Storage Controller File Key Automation for TEE Switching Bottleneck
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The frequent switching between Rich Execution Environment (REE) and Trusted Execution Environment (TEE) modes by the processor to manage file encryption and decryption in existing electronic device storage systems leads to significant resource occupation and efficiency loss.
Innovation Solution
A storage controller is designed with a keystore to store classkeys, a key generator to calculate file keys based on random numbers and classkeys, and a file cryptography device to process files using these file keys, thereby eliminating the need for processor mode switching during file operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the processor frequently switches between REE mode and TEE mode to encrypt and decrypt keys during file operations, then file security is ensured, but processor resource occupation increases and processing efficiency decreases
Solution Approach 1:
The system divides key management functions into two parts: the processor handles high-level key generation and initial encryption in TEE mode, while the storage controller independently handles key derivation and file-level encryption/decryption in REE mode. This segmentation allows the processor to exit TEE mode after initial setup, avoiding repeated mode switching while maintaining security through distributed key management.
Solution Approach 2:
The storage controller acts as an intermediary between the processor and stored files, performing key derivation from master keys and handling file encryption/decryption operations. This intermediary role enables the processor to generate keys once in TEE mode while the storage controller manages subsequent encryption operations in REE mode, eliminating repeated processor mode switching.
2Reliability
If the processor switches to TEE mode to encrypt keys before storing files, then key security is improved, but the complexity of key management increases
Solution Approach 1:
The processor performs preliminary key generation and master key establishment in TEE mode during system initialization or first use. These pre-established keys are then stored securely and used by the storage controller for subsequent file operations, eliminating the need for repeated TEE mode switching and simplifying ongoing key management while maintaining initial security requirements.
Solution Approach 2:
The storage controller performs self-service by autonomously deriving file-specific keys from stored master keys and handling encryption/decryption operations without requiring processor intervention. This self-service capability reduces key management complexity by automating routine cryptographic operations while maintaining security through pre-established master keys.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A storage controller (103), including: a controller (1031), a keystore (1032), a key generator (1033), a file cryptography device (1034), and a data memory interface (1035). The keystore (1032) is configured to store a classkey. The controller (1031) is configured to: receive indication information of a to-be-processed file and indication information of a random number that are sent by a processor (101), obtain the to-be-processed file based on the indication information of the to-be-processed file, obtain the random number based on the indication information of the random number, and obtain a first classkey from a classkey stored in the keystore (1032). The key generator (1033) is configured to calculate a file key based on the random number and the first classkey obtained by the controller (1031). The file cryptography device (1034) is configured to process the to-be-processed file by using the file key calculated by the key generator (1033) to obtain a processed file. The data memory interface (1035) is configured to: write the processed file into a data memory (300); or read the to-be-processed file from the data memory (300).