TEE Offline Management Using OTrP Security Domain Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for managing trusted execution environments (TEE) require real-time interaction or online communication with an outside world entity (OWE) for remote management, which is not feasible in all scenarios.
Innovation Solution
A method for offline management of TEE using an open trust protocol (OTrP) that allows terminals to decrypt encrypted data using pre-configured decryption keys, enabling management operations such as installing or updating trusted applications without online interaction.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the terminal device processes and displays all notification messages locally, then the user can access all notifications, but the battery consumption increases and the processing burden on the terminal device increases
Solution Approach 1:
The patent introduces a server as an intermediary to handle notification message processing. The server receives notification messages, extracts key information, and generates simplified display content. This mediator approach allows the terminal device to display notifications with reduced processing burden and lower battery consumption while maintaining access to essential notification information.
2Reliability
If the terminal device processes and displays all notification messages locally, then the user can access all notifications, but the processing burden on the terminal device increases
Solution Approach 1:
The patent introduces a server as an intermediary to handle notification message processing. The server receives notification messages, extracts key information, and generates simplified display content. This mediator approach allows the terminal device to display notifications with reduced processing burden and lower battery consumption while maintaining access to essential notification information.
Solution Approach 2:
The patent segments the notification processing function into two parts: the server handles complex processing including message reception, information extraction, and content generation, while the terminal device handles simpler display and user interaction functions. This segmentation reduces the processing burden on the terminal device while maintaining complete notification access capability.
3Productivity
If the terminal device displays simplified notification content, then the battery consumption and processing burden are reduced, but the information completeness may be compromised
Solution Approach 1:
The patent applies local quality by differentiating between essential information that requires simplification for efficient display and important information that must be preserved in complete form. The server extracts key information for simplified display while retaining complete notification content, ensuring that both processing efficiency and information completeness are maintained through selective information presentation.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Embodiments of the present invention provide a management method, applied to management of a trusted execution environment TEE that supports an open trust protocol OTrP. The management method includes: obtaining, by a terminal, an application packet, where the application packet includes an offline management instruction, the offline management instruction includes a target security domain SD identifier, a decryption key identifier, and encrypted data, a decryption key corresponding to the decryption key identifier is used to decrypt the encrypted data, the encrypted data is generated by an outside world entity OWE by using an encryption key, and the decryption key and the encryption key are a key pair generated by the outside world entity OWE; determining, by the terminal, whether a target SD corresponding to the target SD identifier includes the decryption key corresponding to the decryption key identifier, and when the target SD includes the decryption key, decrypting, by the terminal, the encrypted data by using the decryption key, and performing an offline management operation based on data obtained after the encrypted data is decrypted. The provided management method is used to implement offline management of the TEE in the OTrP.