Secure IoT Device Update via Trusted Execution Environment Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing IoT device software update mechanisms lack sufficient security and reliability, particularly in ensuring the integrity and authenticity of updates across different execution environments.
Innovation Solution
Implementing a dual-execution environment approach where a secure world environment validates and manages software updates, while a normal world environment handles network communications and update requests, ensuring that only validated updates are written to flash memory.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If a single execution environment is used for software updates, then device complexity is reduced, but security and reliability of updates deteriorate
Solution Approach 1:
The system divides the execution environment into two independent worlds: a secure world with a trusted execution environment (TEE) and a normal world without TEE. The secure world handles sensitive update validation operations while the normal world handles routine update management, allowing security-critical functions to be isolated from less trusted operations.
Solution Approach 2:
A message queue mechanism acts as an intermediary between the normal world and secure world. Update requests from the normal world are queued and processed by the secure world, which validates updates using its TEE capabilities before allowing installation. This intermediary layer enables the less trusted normal world to benefit from the security of the secure world without direct access to sensitive operations.
2Ease of operation
If the normal world handles update requests directly, then ease of operation is improved, but security against unauthorized access deteriorates
Solution Approach 1:
The message queue serves as an intermediary that filters and validates update requests before they reach the secure world. The normal world can freely submit update requests through this queue, maintaining ease of operation, while the secure world processes these requests with full security validation, blocking unauthorized access.
Solution Approach 2:
The secure world performs preliminary validation of update requests before allowing any actual update installation. By checking the authenticity and integrity of updates in advance within the trusted execution environment, the system prevents unauthorized or malicious updates from being installed, countering potential security threats before they can cause harm.
3Device complexity
If update validation is performed without TEE, then device complexity is reduced, but reliability of update integrity deteriorates
Solution Approach 1:
The validation function is segmented and assigned exclusively to the secure world with TEE capabilities. While this adds complexity to the overall system architecture, it ensures that critical validation operations are performed in a trusted environment, guaranteeing update integrity. The normal world handles less critical update management tasks without TEE.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The disclosed technology is generally directed to updating of applications, firmware and/or other software on IoT devices. In one example of the technology, a request that is associated with a requested update is communicated from a normal world of a first application processor to a secure world of the first application processor. The secure world validates the requested update. Instructions associated with the validated update are communicated from the secure world to the normal world. Image requests are sent from the normal world to a cloud service for image binaries associated with the validated update. The secure world receives the requested image binaries from the cloud service. The secure world writes the received image binaries to memory, and validates the written image binaries.