Trusted Execution Environment Proxy for Data Integrity

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing proxy technologies fail to guarantee data integrity and liability, as clients are exposed to malware and cannot prove that a proxy initiated a request on their behalf, lacking evidence to verify legal compliance.

Innovation Solution

Implementing trusted execution environments (TEEs) on both client and proxy devices for secure attestation, creating a secure channel to ensure data integrity and logging requests to prove liability, using protocols like INTEL SGX for enclave attestation and secure data forwarding.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If traditional proxy technologies are used, then clients can access remote servers and maintain privacy, but data integrity cannot be guaranteed and clients are exposed to malware injection

Engineering Contradiction:

Improvedata integrityVSAvoidmalware exposure

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The patent introduces a Trusted Execution Environment (TEE) as an intermediary layer between the client and proxy server. This TEE acts as a mediator that verifies the proxy's integrity through attestation protocols before allowing communication, thereby preventing malware injection while maintaining the proxy's core functionality for privacy protection

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The system performs attestation verification in advance before establishing the proxy connection. The client's TEE verifies the proxy's TEE identity and integrity credentials beforehand, ensuring that only trusted proxies can serve requests. This preliminary verification prevents exposure to malicious proxies

Inventive Principle:

Principle #10Preliminary action

2Loss of information

If proxies are used to protect privacy, then clients can avoid censorship, but clients cannot prove that the proxy initiated requests on their behalf

Engineering Contradiction:

Improveliability evidenceVSAvoidprivacy protection

Core Design Contradiction:

Loss of informationVSEase of operation

Solution Approach 1:

The patent implements a feedback mechanism where the proxy's TEE provides attestation credentials and proof of request initiation back to the client's TEE. This feedback loop allows the client to verify that the proxy is acting on their behalf, creating auditable proof of liability while maintaining privacy through encrypted communication channels

Inventive Principle:

Principle #23Feedback

3Reliability

If TEE attestation is implemented, then data integrity and auditable proof are ensured, but system complexity increases

Engineering Contradiction:

Improveauditable proofVSAvoidsystem complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent extracts the complex attestation and verification logic into a separate TEE module, isolating it from the main proxy and client applications. This extraction allows the complex security protocols to run in a dedicated trusted environment without complicating the overall system architecture, as the TEE handles complexity internally through hardware-enforced security

Inventive Principle:

Principle #2Taking out (Extraction)

Data Source

PatentUS11451517B2Secure and auditable proxy technology using trusted execution environments

Publication Date: 2022.09.20 NEC CORP

AI summary

A method for secure proxying using trusted execution environment (TEE) technology includes performing, using a TEE running on a proxy, an attestation with a TEE running on a client. The TEE running on the proxy receives from the TEE running on the client a request to fetch data from a remote server. The TEE running on the proxy fetches the data specified in the request from the remote server. The TEE running on the proxy forwards to the TEE running on the client the data fetched from the remote server.