Application-Bound Data Encryption Using TEE-Isolated One-Time Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing encryption methods in mobile terminals are vulnerable to key extraction and reuse, leading to security risks as the key is often pre-embedded in the application code and lacks independent protection, making it easy to be statically analyzed and extracted by attackers, and the same keys are used across applications, allowing data to be decrypted on other devices.
Innovation Solution
Implement a data encryption method using a one-time key generated in a trusted execution environment, where the key is isolated from the untrusted environment, ensuring secure storage and unique generation for each application, and employing a secure cryptographic function to encrypt the data, which is then processed in the untrusted environment using symmetric key algorithms.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If a symmetric key algorithm is used for data encryption in mobile terminals, then encryption efficiency is improved, but key security is worsened because the key is pre-embedded in application code and can be easily extracted by attackers
Solution Approach 1:
The patent segments the encryption system into two distinct environments: a trusted execution environment (TEE) for secure key generation and a rich execution environment (REE) for data processing. The primary key is generated and stored in the TEE, while the application in the REE uses this key through secure interfaces without having direct access to it. This segmentation prevents key extraction while maintaining encryption efficiency.
Solution Approach 2:
The patent introduces the trusted execution environment as an intermediary between the application and the primary key. The TEE acts as a mediator that securely generates, stores, and manages the primary key, providing cryptographic services to the application without exposing the key itself. This intermediary mechanism ensures that the key remains protected while still enabling efficient encryption operations.
2Ease of operation
If the same primary key is used across multiple applications, then key management is simplified, but security is worsened because data can be decrypted on other devices
Solution Approach 1:
The patent applies local quality by binding the primary key to specific application characteristics (package name, signing certificate, etc.) and device identity (device identifier). Each application gets a uniquely tailored key that is valid only for that specific application-device combination. This ensures that even if the same application is installed on multiple devices, each device has its own unique key, preventing cross-device decryption.
3Reliability
If the primary key is stored in the trusted execution environment, then key extraction is prevented, but key generation complexity increases
Solution Approach 1:
The patent makes the trusted execution environment a universal security module that provides multiple cryptographic functions (key generation, encryption, decryption, digital signatures) through a unified interface. The TEE handles various cryptographic operations using the same secure key management infrastructure, reducing overall system complexity despite the enhanced security requirements.
Data Source
AI summary
Provided is a data encryption method. The data encryption method includes: determining source data requested to be encrypted by an application in an untrusted execution environment; generating reference data corresponding to the source data in the untrusted execution environment, wherein the reference data is data for one-time use in encrypting the source data; reading a primary key generated for the application in a trusted execution environment; acquiring security data by encrypting the reference data using the primary key in the trusted execution environment; and acquiring target data by encrypting the source data using the security data in the untrusted execution environment.