Patent ID: 11934516
Assignee: AXIS AB
Field: Digital communication (Electrical engineering)
Classification: CPC G  H | IPC G  H

Claim 4:
5. A non-transitory computer-readable storage medium having stored thereon instructions for implementing a method, when executed by a system having processing capabilities, the method for enabling secure processing of data using an untrusted processing application configured to process the data, wherein the method is performed within a secure application framework running in a trusted execution environment and controlling all input to a nd output from the untrusted processing application, wherein the untrusted processing application is running in the trusted execution environment, and wherein the computer implemented method comprises:
receiving the data encrypted using a first random key;
receiving the first random key in a secure way;
decrypting the encrypted data using the first random key, thereby obtaining the data;
inputting the data to the untrusted processing application;
executing the untrusted processing application to process the input data;
receiving output data from the untrusted processing application, wherein the output data are unencrypted;
generating a second random key;
encrypting the output data using the second random key;
encrypting the second random key using a public key of a storage device; and
sending the encrypted output data and the encrypted second random key to the storage device, wherein the storage device is located outside the trusted execution environment;
within a device comprising a secure module:
generating a private/public key pair for the storage device;
receiving the first random key encrypted using the public key of the storage device;
decrypting the first random key using the private key of the storage device; and
sending the first random key in a secure way to the secure application framework, and
within the secure application framework running in the trusted execution environment:
generating a private/public key pair for the untrusted processing application,
wherein receiving the first random key in a secure way comprises:
receiving the first random key encrypted using the public key of the untrusted processing application; and
decrypting the first random key using the private key of the untrusted processing application.