Software Trusted Execution Environment for Mobile App Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Mobile devices without hardware-based trusted execution environments (TEEs) are vulnerable to malware and attacks, compromising user and service provider security, as they lack the necessary secure computing functionality.
Innovation Solution
A software-based trusted execution environment (Soft TEE) is introduced, allowing mobile applications to be developed with secure components that can execute on devices without hardware TEEs, using cryptographic keys and a Soft TEE virtual machine to isolate and protect sensitive data, and employing white-box cryptography for secure provisioning and runtime memory encryption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If hardware-based trusted execution environments are implemented in mobile devices, then security of mobile applications and sensitive data is improved, but device complexity and manufacturing cost increase
Solution Approach 1:
The patent creates a software-based copy of the trusted execution environment functionality that runs on the main processor instead of requiring dedicated hardware. The soft TEE virtual machine replicates the security isolation and cryptographic key management functions of hardware TEEs through software emulation, allowing devices without hardware TEEs to achieve comparable security levels
Solution Approach 2:
The patent replaces the mechanical/hardware-based trusted execution environment with a software-based system. Instead of relying on physical isolation mechanisms in hardware, the invention uses virtual machine technology, cryptographic protocols, and software enforcement to achieve the same security objectives, thereby eliminating the need for specialized hardware components
2Adaptability or versatility
If software-based trusted execution environment is used on devices without hardware TEEs, then security functionality is provided to more devices, but security strength compared to hardware TEEs deteriorates
Solution Approach 1:
The patent performs preliminary security actions by establishing cryptographic key pairs and provisioning security credentials before the mobile application is installed and executed. The soft TEE virtual machine is pre-configured with security policies and cryptographic infrastructure, ensuring that security measures are in place before any sensitive operations occur
Solution Approach 2:
The patent segments the mobile application into trusted and untrusted components, with the soft TEE virtual machine providing isolated execution environments for sensitive operations. This segmentation separates security-critical functions from the general-purpose operating system, ensuring that even if the main system is compromised, the protected functions remain secure
3Ease of manufacture
If cryptographic keys are stored in soft TEE virtual machine on devices without hardware security, then security provisioning is simplified, but vulnerability to attacks increases
Solution Approach 1:
The patent introduces a trusted service manager as an intermediary that securely provisions cryptographic keys and security credentials to the soft TEE virtual machine. This intermediary uses secure communication channels and authenticated protocols to transfer sensitive security materials, reducing the risk of key exposure during the provisioning process
Solution Approach 2:
The patent changes the operational parameters of the cryptographic system by using dynamic key derivation and multiple layers of encryption. Instead of storing keys in a single static location, the system derives keys from master secrets using cryptographic hash functions and stores them in encrypted form, changing the security model from static to dynamic protection
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A mechanism for securing a mobile app for execution on a mobile device. The mechanism includes loading a non-trusted portion of the mobile app from a non-trusted application provider onto the mobile device, operating a key provisioning server to generate keys associated with a trusted execution environment, transmitting the keys associated with the trusted execution environment to the mobile device and to a key directory server, authenticate the mobile device, and upon authenticating the mobile device, transmitting a trusted portion of the mobile app including a trusted application to the mobile device, and installing the trusted portion of the mobile app on the mobile device thereby providing a trusted execution environment. Other systems and methods are disclosed.