Trusted VM Data Processing Across REE and TEE Boundaries
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Virtual machines in computing devices are vulnerable to malicious attacks by hackers, compromising user data security.
Innovation Solution
The hardware resources of a computing device are divided into a rich execution environment (REE) side and a trusted execution environment (TEE) side, with data processing performed on the TEE side using a target VM to enhance security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If virtual machines are run on the REE side for general data processing, then ease of operation and resource accessibility are improved, but security vulnerability to hacker attacks increases
Solution Approach 1:
The computing device is segmented into two distinct execution environments: REE side for general operations and TEE side for secure data processing. Virtual machines are selectively deployed on different sides based on security requirements, with confidential VMs running on the TEE side to protect against hacker attacks while maintaining operational functionality on the REE side.
Solution Approach 2:
A secure communication mechanism is introduced as an intermediary between the REE side and TEE side, enabling data transfer and coordination while maintaining security boundaries. This intermediary allows confidential VMs on the TEE side to process data securely while still being accessible and controllable from the REE side.
2Reliability
If virtual machines are run on the TEE side to improve security, then security of user data is improved, but device complexity increases due to dual environment management
Solution Approach 1:
The computing device is designed with multi-functionality, capable of running both REE and TEE environments with their respective virtual machines. The system can dynamically select which environment to use based on the security requirements of the data being processed, making the dual-environment architecture adaptable and manageable rather than overly complex.
Data Source
Figure 1~2
Figure 3
Figure 4
AI summary
This application provides a data processing method and apparatus, and a computer-readable storage medium, which may be applied to a computing device. A hardware resource of the computing device is divided into (rich execution environment, REE) and (trusted execution environment, TEE) sides. The method includes the following steps: A processor of a computing device obtains to-be-processed data on the REE side, and then runs a target virtual machine (virtual machine, VM) on the TEE side to process the to-be-processed data. The target VM is any one of one or more VMs included on the TEE side. The method can reduce a risk that a VM is attacked by a hacker, and improve security of user data.