Trusted Execution Environment Authentication Protection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing security authentication systems for mobile devices, particularly those based on trusted execution environments (TEE), face vulnerabilities that can lead to system crashes and insufficient security, especially due to the lack of comprehensive protection for interactions between different security levels.

Innovation Solution

A trusted environment-based authentication protection system and method that includes a client application, a TEE processing unit, a daemon application, and a trusted application, which utilize hash algorithms and random numbers to ensure secure parameter verification and processing, enhancing security through encryption and integrity verification during connection establishment and maintenance.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If security isolation technology is implemented through TEE, then security protection is provided, but serious security threats still exist and may cause system crashes

Engineering Contradiction:

Improvesystem securityVSAvoidsecurity threats

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The patent segments the authentication process into multiple verification stages: initial authentication verification, parameter completeness verification, and continuous authentication verification. Each stage independently verifies specific aspects, creating layered security that prevents single-point failures and mitigates security threats at different levels of the system.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent performs preliminary verification of parameter completeness and authentication validity before establishing the connection and during the authentication process. By verifying parameters in advance and continuously monitoring authentication status, the system prevents malicious inputs from causing system crashes and blocks security threats before they can compromise the TEE.

Inventive Principle:

Principle #10Preliminary action

2Reliability

If comprehensive parameter verification is performed in connection establishment, then security is improved, but system complexity increases

Engineering Contradiction:

Improveconnection securityVSAvoidverification process complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent introduces a daemon application as an intermediary between the client application and the TEE. The daemon application centralizes the complex verification logic for parameter completeness and authentication validity, managing the verification process systematically. This intermediary absorbs the complexity of multi-stage verification, presenting a simplified interface to both the client and TEE while maintaining comprehensive security checks.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Reliability

If multiple verification steps are added to ensure trusted parameters, then information interaction security is improved, but processing time increases

Engineering Contradiction:

Improveinformation interaction securityVSAvoidconnection establishment time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The patent implements continuous authentication verification that operates throughout the connection lifecycle rather than only at establishment. The authentication verification continues during the connection process, allowing the system to maintain security while optimizing the initial connection establishment by performing verifications continuously in the background, thus reducing perceived processing time while maintaining comprehensive security.

Inventive Principle:

Principle #20Continuity of useful action

Data Source

PatentUS11620373B2Authentication protection system and method based on trusted environment, and storage medium

Publication Date: 2023.04.04 SANECHIPS TECH CO LTD

AI summary

Provided is an authentication protection system based on a trusted environment. The system includes: a client application, a trusted execution environment (TEE) processing unit, a daemon application and a trusted application; where the client application is configured to issue a security authentication business request to the TEE processing unit for calling a security business; the TEE processing unit is configured to forward the security authentication business request to the daemon application and the trusted application separately, return a verification result to the client application, and create a session connection for the client application and the trusted application; the daemon application is configured to verify the security authentication business request and the trusted application is configured to conduct a session with the client application and provide a business service for the client application.