TEE Shared Memory Data Transmission with Atomic Offset Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data transmission methods in Trusted Execution Environment (TEE) systems face inefficiencies, particularly in handling data overflow and ensuring secure, high-performance asynchronous data transmission between TEE and non-TEE environments.
Innovation Solution
A data transmission method and apparatus utilizing a shared memory with specific address structures for write and read offsets, allowing for efficient data writing and reading within the TEE system, including handling data overflow by discarding excess data and using atomic variables for security, without the need for locks to ensure thread safety.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If data transmission is performed between TEE and non-TEE environments using traditional methods, then data security is maintained, but transmission efficiency and performance are reduced due to overheads and locking mechanisms
Solution Approach 1:
The shared memory is segmented into multiple regions with different access permissions: a first region accessible only by the TEE side for writing data, and a second region accessible only by the non-TEE side for reading data. This segmentation eliminates the need for locks and synchronization mechanisms, thereby improving transmission efficiency while maintaining data security.
Solution Approach 2:
The patent extracts the security verification mechanism from the data transmission path by implementing an atomic variable that automatically tracks the readable length of data. This extraction removes the overhead of traditional locking mechanisms while preserving data integrity, as the atomic variable inherently prevents race conditions without requiring explicit lock operations.
2Reliability
If locks are used to ensure thread safety in shared memory access, then data integrity is maintained, but system performance and running speed deteriorate due to overheads
Solution Approach 1:
The atomic variable serves itself by automatically updating to reflect the current readable length of data in the shared memory. Each write operation increments the atomic variable, and each read operation decrements it, providing self-service thread safety without external locking mechanisms. This self-managing approach maintains data integrity while eliminating lock overheads that would reduce system running speed.
3Speed
If a simple shared memory structure is used for data transmission, then access speed is improved, but data security and thread safety cannot be ensured
Solution Approach 1:
Different regions of the shared memory are assigned different access qualities: the first region has write-only access from the TEE side with high speed, while the second region has read-only access from the non-TEE side with high speed. The atomic variable provides a centralized coordination point that ensures thread safety without slowing down the actual data access operations in either region, thus maintaining both speed and reliability.
4Productivity
If offset addresses are used to track data positions in shared memory, then data transmission efficiency is improved, but complexity increases in managing read and write offsets
Solution Approach 1:
The patent merges the management of read offset and write offset into a unified atomic variable that tracks the readable length of data. Instead of separately managing two offset pointers and their synchronization, the atomic variable consolidates this information into a single entity that is automatically updated by both read and write operations, thereby improving transmission efficiency while reducing offset management complexity.
Data Source
AI summary
Examples of a data transmission method and apparatus in TEE systems are described. One example of the method includes: obtaining first data; obtaining a write offset address by reading a first address; obtaining a read offset address by reading a second address; determining whether the number of bytes in the first data is less than or equal to the number of writable bytes, where the number of writable bytes is determined based on the write offset address and the read offset address, and each address corresponds to one byte; when the number of bytes in the first data is less than or equal to the number of writable bytes, writing the first data into third addresses starting from the write offset address; and updating the write offset address in the first address.