TEE Peripheral Access Control via Whitelist Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current mobile terminal systems face challenges in managing application permissions for peripherals, leading to potential side-channel attacks, and existing solutions either restrict peripheral access too severely or require cumbersome user intervention, impacting terminal functionality.
Innovation Solution
A data processing method that determines if an application is on a whitelist before accessing peripherals, allowing the Trusted Execution Environment (TEE) management module to take over conflicting peripherals and send data to authorized applications, ensuring secure information exchange while minimizing functional limitations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the terminal prohibits external entities from accessing peripherals when displaying TUI, then information security is improved, but terminal functionality is restricted
Solution Approach 1:
The patent implements differential permission management where different applications receive different levels of peripheral access rights. The whitelist mechanism allows specific authorized applications to access peripherals while other applications remain restricted, achieving local quality control rather than universal restriction.
Solution Approach 2:
The system dynamically adjusts peripheral access permissions based on the running state of applications. When a whitelisted application is detected to be running, the system automatically grants it peripheral access rights, and revokes them when the application stops, making the permission control dynamic rather than static.
2Reliability
If the system requires user intervention to manage peripheral permissions, then security control is improved, but ease of operation deteriorates
Solution Approach 1:
The system implements automatic permission management that operates without user intervention. The permission management module automatically detects running applications, checks them against the whitelist, and adjusts peripheral permissions accordingly, making the security system self-service rather than user-dependent.
Solution Approach 2:
The whitelist of authorized applications is pre-configured before runtime. The system performs preliminary validation by checking running applications against this pre-established whitelist, enabling automatic permission decisions without requiring users to make real-time security judgments.
3Object-affected harmful factors
If static permission restriction is applied during TUI display, then side-channel attack prevention is improved, but adaptability to complex application environments deteriorates
Solution Approach 1:
The patent transforms static permission restrictions into dynamic control by continuously monitoring application runtime states. Permission decisions are made based on real-time detection of which whitelisted applications are currently running, allowing the system to adapt to changing application environments while maintaining security.
Solution Approach 2:
The system implements a feedback mechanism where the permission management module continuously monitors application execution states and adjusts peripheral permissions based on this feedback. When a whitelisted application starts or stops, the system receives feedback and automatically adjusts permissions, creating a closed-loop adaptive security system.
Data Source
Figure 1
Figure 2
Figure 3A
AI summary
Embodiments of the present invention provide a data processing method and a terminal. The method includes: determining whether a first conflicting application related to a first conflicting peripheral is in a whitelist; when it is determined that the first conflicting application is in the whitelist, independently taking over the first conflicting peripheral, where the first conflicting application is an application that is running in a rich execution environment REE; and when the TUI is displayed, sending data generated by the first conflicting peripheral to the first conflicting application. The embodiments of the present invention provide a method for processing peripheral data, so that not only information security of the terminal can be ensured, but also an access restriction on a terminal peripheral in a trusted execution environment TEE can be minimized, thereby less limiting and affecting a terminal function.