Trusted Execution Environment for Secure TLS Key Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The security of Transport Layer Security (TLS) servers in mobile devices can be unknowingly compromised by malicious software, making online transactions insecure, especially in scenarios where traditional verification methods like password or PIN entry are inconvenient and impractical.
Innovation Solution
Implementing a Trusted Execution Environment (TEE) within mobile devices to generate and manage TLS key pairs securely and integrating biometric authentication, such as fingerprint scanning, to enhance transaction security, thereby reducing the risk of unauthorized transactions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional verification methods like password or PIN entry are used, then user verification can be performed, but the process becomes time consuming and inconvenient for users
Solution Approach 1:
The patent replaces manual password/PIN entry with automated biometric authentication using fingerprint sensors. The biometric verification unit automatically captures and verifies user identity through fingerprint scanning, eliminating the need for manual input while maintaining security. This substitution of mechanical verification with automated biometric recognition resolves the contradiction between verification security and verification time.
2Reliability
If TLS server is implemented in mobile device, then communication security is improved, but the security can be unknowingly compromised by malicious software
Solution Approach 1:
The patent segments the mobile device into two distinct environments: the normal operating system environment and the trusted execution environment (TEE). The TLS server is specifically implemented within the TEE, which is isolated from the main operating system. This segmentation prevents malicious software in the normal OS from compromising the TLS server, as the TEE provides a secure, isolated runtime environment with protected memory and cryptographic operations.
Solution Approach 2:
The trusted execution environment acts as an intermediary layer between the malicious software in the normal OS and the TLS server. The TEE client interfaces between the requesting application and the payment application within the TEE, providing a secure mediation layer that prevents direct access to sensitive cryptographic operations by untrusted software.
3Reliability
If out of band verification process is implemented, then communication security is maintained, but the approach is time consuming and inconvenient for users
Solution Approach 1:
The patent implements self-service biometric authentication where the user simply places their fingerprint on the sensor for automatic verification. The system automatically captures the biometric data, compares it against stored templates, and authenticates the user without requiring manual intervention or additional verification steps. This self-service approach maintains security while dramatically improving user convenience compared to traditional out-of-band verification methods.
Data Source
AI summary
According to some embodiments, a requesting application executing on a mobile device may request a transport layer security key pair in connection with a payment transaction. Responsive to the request, a trusted execution environment client of the mobile device may route a request to a payment application executing in a secure trusted execution environment of the mobile device. It may then be arranged, within the secure trusted execution environment, to create the transport layer security key pair and provide key pair to the requesting application. Moreover, in some embodiments, the mobile device may transmit payment transaction information to an access control server and receive a request for biometric authentication. It may then be arranged for hardware within the mobile device to biometrically authenticate a user of the mobile device.