Trusted Application Interface Composition for Secure Service Requests
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The frequent changes in service requests from client applications in a rich execution environment (REE) lead to high costs and inflexibility in upgrading or modifying trusted applications in a trusted execution environment (TEE), as conventional methods require manual modification of processing logic for each service request change.
Innovation Solution
Abstracting self-consistent interfaces corresponding to functional units of the trusted application and exposing them externally, allowing client applications to invoke combinations of these interfaces to execute services without needing to upgrade or modify the trusted application, thereby enabling flexible and secure service request processing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If the trusted application is frequently upgraded or modified to process frequently changing service requests, then the service request processing capability is improved, but the maintenance cost and complexity increase significantly
Solution Approach 1:
The patent segments the service request processing into two independent parts: a stable trusted application providing core security functions, and a flexible interface layer that handles service request variations. By dividing the system this way, the trusted application doesn't need to be modified when service requests change, resolving the contradiction between adaptability and maintenance complexity.
Solution Approach 2:
The patent introduces an intermediary layer (interface layer) between the client application and the trusted application. This intermediary handles the variations in service requests by selecting and composing different interface combinations, while the trusted application remains unchanged. The intermediary acts as a mediator that absorbs the complexity of changing service requests.
2Adaptability or versatility
If the trusted application is modified to accommodate new service requests, then the functional versatility is improved, but the security stability deteriorates
Solution Approach 1:
The patent segments the trusted application into core security functions (maintained in the TEE) and service interface functions (exposed externally). By separating these, the core security stability is preserved while the interface layer can adapt to new service requests without compromising security.
Solution Approach 2:
The trusted application provides universal core security functions that remain stable, while multiple service interfaces can be composed to handle different service requests. This multi-functionality at the interface layer allows the system to maintain security stability while achieving functional versatility.
3Manufacturing precision
If manual modification of processing logic is performed for each service request change, then the processing accuracy is improved, but the processing time and efficiency deteriorate
Solution Approach 1:
The patent pre-defines a set of stable interfaces with their processing logic in the trusted application. When service requests change, the system doesn't need to manually modify processing logic but can instead compose existing interfaces in different sequences or combinations. This preliminary preparation of interfaces eliminates manual modification needs and improves efficiency.
Solution Approach 2:
Instead of copying and modifying the entire processing logic for each service request change, the patent reuses existing interface definitions and composes them differently. This approach maintains processing accuracy by reusing verified interface logic while significantly improving efficiency by avoiding redundant modifications.
Data Source
Figure 1~2
Figure 3~4
Figure 5~6
AI summary
Embodiments of the present specification provide secure service request processing methods and apparatuses. The methods are executed by a trusted application that is deployed in a trusted execution environment (TEE) of an end-user device. The trusted application externally provides several interfaces, and each interface corresponds to one functional unit of the trusted application. The end-user device further includes a rich execution environment (REE), and a client application is deployed in the REE. The processing method includes: receiving, from the client application, a first service request for requesting the trusted application to execute a first service. The first service request includes a first expression and an input parameter of the first expression, and the first expression specifies a plurality of target interfaces related to the first service and an invoking sequence of the plurality of target interfaces. Based on the input parameter, the plurality of target interfaces are executed in turn in the invoking sequence to obtain a target execution result, The target execution result is used as a processing result of the first service request, and the processing result of the first service request is returned to the client application.