TEE Decryption Software One-Time Execution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems fail to securely protect data records, such as encryption keys and passwords, from unauthorized access, particularly in networked devices like household appliances, where encryption keys are vulnerable to unauthorized decryption and access.
Innovation Solution
A system utilizing a Trusted Execution Environment (TEE) with decryption software that decrypts encrypted data sets only once during startup, storing them securely in a RAM-based storage unit accessible only through the TEE, and prevents further execution of the decryption software to maintain secure access control.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the decryption software is made accessible for repeated execution during system operation, then the ease of operation is improved, but the security against unauthorized access deteriorates
Solution Approach 1:
The decryption software is executed once during system startup before the operating system is loaded, performing the decryption operation in advance. After this preliminary execution, the software is locked and cannot be executed again during system operation, thus maintaining security while enabling the necessary decryption function.
Solution Approach 2:
The system is divided into two distinct execution phases: a secure preliminary phase during startup where decryption software can execute, and a protected operational phase where the software is locked. This segmentation allows the decryption function to be performed when necessary while preventing unauthorized repeated execution during normal operation.
2Reliability
If the decrypted data set is stored in a secure storage unit accessible only via TEE, then the security against unauthorized access is improved, but the device complexity increases
Solution Approach 1:
The Trusted Execution Environment (TEE) acts as an intermediary layer between the secure storage unit and the rest of the system. The TEE controls and mediates all access to the decrypted data set, ensuring that only authorized operations can access the sensitive information while maintaining a relatively simple overall storage architecture.
3Productivity
If the decryption key is made available for multiple decryption operations, then the productivity is improved, but the security against key extraction deteriorates
Solution Approach 1:
The decryption key is made available for decryption operations in advance during system startup, before the operating system is loaded. This preliminary availability enables all necessary decryption operations to be performed. After this initial period, the key is locked and cannot be extracted or used for additional decryption operations, thus maintaining security while enabling productivity when needed.
Data Source
Figure 1~2
Figure 3
AI summary
A system (100) for controlling access to a data record (111, 112) to be protected is described. The system (100) comprises a secure runtime environment (103) configured to execute decryption software (103), wherein the decryption software (103) is configured to decrypt an encrypted data record (111) to be protected and to store the decrypted version on a secure storage unit (106). The secure storage unit (106) is configured such that access to the secure storage unit (106) is possible only via the secure runtime environment (103). Furthermore, the secure runtime environment (103) is configured to prevent the decryption software (103) from being executed again.