Secure Runtime Data Exchange via Segmented Buffers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for data exchange between secure and insecure environments on microprocessor units, particularly in mobile terminals, do not adequately optimize multitasking properties, leading to inefficiencies in data transmission and context switching.
Innovation Solution
The method involves transmitting application data and control data through different buffers using a memory area accessible by both secure and non-secure environments, with separate secure buffers for control data to enable fast context switching, and utilizing ARM monitor code and a scheduler to manage data exchange between secure and insecure environments.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If a single buffer is used for both application data and control data exchange between secure and insecure environments, then the device complexity is reduced, but the context switching time increases and multitasking performance deteriorates
Solution Approach 1:
The patent divides the data exchange buffer into separate buffers: a first buffer for application data and a second buffer for control data. This segmentation allows independent management of different data types, enabling faster context switching by pre-loading control data without requiring application data to be present, thus resolving the contradiction between simplified structure and fast switching.
2Reliability
If strict process isolation is implemented between secure and insecure environments, then security reliability is improved, but data exchange efficiency decreases
Solution Approach 1:
The patent introduces a monitor unit as an intermediary between the secure runtime environment and the insecure environment. This mediator manages the buffer structures and control messages, enabling efficient data exchange while maintaining strict process isolation through controlled access mechanisms, thus resolving the contradiction between security and efficiency.
3Device complexity
If control data and application data are transmitted through the same buffer, then the buffer management complexity is reduced, but the data exchange speed decreases due to mixing different data types
Solution Approach 1:
The patent segments the buffer into dedicated buffers for control data and application data. This allows the control buffer to be managed independently with control messages containing session identifiers, enabling faster control data transmission without being constrained by application data buffer management, thus resolving the contradiction between management simplicity and transmission speed.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The invention relates to a method for interchanging data between a secure runtime environment (SWd), in which a number of secure applications (TL) can be executed, and a non-secure environment (NWd) of a microprocessor unit (MP), in particular in a mobile terminal, in which application data (AD) and control data (MCP, NQ) are transmitted via different buffers.