Granted Patent B2

US 12,585,756 · App. 18/261,461 · Granted Mar 24, 2026

Inventors: Jinsoo Jang (Daejeon, KR); Brent Byunghoon Kang (Daejeon, KR)

Assignees: The Industry & Academic Cooperation Chungnam National University; Korea Advanced Institute of Science and Technology

G06F21/53G06F21/54G06F21/78G06F21/121

Abstract

Claims (15)

1 . An apparatus for reinforcing security of a trusted execution environment in a mobile device, the apparatus comprising:

a hypervisor configured to separate regions into a privileged region and a non-privileged region;

a region switch configured to perform switching between the privileged region and the non-privileged region by controlling a watchpoint and memory execution area write protection; and

a mode switch configured to perform switching between OS kernel mode and hypervisor mode by trapping by branch based on an exception occurrence privilege in order to protect vector integrity.

2 . The apparatus of claim 1 , wherein the privileged region protects a writable object such as a page table as privileged data, and separates an exception vector and privileged region code based on a granularity of page.

3 . The apparatus of claim 1 , wherein the non-privileged region emulates, for a monitored OS kernel, updates of a page table and a system register.

4 . The apparatus of claim 1 , wherein the region switch unit checks an OS request type in an exception vector, and performs the switching between the regions through a secure gate that configures the watchpoint and a memory execution area write protection flag in order to isolate the privileged region.

5 . The apparatus of claim 1 , wherein the region switch performs switching to the privileged region by using a hypercall captured by an exception vector upon receiving a request for updating a hypervisor page table while executing the non-privileged region.

6 . The apparatus of claim 1 , wherein, in the mode switch, a hypercall triggered in an OS kernel is trapped by branch due to an exception with a lower privilege, and

all exceptions that occur in hypervisor mode execution are trapped by branch for a current privilege.

7 . A method for reinforcing security of a trusted execution environment in a mobile device, the method comprising:

invoking, from an OS kernel, a hypercall ported for OS kernel monitoring;

in response to the invoking, trapping, by an exception vector in a privileged region, a hypercall exception;

checking an OS request type to dispatch a handler in a non-privileged region and causing a region switch to occur from the privileged region to the non-privileged region; and

performing switching between the privileged region and the non-privileged region through a secure gate that configures a watchpoint and a memory execution area write protection flag in order to isolate the privileged region.

Assignments (1)

Priority Claims (1)

Continuity (1)

References Cited (39)