TEE Token Ownership Transfer for Secure Interconnected Operations
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
There is a need to improve security and robustness in controlling the execution of operations performed by interconnected devices, particularly when these devices are not owned by the same entity, to prevent intrusions and ensure data integrity.
Innovation Solution
A method and system that utilize a server connected to a database to manage digital tokens, which are securely transferred between devices equipped with hardware trusted execution environments (TEE) using encrypted protocols and zero-knowledge proof (ZKP) protocols for validation, ensuring secure offline and online communication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encryption protocols are used to secure data transmission between devices, then security against intrusions is improved, but communication complexity and processing overhead increase
Solution Approach 1:
The patent applies preliminary action by pre-establishing security credentials and encryption keys in the TEE before data transmission occurs. The TEE is configured with trusted application code and cryptographic materials in advance, enabling secure communication without requiring complex real-time key management or authentication negotiations during data exchange.
Solution Approach 2:
The TEE performs self-service by autonomously managing its own security credentials, cryptographic operations, and authentication processes without requiring external security infrastructure. The embedded trusted application within the TEE handles all security functions independently, eliminating the need for separate key management servers or authentication intermediaries.
2Reliability
If zero-knowledge proof protocols are implemented for validation, then data integrity and unauthorized use prevention are improved, but computational overhead and processing time increase
Solution Approach 1:
The patent extracts the computationally intensive zero-knowledge proof operations from the main processing system and confines them to the TEE. By isolating these heavy computational tasks within the secure hardware boundary, the system achieves data integrity verification without exposing the main processor to excessive computational overhead or energy consumption.
Solution Approach 2:
The system changes the parameter of computational complexity by leveraging the TEE's hardware-accelerated cryptographic operations. The TEE's specialized security processors provide optimized implementations of zero-knowledge proof algorithms, reducing the computational burden compared to software-based implementations on general-purpose processors.
3Reliability
If TEE is used to securely transfer only necessary sensitive data, then unauthorized use prevention is improved, but device complexity increases
Solution Approach 1:
The patent applies segmentation by dividing the device architecture into distinct security zones: the TEE for handling sensitive data and cryptographic operations, and the main processor for general-purpose computing. This segmentation isolates security-critical functions in a protected hardware enclave, preventing unauthorized access while maintaining overall system functionality.
Solution Approach 2:
The TEE implements a nested doll structure by containing an embedded trusted application within the hardware security boundary. The trusted application is nested inside the TEE's protected memory and processing resources, creating layers of security where the application operates within the hardware-enforced security context, preventing escape or tampering.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The invention relates to a method and corresponding system for controlling, via secured transfers of tokens, operations of a plurality of interconnected devices having each a hardware trusted execution environment (TEE) and a controller, wherein each controller owns tokens attributed by a supervisor server and the TEE of each device is adapted to respond to a validation challenge via a zero- knowledge proof (ZKP) protocol, and generate and validate a single use ownership digital signature and its corresponding ownership signature validation challenge. The tokens can be transferred from one interconnected device to another in an online manner via a server or an offline manner via direct communication between the devices.