Virtual SIM Management via Trusted Execution Environment Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing wireless communication devices face issues with securely storing and transmitting subscriber identification information, such as IMSI, which can lead to data leakage and user damage if not handled properly.
Innovation Solution
An electronic device is designed with a rich execution environment (REE) and a trusted execution environment (TEE) that includes a processor for executing applications, a communication circuit for data transmission, and a secure memory area for storing SIM data. It obtains a random value from a server, encrypts SIM data using public and private keys, and stores the SIM profile in a secure memory area, preventing data leakage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If SIM data is transmitted through the network for software SIM usage, then the electronic device can activate virtual SIM functionality, but the IMSI value may be leaked during communication or not safely stored
Solution Approach 1:
The patent divides the execution environment into two separate segments: Rich Execution Environment (REE) for application execution and Trusted Execution Environment (TEE) for secure key generation and decryption operations. This segmentation isolates sensitive cryptographic operations from the less secure application layer, preventing IMSI leakage while enabling virtual SIM functionality.
Solution Approach 2:
The patent introduces an agent as an intermediary component that bridges the REE and TEE. The agent receives decryption requests from applications in the REE, forwards them to the TEE, and retrieves the decrypted IMSI data. This intermediary ensures that sensitive operations occur in the secure environment while maintaining application accessibility.
2Reliability
If SIM data is stored in a secure area, then data leakage is prevented, but the complexity of the device architecture increases due to dual execution environments
Solution Approach 1:
The patent merges the security functions into a unified TEE that handles all cryptographic operations (key generation, decryption) regardless of which application or SIM profile is accessed. This consolidation reduces architectural complexity compared to having separate security modules for each function, while maintaining high security standards.
Solution Approach 2:
The TEE is designed as a universal secure environment that performs multiple functions: generating cryptographic keys, decrypting SIM data, and managing multiple SIM profiles. This multi-functionality eliminates the need for separate security subsystems, reducing overall device complexity while ensuring comprehensive security.
3Reliability
If public and private keys are generated by the second application in the TEE, then encrypted SIM data can be securely decrypted, but the key management process becomes more complex
Solution Approach 1:
The TEE performs self-service by automatically generating the public-private key pairs and managing the private keys without external intervention. The keys are created and stored within the secure environment, and the TEE itself handles the decryption operations using these keys. This self-contained approach simplifies key management compared to external key distribution systems.
Solution Approach 2:
The cryptographic keys are generated in advance during the TEE initialization phase, before any SIM data decryption is needed. This preliminary key generation ensures that secure decryption is immediately available when applications need it, eliminating the need for complex real-time key distribution or generation protocols.
Data Source
AI summary
An electronic device is provided. The electronic device includes at least one processor that is configured to execute a first application in an REE, to execute a second application in a TEE, and to execute an agent that performs data transmission between the first application and the second application, a communication circuit configured to communicate with a server, and a secure memory area that is accessible by the TEE. The at least one processor is configured to obtain a random value from the server, to transmit a response message including the random value to the server through the communication circuit, to receive encrypted SIM data from the server, to obtain a SIM profile from the encrypted SIM data using a private key corresponding to the public key, and to store the obtained SIM profile in the secure memory area.