Trusted Execution Environment Secure User Interface Display
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Mobile payment security is compromised in open rich execution environments due to the risk of information leakage and malware transmission, making it difficult to protect sensitive information such as payment amounts and passwords from malicious applications.
Innovation Solution
Implementing a trusted user interface (TUI) display method that uses a trusted execution environment (TEE) to isolate sensitive operations, allowing only authenticated applications to access secure resources, thereby preventing interception of user input and display.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If TUI is displayed in full screen on TEE side, then security of sensitive information is improved, but compatibility with CA interface controls and user experience deteriorates
Solution Approach 1:
The display interface is segmented into two independent rendering systems: one for the trusted user interface (TUI) in the TEE and another for the client application (CA) interface in the REE. Each segment maintains its own control set and rendering logic, allowing both to coexist without interference. The status bar and navigation bar are separated as independent segments that can be selectively displayed.
Solution Approach 2:
A display management intermediary layer is introduced to coordinate between the TUI and CA interface. This intermediary handles the composition of both interfaces, manages z-ordering, and controls the visibility of shared elements like the status bar and navigation bar, ensuring seamless integration while maintaining security boundaries.
2Reliability
If TUI is displayed in full screen on TEE side, then security of sensitive information is improved, but user experience deteriorates due to inability to see status bar and navigation bar
Solution Approach 1:
The TUI and CA interface are merged into a unified display composition where both can be visible simultaneously. The status bar and navigation bar from the CA interface are merged into the display hierarchy, allowing users to access both secure TUI functionality and familiar navigation elements in a single view.
Solution Approach 2:
Different regions of the display are assigned different quality characteristics: the TUI occupies the primary secure region with full functionality, while the status bar and navigation bar occupy peripheral regions with simplified rendering. This allows each region to optimize for its specific purpose while contributing to the overall user experience.
3Reliability
If separate rendering is used for TUI and CA interface, then security isolation is maintained, but display consistency and control compatibility worsen
Solution Approach 1:
The display rendering system is designed with universal capabilities that can handle both TUI and CA interface requirements. A unified rendering engine processes both interface types, applying consistent transformation, positioning, and composition rules. This multi-functional approach ensures display consistency while maintaining the security boundaries through logical separation of rendering contexts.
Data Source
Figure 1
Figure 2
Figure 3~4
AI summary
Embodiments of this application provide a solution for compatibility between TUI display and Android display. Based on a native control provided by a rich operating system, a customized secure control is further added, thereby simplifying TUI development. Further, the rich operating system performs drawing processing on a native control in a user interface, synchronizes a non-secure surface obtained after processing to a frame buffer of a trusted operating system on a TEE side, and transfers identified information about a secure control in the user interface to the trusted operating system on the TEE side. The trusted operating system processes drawing processing on the secure control based on the information about the secure control and a customization method corresponding to the secure control, composites a secure surface and the non-secure surface that are obtained after processing, and then displays a composited surface by using a display.