Trusted Execution Environment Command Validation for Secure Element Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The implementation of secure operations in devices, such as handheld devices, is challenged by the limited operability of secure elements and maintaining security with high-level access, which restricts the functionality of applications that use sensitive data.
Innovation Solution
A trusted execution environment (TEE) is utilized within a main processor to interface between a rich operating system and a secure element, verifying and authorizing commands to ensure secure data transmission and execution, while a validation circuitry controls access to the secure element, filtering instructions from potentially untrusted environments.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a secure element is implemented with high-level access to provide rich functionality, then the functionality of applications using sensitive data is improved, but security is compromised due to potential unauthorized access
Solution Approach 1:
The system is divided into three distinct components: a rich OS environment for high-level application functionality, a TEE for secure command validation, and a SE for secure data storage and execution. This segmentation allows each component to perform its specialized function while maintaining security boundaries, resolving the contradiction between functionality and security.
Solution Approach 2:
The TEE acts as an intermediary between the rich OS and the SE. It validates commands from the rich OS before allowing execution on the SE, and filters instructions before passing them to the SE. This intermediary layer enables rich functionality while maintaining security by preventing unauthorized or malicious commands from reaching the secure element.
2Reliability
If a secure element is implemented with restricted access to maintain security, then security is improved, but the operability and functionality are limited
Solution Approach 1:
The TEE provides multi-functional capabilities by both validating commands and filtering instructions. This single component serves multiple security functions, enabling rich operability while maintaining security. The SE meanwhile focuses on its core secure execution function, achieving both security and operational capability through specialized design.
3Ease of operation
If commands are allowed to be executed directly from the rich OS to the secure element, then the operability is improved, but security is compromised due to potential malicious or unauthorized commands
Solution Approach 1:
The TEE performs preliminary validation of commands before they are executed on the SE. By validating commands in advance and filtering instructions beforehand, the system prevents malicious or unauthorized commands from reaching the secure element, thereby maintaining security while allowing legitimate operations to proceed.
Solution Approach 2:
The TEE serves as a mediating layer that sits between the rich OS and the SE. It intercepts all commands from the rich OS, validates them against security policies, and only passes approved commands to the SE. This intermediary approach enables operational flexibility while blocking harmful factors.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
As may be implemented in accordance with one or more embodiments, and apparatus and/or method may involve a first circuit that initiates secure operations by interfacing with a user and providing operation trigger data that is signed cryptographically and secured from alteration, based on the interfacing. A second circuit, including a secure element, stores data secured from access by the first circuit, and executes secure operations separately from operations executed by the first circuit based on one or more commands provided by the first circuit. Validation circuitry validates and controls accesses to the second circuit by verifying a characteristic of the operation trigger data by executing stored validation instructions with the operation trigger data, and communicating information to the second circuit based on the verifying. The second circuit is responsive to the communicated information by initiating execution of the secure operations.