Trusted VM Execution Across REE and TEE for User Data Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Virtual machines (VMs) are vulnerable to malicious attacks by hackers, compromising the security of user data.
Innovation Solution
The hardware resources of a computing device are divided into a rich execution environment (REE) side and a trusted execution environment (TEE) side, with VMs running on the TEE side to enhance security, and processes such as creating, managing, and processing data are handled on the TEE side to reduce attack risks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If VMs run on the REE side, then ease of operation and device complexity are maintained, but security of user data deteriorates due to vulnerability to hacker attacks
Solution Approach 1:
The hardware resources of the computing device are segmented into two distinct sides: a Rich Execution Environment (REE) side for general operations and a Trusted Execution Environment (TEE) side for secure operations. This segmentation allows VMs to run in isolation on the TEE side, protecting user data from attacks while maintaining ease of operation on the REE side. The patent implements this by dividing hardware resources and creating separate execution environments with different security characteristics.
2Reliability
If VMs run on the TEE side, then security of user data improves, but device complexity increases due to hardware resource division
Solution Approach 1:
The hardware resources are segmented into TEE and REE sides, with the TEE side providing enhanced security for VM operations. This segmentation resolves the contradiction by isolating security-critical operations in the TEE environment while keeping the overall device manageable through clear resource division and dedicated management interfaces.
Solution Approach 2:
The patent introduces an intermediary mechanism that manages communication and coordination between the TEE and REE sides. This intermediary layer handles resource allocation, VM lifecycle management, and data transfer, thereby reducing the operational complexity that would otherwise arise from having separate execution environments.
3Reliability
If hardware resources are divided into REE and TEE sides, then security of user data improves, but ease of operation deteriorates due to environment switching
Solution Approach 1:
An intermediary management system is introduced that abstracts the complexity of operating across two environments. This intermediary handles VM creation, resource allocation, and data transfer between TEE and REE, presenting a unified interface to users and applications while maintaining the security benefits of the divided architecture.
Solution Approach 2:
The patent implements a universal management interface that can operate across both TEE and REE environments. This multi-functional interface handles various operations (VM management, data transfer, resource allocation) in a unified manner, reducing the operational complexity that would otherwise result from environment switching.
Data Source
AI summary
A data processing method applied to a computing device includes dividing a hardware resource of the computing device into a rich execution environment (REE) side and a trusted execution environment (TEE) side, obtaining to-be-processed data on the REE side, and running a target virtual machine (VM) on the TEE side to process the to-be-processed data. The target VM is any one of one or more VMs included on the TEE side.