Trusted Execution Environment Data Storage and Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Data rolling back to previous versions poses security risks, including potential monetary losses and sensitive information leakage, as it can cause terminal devices to become unusable and reintroduce security vulnerabilities.
Innovation Solution
A data storage and verification method utilizing a trusted execution environment, where user data is encrypted with a first key and stored in a general storage space, while version information and verification information are stored in a secure storage space, ensuring data integrity and preventing unauthorized rollbacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If data is stored in a general storage space without encryption, then storage accessibility is improved, but data security deteriorates
Solution Approach 1:
The storage space is segmented into a general storage space for ciphertext and a secure storage space for verification information. This segmentation allows the system to maintain both accessibility (by storing encrypted data in general space) and security (by storing verification data in secure space with restricted access).
Solution Approach 2:
Encryption acts as an intermediary mechanism between the stored data and the verification process. The ciphertext in the general storage space can be accessed, but the verification information stored separately in the secure storage space acts as a mediator that must be presented to the trusted execution environment to confirm authenticity, thus resolving the contradiction between accessibility and security.
2Reliability
If version information is stored separately from user data, then verification capability is improved, but storage complexity increases
Solution Approach 1:
The storage system is segmented to separate user data (stored as ciphertext in general storage space) from version information and verification information (stored in secure storage space). This segmentation enables independent verification of version information without complicating the overall storage structure, as the separation is achieved through standardized storage spaces rather than complex data structures.
3Reliability
If data encryption is implemented, then data security is improved, but processing time increases
Solution Approach 1:
The encryption of user data is performed in advance during the data storage phase, and the ciphertext is stored in the general storage space. During verification, only the decryption operation is needed, which is faster than full encryption/decryption cycles. This preliminary action reduces the time required during the critical verification phase while maintaining security.
Data Source
AI summary
Disclosed are data storage and verification methods and a device executable in a trusted execution environment. The data storage method comprises: encrypting, using a first key, user data and version information of the user data to generate first ciphertext, and storing the first ciphertext into a general storage space (S310); generating verification information of the user data (S320); and storing the version information and the verification information into a secure storage space (S330). The present disclosure effectively prevents version rollback of user data.