TEE Interface Data Filtering to Block Reverse Engineering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing confidential computing technologies are vulnerable to reverse engineering, allowing malicious users to circumvent hardware-based protections and compromise the confidentiality of sensitive applications, particularly in industrial settings where third-party integration is critical.
Innovation Solution
Implementing protection modules at the input and output interfaces of trusted execution environments (TEEs) to filter and process data, including rate limiting, source verification, output encryption, and fuzzification, to prevent unauthorized access and data leakage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If confidential computing technology is used with TEE and encrypted memory to protect sensitive applications, then IP protection and data confidentiality are improved, but the system remains vulnerable to reverse engineering through input/output analysis
Solution Approach 1:
The patent introduces protection modules as intermediary components between the TEE and external interfaces. These modules act as mediators that filter, validate, and control all input/output data flows, preventing direct observation of internal application behavior while maintaining functional integrity. The protection modules include rate limiters, input validators, and output fuzzifiers that collectively block reverse engineering attempts.
Solution Approach 2:
The patent creates a composite protection architecture by combining multiple protection mechanisms (rate limiting, input validation, output encryption, fuzzification) with the existing TEE hardware. This composite structure integrates hardware-based isolation with software-based obfuscation layers, creating a multi-layered defense system that addresses both the confidentiality and reverse engineering prevention requirements.
2Reliability
If protection modules are added to the TEE interface to prevent reverse engineering, then security against analysis is improved, but system complexity increases
Solution Approach 1:
The patent segments the protection functionality into distinct, modular protection modules that can be independently configured and deployed. Each module handles a specific aspect of protection (rate limiting, input validation, output encryption), allowing the system to be built with only the necessary components for each specific use case, thereby managing complexity through functional decomposition.
Solution Approach 2:
The protection modules are designed as universal components that can be applied to any TEE interface regardless of the specific application. The same module architecture handles both input data protection and output data protection, and can be configured for different types of sensitive data, reducing overall system complexity through reusability and standardization.
3Reliability
If rate limiting and input filtering are implemented to hinder reverse engineering, then protection against malicious inputs is improved, but processing speed and productivity may deteriorate
Solution Approach 1:
The patent implements rate limiting that allows normal operational data flows to pass through at full speed while blocking excessive query patterns characteristic of reverse engineering attempts. The system applies partial protection by focusing rate limiting thresholds on anomalous patterns rather than uniformly restricting all data flows, thereby maintaining productivity for legitimate uses while preventing malicious analysis.
Data Source
Figure 1~2
Figure 3
Figure 4a~6
AI summary
There is disclosed a method for protecting an application within a trusted execution environment, TEE, against reverse-engineering in industrial plants. The method comprises equipping the TEE or an interface of the TEE with at least one protection module; and directing data related to the application to go through the at least one protection module. There is further disclosed a data processing apparatus, a computer-readable medium and a computer program product.