TEE Runtime Integrity Verification via Polymorphic MTD
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Trusted Execution Environments (TEEs) are unable to effectively identify and authenticate general-purpose application software, as they consider such software untrusted and lack mechanisms to verify the integrity of software outside the TEE during execution, making key protection ineffective against compromised applications.
Innovation Solution
A secure communication channel is generated between the TEE and executable programs, utilizing a Moving Target Defense (MTD) module with disposable polymorphic code to verify the integrity of executable programs by transforming and signing data, ensuring only cryptographically verified code can communicate with the TEE.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If TEE hardware verifies internal software validity, then internal software integrity is ensured, but external application software cannot be authenticated
Solution Approach 1:
The verification system is segmented into two distinct components: an internal verification mechanism for TEE software and an external verification mechanism for application software. The external verifier module separately authenticates application code by comparing runtime hashes against stored baseline hashes, enabling independent verification of external software without compromising internal TEE security.
Solution Approach 2:
An external verifier module acts as an intermediary between the TEE and application software. This mediator captures execution context, computes hashes of running applications, and compares them against baseline values stored outside the TEE, thereby enabling authentication of external software without requiring modifications to the TEE hardware itself.
2Reliability
If TEE protects encryption keys, then key secrecy is maintained, but compromised applications can still exfiltrate data by mimicking legitimate software
Solution Approach 1:
The system performs preliminary verification by capturing and storing baseline hash values of legitimate application code before execution. The external verifier uses these pre-stored baselines to authenticate applications at runtime, preventing compromised software from accessing encrypted data by mimicking legitimate applications.
Solution Approach 2:
The external verification system continuously monitors application integrity by computing runtime hashes and comparing them against baseline values. This feedback mechanism detects when applications have been compromised or modified, allowing the system to revoke access privileges and prevent data exfiltration by malicious software.
3Ease of operation
If traditional authentication methods are used, then basic security is provided, but they cannot detect code integrity or prevent injection attacks
Solution Approach 1:
The system replaces traditional mechanical authentication methods (passwords, certificates) with a cryptographic hash-based verification mechanism. The external verifier computes cryptographic hashes of application code at runtime and compares them against baseline hashes, providing robust code integrity verification that detects even minor modifications or injection attacks.
Solution Approach 2:
The verification system dynamically changes the parameter being verified from static authentication credentials to dynamic code hash values. By computing hashes of the actual running application memory contents and comparing them against baseline values, the system adapts verification to the actual execution state, detecting code modifications that static authentication cannot prevent.
Data Source
AI summary
Systems and methods of verifying runtime integrity with a trusted execution environment (TEE) may include generating, by a processor in communication with the TEE, a secure communication channel between the TEE and at least one executable program attempting to communicate with the TEE, providing, by the processor, a moving target defense (MTD) module to the at least one executable program via the generated secure communication channel, wherein the MTD module comprises disposable polymorphic code, sending over the secured communication channel, by the processor: data, received from the at least one executable program, and a transformed runtime digest of the at least one executable program, and allowing, by the processor, communication with the TEE when the validity of the transformed runtime digest of the corresponding at least one executable program is verified.