Trusted Application Platform for Cross-TEE Bytecode Deployment

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing trusted applications are often developed for specific TEE OS hardware platforms, necessitating multiple versions for different platforms, and there is a lack of effective management across these platforms.

Innovation Solution

An electronic device and method that utilizes a trusted application development platform to manage native and bytecode trusted applications across multiple TEE OS platforms, enabling unified development and deployment through identification information and conversion interfaces.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If multiple versions of trusted applications are developed for different TEE OS hardware platforms, then platform-specific functionality is improved, but device complexity and development costs increase

Engineering Contradiction:
Improveplatform compatibilityVSAvoidapplication version management
Core Design Contradiction:
Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The trusted application is segmented into two distinct parts: a platform-independent bytecode version that contains the core application logic, and platform-specific native adapter layers that handle TEE OS-specific operations. This segmentation allows the bytecode to be universally compatible while the adapters provide platform-specific functionality, eliminating the need for multiple complete application versions.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

A bytecode virtual machine (VM) is introduced as an intermediary between the bytecode trusted application and the underlying TEE OS hardware platforms. The VM translates and executes bytecode instructions, providing a unified execution environment that abstracts away platform differences. Platform-specific adapters act as intermediaries between the VM and individual TEE OS systems, enabling universal bytecode to run across diverse platforms without modification.

Inventive Principle:
Principle #24Intermediary (Mediator)

2Productivity

If a unified bytecode trusted application is developed for cross-platform use, then development efficiency is improved, but execution precision and platform-specific optimization are reduced

Engineering Contradiction:
Improvedevelopment efficiencyVSAvoidplatform-specific optimization
Core Design Contradiction:
ProductivityVSManufacturing precision

Solution Approach 1:

The system changes the execution parameters of the trusted application by compiling it to bytecode with adjustable optimization levels. The bytecode can be compiled with different parameters depending on the target platform characteristics, allowing the same source code to produce optimized binaries for specific platforms while maintaining cross-platform compatibility through the bytecode VM execution layer.

Inventive Principle:
Principle #35Parameter changes

Data Source

PatentUS12541597B2Electronic device
Publication Date: 2026.02.03 CHINA UNIONPAY
  • US12541597B2 patent drawing
  • US12541597B2 patent drawing
  • US12541597B2 patent drawing

AI summary

An electronic device and a trusted application calling method are provided. After a client application initiates call information, a trusted application development platform receives the call information, determines a native trusted application corresponding to first identification information of the electronic device carried by the calling information from native trusted applications corresponding to at least two (or more) TEE OSs connected to the trusted application development platform, and sends the calling information to the native trusted applications corresponding to the first identification information. The native trusted application corresponding to the first identification information receives the calling information, determines a bytecode trusted application corresponding to the second identification information from at least one bytecode trusted application installed in the native trusted application according to the second identification information carried by the calling information, and calls the bytecode trusted application corresponding to the second identification information.