Trusted Execution Environment Authentication for Secure Device Binding
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing mobile device management systems fail to effectively enforce user-specific and device-specific security criteria, particularly when a device changes ownership, leading to insecure installation and management of sensitive applications.
Innovation Solution
A method and system that initiates a trusted user interface session to obtain user credentials, combines them with a unique device identifier, and cryptographically signs the credentials to generate an authentication object, which is verified by a back-end server to authorize the installation of a trusted application part within a secure, isolated execution environment.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If conventional user account authentication is used at the REE level, then ease of operation is improved, but security is worsened because user-specific and device-specific security criteria cannot be enforced
Solution Approach 1:
The authentication system is segmented into two distinct parts: a Rich Application (RA) part running in the untrusted REE for user interaction, and a Trusted Application (TA) part running in the isolated TEE for secure credential verification. This segmentation allows the RA to provide ease of operation while the TA ensures security criteria enforcement, resolving the contradiction between operational convenience and security reliability.
Solution Approach 2:
The TEE acts as an intermediary between the untrusted REE and the back-end server. The TA within the TEE receives authentication requests from the RA, verifies credentials against device-specific and user-specific criteria, and communicates with the back-end server. This intermediary mechanism enables secure authentication without compromising the ease of operation provided by the RA interface.
2Adaptability or versatility
If a device changes ownership, then adaptability is improved, but security is worsened because existing authentication mechanisms fail to maintain security criteria
Solution Approach 1:
Before allowing device ownership changes or new application installations, the system performs preliminary authentication through the TA in the TEE. The TA verifies user credentials and device identity against the back-end server, and only after successful verification does it authorize the ownership change or installation. This preliminary security check ensures adaptability to ownership changes while maintaining security criteria enforcement.
3Reliability
If the TA part is installed in an isolated execution environment, then security is improved, but device complexity is worsened
Solution Approach 1:
The TEE is implemented as a nested secure environment within the existing mobile device architecture. The TA part is nested within the TEE, which itself is nested within the overall device operating system. This nested structure provides the isolated execution environment needed for security services while leveraging the existing device infrastructure, thereby limiting the increase in overall device complexity.
Data Source
AI summary
A method for enforcing secure processes between a user and a device involves determining that the user has initiated installation of a secure application, installing the RA part of the secure application, triggering a trusted UI session upon realization that the TA part of the secure application is not installed, receiving, via the trusted UI session, user credentials for authenticating the user and enforcing user-specific and device-specific security, cryptographically signing combined user credentials with a cryptographic signature to obtain an authentication object, passing the authentication object to a service provider associated with the secure application for extraction of the user credentials, and generating an authorization token permitting the installation of the TA part of the secure application upon verification of the cryptographically signed authentication object.