Security Coprocessor Signing for Trusted Device Security Evaluation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The reliability of existing security evaluation methods for electronic devices is poor, as they do not adequately ensure the integrity and authenticity of security evaluation results, particularly in rich execution environments (REE) and trusted execution environments (TEE).
Innovation Solution
A security coprocessor in the electronic device determines a target security evaluation result, decrypts a private key using a root key, signs the result with the private key, and sends it to an application server along with a digital certificate, ensuring the security evaluation result's integrity and authenticity through cryptographic verification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security evaluation is performed by the electronic device itself without cryptographic verification, then the evaluation process is simple and fast, but the reliability and authenticity of the evaluation result cannot be ensured
Solution Approach 1:
The private key is pre-generated and stored in the security coprocessor before the security evaluation is needed. When the evaluation is performed, the pre-stored private key is immediately used to sign the evaluation result, eliminating the need for real-time key generation and ensuring both reliability and efficiency
Solution Approach 2:
A digital certificate is introduced as an intermediary between the electronic device and the application server. The digital certificate binds the device's public key to its identity, allowing the server to verify the authenticity of the signed evaluation result without needing to directly trust the device itself
2Reliability
If the security evaluation result is transmitted without digital signature, then the transmission process is simple, but the integrity and authenticity of the result cannot be guaranteed against attacks
Solution Approach 1:
The security coprocessor is pre-configured with the private key and is ready to perform signing operations immediately when needed. This preliminary setup minimizes the time penalty during actual security evaluation, as the cryptographic operations can proceed without delays
Solution Approach 2:
The electronic device performs the digital signing of its own security evaluation result using its private key stored in the security coprocessor. This self-service approach eliminates the need for external signing services, reducing communication overhead and time loss while ensuring the device controls its own security credentials
Data Source
AI summary
This application provides a security evaluation method, a service processing method, a security information transmission method, and a related device. The method includes: determining a target security evaluation result based on first security information in a case that a security evaluation request sent by an application server is received, where the first security information includes security status information of an REE of an electronic device or a security evaluation result of the REE; decrypting a first ciphertext by using a root key of the electronic device, to obtain a private key of the electronic device; signing the target security evaluation result by using the private key of the electronic device, to obtain a signature of the target security evaluation result; and sending second security information to the application server.