Trusted Execution Environment Key Register for File Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing key processing methods for intelligent devices fail to ensure the security of file keys, as third-party applications can potentially steal and decrypt the file key in the normal execution environment, compromising the security of the file.
Innovation Solution
A method and apparatus where the initial key is decrypted in a trusted execution environment to obtain a file key, which is then stored in a key register inaccessible to the normal execution environment, with only a key index sent to the normal execution environment to facilitate encryption and decryption operations, thereby preventing unauthorized access to the file key.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the file key is stored in the normal execution environment for easy access, then the ease of operation is improved, but the security of the file key deteriorates because third-party applications can steal and decrypt it
Solution Approach 1:
The system is divided into two execution environments: normal execution environment for file operations and trusted execution environment for key management. This segmentation isolates the file key in a secure environment while allowing normal operations to proceed independently, resolving the contradiction between accessibility and security.
Solution Approach 2:
The file encryption module acts as an intermediary between the normal execution environment and the trusted execution environment. It receives encryption/decryption requests, obtains the file key index from the trusted environment, and performs operations without direct access to the key material, thus maintaining both operational ease and key security.
2Productivity
If the file encryption module has direct access to the file key in memory, then the productivity of file operations is improved, but the security of the file key deteriorates due to potential theft by third-party applications
Solution Approach 1:
The file key is extracted from the normal execution environment and stored in the trusted execution environment. Only the file key index remains accessible to the file encryption module, separating the sensitive key material from the operational code and preventing theft while maintaining operational efficiency.
Solution Approach 2:
The file key is pre-generated and stored in the trusted execution environment before any file operations occur. The file encryption module can quickly retrieve the key index and perform operations without needing direct key access, ensuring both speed and security from the outset.
3Ease of manufacture
If the file key is stored in an accessible memory location, then the ease of manufacture and deployment is improved, but the security of the file key deteriorates as hackers can crack the encryption module and steal the key
Solution Approach 1:
The system adds a new dimension of security by introducing a separate trusted execution environment for key storage. This dimensional separation creates a security layer that is inaccessible to traditional hacking methods targeting the normal execution environment, while maintaining implementation feasibility through standardized dual-environment architecture.
Data Source
AI summary
A key processing method includes receiving, in a trusted execution environment, an initial key from a file encryption system in a normal execution environment, decrypting, in the trusted execution environment, the initial key to obtain a file key, storing, in the trusted execution environment, the file key in a key register of a storage controller, where the file encryption system in the normal execution environment is forbidden to access the key register, obtaining, in the trusted execution environment, a key index of the file key in the key register, where the key index indicates a storage location of the file key in the key register, and sending, in the trusted execution environment, the key index to the file encryption system.