Secure Zone Hardware Isolation for Transaction Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computer network-based systems for secure data transactions are vulnerable to software-based attacks, such as viruses, backdoors, and keyloggers, due to vulnerabilities in the operating system.
Innovation Solution
A secure zone is implemented within a hardware platform, which executes tasks and subtasks with digitally signed executable code and applies sets of permissions based on digital certificates, ensuring secure execution and access control.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If software-based operating systems are used for data transactions, then ease of operation and adaptability are improved, but security and reliability deteriorate due to vulnerabilities to viruses, backdoors, and keyloggers
Solution Approach 1:
The system divides the computing environment into a secure zone and a non-secure zone. The secure zone is a hardware-based isolated environment that executes critical financial transactions, while the non-secure zone handles general operating system functions. This segmentation ensures that even if the operating system is compromised by viruses or keyloggers, the secure transactions remain protected.
Solution Approach 2:
The critical transaction execution functionality is extracted from the software-based operating system and placed into a dedicated hardware secure zone. This extraction removes the vulnerability exposure from the transaction execution path, as the secure zone operates independently of the compromised software environment.
2Reliability
If a secure zone with hardware isolation is implemented, then security and reliability are improved, but device complexity increases
Solution Approach 1:
The secure zone is designed to support multiple transaction types and can interface with various peripheral devices (keyboard, display, printer) through standardized interfaces. This multi-functionality allows a single secure zone implementation to protect diverse financial applications without requiring separate security infrastructure for each transaction type.
Solution Approach 2:
The secure zone contains nested functional components including a processor, memory, and interface controllers that are integrated within a single hardware module. This nested architecture consolidates complexity into a unified component that can be implemented as a security chip or module within the existing computer system.
3Reliability
If permissions are applied to executable code, then security is improved, but ease of operation deteriorates due to restricted access
Solution Approach 1:
Permissions and digital certificates are validated in advance before code execution begins. The secure zone checks the digital signature and permission attributes of executable code prior to allowing it to run, ensuring that security constraints are established before any potential harm can occur. This preliminary validation maintains ease of operation by automatically enforcing security without requiring user intervention.
Data Source
Figure 1
Figure 2
Figure 3A~3B
AI summary
An apparatus according to the present disclosure may comprise a secure zone configured to execute a task having a subtask. The task and subtask may have respective executable code and may be digitally signed by respective code providers. The secure zone may be further configured to apply respective sets of permissions while the respective executable code of the task and subtask are executed. The respective set of permissions for the task may be based on at least one of information associated with the signed task and information in a digital certificate of the respective code provider for the task. The respective set of permissions for the subtask may be based on at least one of information associated with the signed subtask and information in a digital certificate of the respective code provider for the subtask.