TrEE Driver Standard Interface Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing operating systems face challenges in interfacing with secure environments due to the lack of flexibility in proprietary interfaces, which are often monolithic and fail to address quality of service and security issues, requiring specialized programming and changes to the operating system.
Innovation Solution
A Trusted Execution Environment (TrEE) driver provides a consistent interface for operating system components to communicate with secure services, translating message packages and managing hardware interfaces to support arbitrary services and prioritize IO operations securely.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If proprietary monolithic interfaces are used to interface with secure environments, then security is provided, but flexibility and adaptability are reduced
Solution Approach 1:
The patent segments the monolithic proprietary interface into a standardized base interface and multiple specialized mini-port drivers. The standardized interface provides common security functions, while mini-port drivers handle specific secure environment requirements. This segmentation allows the system to maintain security through the standardized interface while gaining flexibility through customizable mini-port drivers that can be added or modified without changing the core interface.
Solution Approach 2:
The patent creates a universal standardized interface that can work with multiple different secure environments through the use of mini-port drivers. The standardized interface provides multi-functional capability by supporting various secure environment types (TPM, HSM, secure graphics, etc.) through a common architecture, allowing the same interface framework to serve multiple purposes across different platforms.
2Reliability
If proprietary monolithic interfaces are used, then security is maintained, but device complexity and programming requirements increase
Solution Approach 1:
The patent introduces a standardized interface as an intermediary layer between the operating system and secure environments. This intermediary provides a common programming model and translation layer, so developers write code against the standardized interface rather than dealing with proprietary interfaces directly. The mini-port drivers act as intermediaries that translate standardized interface calls into secure environment-specific operations, reducing programming complexity while maintaining security.
3Reliability
If proprietary interfaces are used, then platform-specific security is provided, but quality of service and extensibility are limited
Solution Approach 1:
The patent implements a dynamic architecture where the standardized interface can adapt to different secure environments through loadable mini-port drivers. The system can dynamically load, unload, and configure mini-port drivers based on the specific secure environment present and the operational requirements. This dynamic capability enables the interface to optimize quality of service for different scenarios while maintaining a consistent security model.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Constructs to define a Trusted Execution Environment Driver that can implement a standard communication interface in a first environment for discovering and/or exchanging messages with secure applications/services executed in a Trusted Execution Environment (TrEE). The first environment can represent an environment with a different security policy from the TrEE. The TrEE driver can include a standard interface and/or mechanism by which applications/services and drivers within a first environment can access secure applications/services in the TrEE, a standard interface and/or mechanism by which third-party vendors can expose their TrEE applications/services to a first environment, a standard interface and/or mechanism by which a TrEE can request applications/services, on its own behalf, from the first environment, and a standard interface and/or mechanism to facilitate the management of secure application/services and/or provide I/O prioritization and security protection for individual secure applications/services.