TEE Processor Secret Key Segmentation for Data Leakage Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing electronic devices with trusted execution environment (TEE) functions are vulnerable to internal data leakage due to malicious software, which can compromise the security of data even when the operating system is hacked.
Innovation Solution
An electronic device and encryption method that utilize a processor supporting a TEE function to store open software in a protection zone, generate a secret key, and perform operations using homomorphic encryption to prevent malicious data access and ensure data integrity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If TEE function is used to protect data in protection zone, then data security against external attacks is improved, but internal data leakage from malicious software occurs
Solution Approach 1:
The patent segments the secret key into multiple parts (first secret key and second secret key) and stores them in different locations (protection zone and non-protection zone respectively). This segmentation ensures that even if malicious software compromises one part, the complete secret key cannot be obtained, thereby preventing internal data leakage while maintaining data security.
Solution Approach 2:
The patent implements a nested structure where the first secret key is encrypted using a private key and stored in the protection zone, while the second secret key is encrypted using signature information and stored outside. The decryption process requires nested verification of both encrypted components, creating a layered security mechanism that prevents internal leakage while maintaining reliability.
2Reliability
If open software is stored in protection zone, then software integrity is improved, but processing speed decreases due to encryption overhead
Solution Approach 1:
The patent performs preliminary encryption of the secret key components before actual data processing operations. The first secret key is pre-encoded using the private key and stored in the protection zone, while the second secret key is pre-encoded using signature information. This preliminary action ensures that during actual processing, the integrity verification can be performed efficiently without repeated encryption overhead, thus maintaining both software integrity and processing speed.
Data Source
AI summary
An electronic device is disclosed. The present electronic device comprises: a communication device for communicating with an external device; a memory for storing data; and a processor for supporting a trusted execution environment (TEE) function, wherein the processor is configured to store a received open software in a protection zone corresponding to the TEE function, when the open software, signature information corresponding to the open software, and hash information corresponding to the open software are received from the external device, generate a secret key corresponding to the open software, and perform an operation corresponding to the open software by using the open software and the data, stored in the protection zone.