Trusted Execution Environment Secure Time Offset Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing solutions for maintaining secure time in computing devices with a Trusted Execution Environment (TEE) are inadequate, particularly in Linux/Android systems, as they cannot prevent unauthorized manipulation of the real-time clock by the Rich Execution Environment (REE), and previous solutions are either inflexible or expensive in terms of silicon space.
Innovation Solution
Implementing a method where the TEE maintains a real-time clock with a stored offset in non-volatile memory, ensuring that the protected reference time remains unchanged by adjusting both the real-time clock and offset equally, and using a Replay Protected Memory Block or Electrically Erasable Programmable Read-Only Memory for secure storage and authentication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the REE maintains control of the real-time clock, then the system is easier to operate and less complex, but the security of the time reference is compromised as the REE can be hacked to manipulate time
Solution Approach 1:
The patent segments the time management functionality by separating the real-time clock control into the Trusted Execution Environment (TEE) while allowing the Rich Execution Environment (REE) to maintain an offset value. This segmentation enables the REE to appear in control for ease of operation while the TEE actually controls the secure time reference, resolving the contradiction between security and operational simplicity.
Solution Approach 2:
The patent introduces an intermediary mechanism where the REE does not directly control the RTC but instead manages an offset value that the TEE uses to calculate the secure time reference. This intermediary offset approach allows the REE to influence time management without having direct access to or control over the secure RTC, maintaining both security and operational flexibility.
2Reliability
If a single RTC is used shared between TEE and REE, then hardware requirements are reduced and cost is lowered, but the security of the TEE time reference is compromised
Solution Approach 1:
The patent segments the time reference into two components: the secure RTC maintained by the TEE and the offset value managed by the REE. This segmentation allows a single physical RTC to serve both environments securely, with the TEE having exclusive control over the RTC while the REE controls only the offset, eliminating the need for two separate clocks.
Solution Approach 2:
The patent changes the parameter control approach by allowing the REE to modify only the offset parameter rather than the RTC value itself. The secure time reference is derived by adding the offset to the RTC value, and the TEE verifies the integrity of this calculation. This parameter change approach enables secure time management with a single shared RTC.
3Adaptability or versatility
If the REE can freely adjust the RTC time, then the system is more flexible and easier to operate, but the integrity of the secure time reference is compromised
Solution Approach 1:
The patent introduces the offset value as an intermediary between the REE's time adjustment requests and the secure time reference. The REE can freely adjust the offset to provide flexibility for time zone changes, daylight saving time, and other adjustments, while the TEE maintains control over the RTC and verifies the integrity of the secure time reference through cryptographic authentication.
Solution Approach 2:
The patent extracts the security-critical RTC control from the REE and places it exclusively in the TEE, while leaving the non-critical offset management in the REE. This extraction allows the REE to have full flexibility in adjusting time parameters through the offset without compromising the integrity of the secure time reference, which remains under TEE control.
Data Source
AI summary
An exemplary method of maintaining secure time in a computing device is disclosed in which one or more processors implements a Rich Execution Environment (REE), and a separate Trusted Execution Environment (TEE). The TEE maintains a real-time clock (RTC) that provides a RTC time to the REE. A RTC offset is stored in non-volatile memory, with the RTC offset indicating a difference between the RTC time and a protected reference (PR) time. Responsive to a request from the REE to read the RTC time, a current RTC time is returned to the REE. Responsive to a request from the REE to adjust the RTC time, the RTC time and the corresponding RTC offset are adjusted by a same amount, such that the PR time is not altered by the RTC adjustment. An exemplary computing device operable to implement the method is also disclosed.