Trust Zone Access Control Addressing for Secure Mobile Device Communication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Mobile communication devices face challenges in securely managing and updating trusted security zones, which store confidential information, due to the risk of malware and unauthorized access from normal security zones.
Innovation Solution
Implementing a Trust Zone Access Control (TZAC) address system, where each trusted security zone has a unique identifier associated with hardware components, allowing secure communication and access control between normal and trusted security zones, using encryption and hardware-assisted security to prevent unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If normal security zones access trusted security zones directly, then communication between zones is simplified, but security and integrity of trusted security zones deteriorates due to malware and unauthorized access risks
Solution Approach 1:
The system segments the communication address space into two distinct parts: a public routing address for device-level communication and a private TZAC address for trusted security zone identification. This segmentation allows normal applications to communicate with the device while the TZAC address remains hidden and protected, enabling simplified communication interfaces without compromising security.
Solution Approach 2:
The modem acts as an intermediary component that handles the mapping between public routing addresses and private TZAC addresses. It receives communications intended for the trusted security zone, performs address translation using stored mapping information, and forwards communications to the appropriate TZAC address while blocking unauthorized direct access attempts.
2Reliability
If trusted security zones use unique hardware identifiers for access control, then security and integrity are improved, but device complexity increases due to address mapping and routing requirements
Solution Approach 1:
The system employs self-service mechanisms where the modem automatically maintains and updates the mapping between routing addresses and TZAC addresses without requiring manual configuration or intervention from normal applications. The mapping information is stored in the modem's memory, enabling autonomous address translation and reducing the complexity burden on other system components.
3Adaptability or versatility
If direct access to trusted security zone memory and I/O is allowed, then application functionality is improved, but security deteriorates due to potential malware interference
Solution Approach 1:
The system extracts the trusted security zone's communication interface from direct exposure to normal applications by implementing address hiding. The TZAC address, which provides unique identification and access control, is kept hidden within the trusted security zone while a public routing address is presented to normal applications. This extraction allows applications to interact with the trusted zone through controlled interfaces while preventing direct access to sensitive memory and I/O resources.
Data Source
AI summary
A method of communicating with a computing device having a trusted security zone comprises mapping a unique identifier for a computing device with a trust zone access control (TZAC) address, composing a message comprising the trust zone access control address, and routing the message to the computing device based on the unique identifier. The computing device comprises a normal security zone and a trusted security zone that is separate from the normal security zone, and the trust zone access control address is a unique identifier associated with a hardware component of the trusted security zone within the computing device. The message is internally routed to the trusted security zone within the computing device using on the trust zone access control address.