Secure Element Applet Access via TEE Rule Generation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face challenges in securely controlling access to applets in electronic devices, particularly due to the risk of unauthorized access and exposure of access rules in less secure execution environments, leading to potential security breaches.
Innovation Solution
The solution involves generating access rules based on identification information of a security element within a trusted execution environment (TEE), using a secure channel and shared keys, to control access to applets, thereby enhancing security by reducing the risk of rule exposure and unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If access rules are generated and stored in a rich execution environment (REE), then access control functionality is available, but security is compromised due to potential exposure of access rules
Solution Approach 1:
The system divides the execution environment into two distinct parts: a Rich Execution Environment (REE) for general application execution and a Trusted Execution Environment (TEE) for secure access rule generation and storage. This segmentation isolates sensitive security operations from the less secure REE, preventing access rule exposure while maintaining access control functionality.
Solution Approach 2:
The TEE acts as an intermediary between the application in REE and the security element. It securely generates access rules based on application information and certification, then delivers them to the security element without exposing the rules to the REE. This intermediary mechanism enables secure access control while protecting sensitive information.
2Reliability
If access control is implemented using traditional methods in REE, then implementation is simple, but unauthorized access and security breaches occur
Solution Approach 1:
The system performs preliminary security setup by establishing the TEE and security element configuration before access control operations begin. Certification information and security parameters are pre-configured in the TEE, enabling secure access rule generation without requiring complex security implementations during runtime operations.
Solution Approach 2:
The patent replaces traditional software-based access control mechanisms in REE with a hardware-backed secure system using TEE and security element. This substitution provides stronger security guarantees through hardware-enforced isolation and cryptographic operations, overcoming the limitations of software-only approaches.
3Reliability
If access rules are delivered from TEE to security element, then security is enhanced, but additional processing steps are required
Solution Approach 1:
The system establishes continuous secure communication channels between TEE and security element for access rule delivery. Once the secure pathway is established, access rules can be efficiently transmitted and updated without breaking security, maintaining both security and operational efficiency.
Solution Approach 2:
The TEE autonomously generates access rules based on application information and certification data without requiring external intervention. This self-service capability streamlines the access control process by automatically creating and delivering secure access rules, reducing manual processing overhead while maintaining high security standards.
Data Source
AI summary
A method performed by an electronic device, includes: identifying an event for executing a function of an applet in a security element of the electronic device, wherein the applet is associated with a software application; based on the identified event, delivering certification information of the software application and package information of the software application from a rich execution environment (REE) to a trusted execution environment (TEE); based on identification information of the security element, the certification information, and the package information of the security element obtained from the security element, generating a value for controlling an access to the applet, on the TEE; and based on the value, executing the function of the applet in the security element.