Trusted Execution Environment for Secure Computer Backup
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional backup methods for computers and mobile devices are inadequate in restoring systems compromised by ransomware, DDoS attacks, and other threats, as they often rely on OS services and system calls, which can lead to reinstallation on compromised structures, allowing further intrusion.
Innovation Solution
A method that creates a mirror image of a device's hard drive, including firmware and OS artifacts, using a trusted execution environment (TEE) for backup and restoration, independent of conventional OS services, ensuring the structural integrity of the device is maintained during the restoration process.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional backup methods using OS services and system calls are used, then backup operations are simple to implement, but the restored system may be reinstalled on compromised structures allowing further intrusion
Solution Approach 1:
The system separates the backup/restore operations from the compromised OS by using a Trusted Execution Environment (TEE) as an isolated secure compartment. The TEE contains the backup agent and restore processes, preventing interaction with potentially compromised OS services and system calls, thus ensuring system integrity while maintaining manageable complexity through clear separation of concerns
Solution Approach 2:
The TEE acts as an intermediary between the backup operations and the host system. The backup agent running in the TEE mediates all backup and restore operations, providing a secure interface that prevents direct interaction with compromised OS structures. This intermediary layer ensures reliability by blocking malicious paths while preserving ease of operation through standardized interfaces
2Reliability
If a trusted execution environment is used for backup and restoration, then system integrity is maintained during restoration, but the backup process becomes more complex
Solution Approach 1:
The system performs preliminary actions by establishing the TEE and deploying the backup agent before any backup or restore operations occur. The TEE is constructed with necessary security permissions and the backup agent is pre-configured with encryption keys and authentication credentials. This preliminary setup, though adding initial complexity, enables subsequent backup and restore operations to proceed reliably without repeatedly dealing with complex security configurations
Solution Approach 2:
The TEE-based backup system is designed to be universal, supporting multiple backup targets (local storage, remote servers, cloud services) and multiple restore scenarios through a single unified architecture. The backup agent can operate in different modes (full backup, incremental backup, differential backup) and the same TEE infrastructure serves both backup and restore functions, reducing overall implementation complexity despite the enhanced security requirements
Data Source
AI summary
A method of restoring an image of a computer, including identifying, by a backup application executing on the computer, artifacts of the computer to back up, creating a mirror image of a hard drive of the computer, wherein the mirror image comprises the artifacts, establishing a local environment within the computer, communicating with a backup server, by the backup application, using the local environment in the computer, backing up the mirror image, by the backup application, to the backup server using the local environment, updating the mirror image, by the backup application, in the backup server in response to a change in the computer, constructing the local environment on the computer in response to an event, loading a program from the local environment, and restoring the computer, by the backup application, from the mirror image in the backup server based on the artifacts, the program, and the restore process.