Secure Memory Storage via TPM and TEE Binding
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cryptography methods in mobile devices are vulnerable to brute force attacks and do not adequately bind cryptographic keys to a specific device, failing to meet security standards, especially in scenarios where user passwords and salt values are stored in an open memory area.
Innovation Solution
A method that utilizes a Trusted Platform Module (TPM) and Trusted Execution Environment (TEE) to create a hardware-backed secure memory storage by generating a blob using a random number, Platform Configuration Registers, and user password, then re-encrypting it with a hardware-specific key using AES-CBC, ensuring the cryptographic keys are bound to the device and secure.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cryptography methods are used to protect data on memory storage, then data security is improved, but the system becomes vulnerable to brute force attacks and does not adequately bind cryptographic keys to a specific device
Solution Approach 1:
The patent introduces a Trusted Platform Module (TPM) as an intermediary hardware component that securely stores cryptographic keys and binds them to the specific device. The TPM acts as a mediator between the encryption system and the device hardware, preventing key extraction and brute force attacks by ensuring keys can only be used within the authenticated device context.
Solution Approach 2:
The patent changes the fundamental parameter of key storage from software-based to hardware-based. By moving cryptographic key storage into the TPM hardware module, the system transforms the security model from relying on software encryption algorithms to relying on hardware-enforced key protection, making brute force attacks impractical.
2Ease of operation
If user passwords and salt values are stored in open memory area, then ease of operation is improved, but security is compromised
Solution Approach 1:
The patent extracts sensitive cryptographic materials (keys, passwords, salt values) from the open memory area and relocates them to the secure TPM hardware module. This separation allows the system to maintain ease of operation for legitimate users while preventing unauthorized access, as the sensitive data remains isolated in the secure hardware enclave.
3Adaptability or versatility
If cryptographic keys are not bound to a specific device, then adaptability is improved, but security standards are not met
Solution Approach 1:
The patent segments the cryptographic key management system into device-specific and portable components. The TPM binds keys to the specific device hardware for security compliance, while the encryption system maintains adaptability by allowing different encryption schemes and key derivation methods to be applied based on the specific use case and device capabilities.
Data Source
Figure 1~2
Figure 3
AI summary
A solution for securing a memory storage is provided. A user password is received (202). A random number is read (206) from Trusted Platform Module. Values of one or more Platform Configuration Registers of the Trusted Platform Module are received (210) and a blob is created (212) using the random number and the values from the one or more registers and the user password. The blob is encrypted (216) in the Trusted Platform Module and re-encrypted (222) in a Trusted Execution Environment execution mode of the apparatus utilizing hardware specific key and the user password and the re-encrypted blob is stored (226).