is improved, but device complexity increases
Solution Approach 1:
The patent applies universality by designing a unified binary executable format that integrates multiple functions: the original code, pre-computed hash values, and hash comparison logic all coexist in a single standardized structure. This universal format allows the same binary file to be executed normally while simultaneously providing validation data, eliminating the need for separate validation modules or complex external verification systems. The approach reduces overall system complexity despite adding validation capabilities to every function.
3Speed
If hashes are stored in plaintext, then validation speed is improved, but security deteriorates
Solution Approach 1:
The patent applies the intermediary principle by introducing an encrypted storage layer between the hash values and the validation process. Instead of storing hashes in plaintext or using complex obfuscation, the solution uses symmetric encryption with a key derived from a trusted source (such as a secure element or hardware security module). The encrypted hashes can be quickly decrypted and compared during validation, maintaining high speed while ensuring that stolen binary files cannot be used to forge valid hashes. This intermediary encryption layer resolves the contradiction between fast validation and secure storage.
Data Source
AI summary
Various embodiments include methods and devices for a secure execution environment in computing devices. Embodiments may include generating a binary executable file for execution in the secure execution environment by generating hashes of instructions of a function, inserting a start hash instruction and a stop hash instruction in object code of the function, and generating a binary executable having the function including the start hash instruction and the stop hash instruction. Embodiments may include implementing the secure execution environment by generating hashes of instructions of a function in parallel with executing the function, comparing the generated hashes of the instructions of the function to stored hashes of instructions of the function, and issuing an exception indicating to a processor that execution of the function is not secure for any difference between the generated hashes of the instructions of the function and the stored hashes of the instructions of the function.