Trusted Execution Environment File Protection via Dynamic Key Generation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Mobile devices face challenges in securing sensitive data due to the risk of data exposure from lost or stolen devices, malware, and inadequate data erasure during trade-ins, necessitating a robust method for encrypting and controlling access to sensitive information.
Innovation Solution
The implementation of a Trusted User Interface (TUI) within a secure environment on mobile devices, which requires user input for all file access operations, generates encryption keys on demand, and executes cryptographic operations in a Trusted Execution Environment (TEE) to ensure secure encryption and decryption of sensitive data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If sensitive data is stored on a mobile device, then data accessibility is improved, but data security deteriorates due to risks from lost/stolen devices and malware
Solution Approach 1:
The patent segments the mobile device into two distinct environments: a normal world environment for general operations and a trusted execution environment (TEE) for secure cryptographic operations. This segmentation allows sensitive data to be accessible when needed while isolating security-critical operations in a protected domain that is resistant to malware and attacks from the normal world.
Solution Approach 2:
The patent introduces a trusted user interface (TUI) as an intermediary layer between the user and the cryptographic operations. The TUI collects user input through a secure interface and passes it to the TEE for key generation, ensuring that even if the normal world is compromised, the attack path to sensitive data is blocked by this trusted intermediary.
2Reliability
If encryption keys are stored securely, then data security is improved, but key management complexity increases
Solution Approach 1:
The patent performs preliminary action by generating encryption keys in advance within the trusted execution environment and storing them in secure storage. This allows the keys to be ready for immediate use when encryption or decryption is needed, eliminating the need for complex real-time key generation and management while maintaining high security standards.
3Reliability
If user input is required for all file access operations, then access control security is improved, but operation speed deteriorates
Solution Approach 1:
The patent implements dynamic key generation where the encryption key is generated on-demand based on user input through the trusted user interface. Rather than requiring static key storage or repeated authentication for every operation, the system dynamically creates keys when needed, providing both strong access control and operational flexibility.
Data Source
AI summary
An apparatus and method for securing sensitive data on a mobile device are provided. The method includes receiving an encryption or decryption request for the sensitive data on the mobile device, forwarding a file access request for the sensitive data to a secure environment, instantiating a trusted user interface (TUI), collecting user input via the TUI, generating a key using the collected user input, and encrypting or decrypting the sensitive data on the mobile device.