Abstract: A computing device executes one or more trusted execution environment (TEE) processes in a TEE of a processor. The one or more TEE processes cryptographically protect a secret and a policy. The policy specifies a plurality of conditions on usage of the secret. A particular non-TEE process generates a request whose fulfillment involves an action requiring use of the secret. Responsive to the request, one or more non-TEE processes determine whether a first subset of the plurality of conditions is satisfied. Responsive to the first subset of the plurality of conditions being satisfied, the one or more TEE processes determine that a second, different subset of the plurality of conditions is satisfied. Responsive to determining the second subset of the plurality of conditions is satisfied, the one or more TEE processes use the secret to perform the action.

Abstract: A trusted execution environment (TEE) of a computing device may receive an operation request requiring use of a protected data accessible only to the TEE. Responsive to receiving the operation request, the TEE may generate first data. The computing device may send the first data to a remote computing device. Responsive to sending the first data, the TEE may receive second data. The TEE may validate the second data to verify the remote computing device generated the second data. Responsive to validating the second data was generated by the remote computing device, the TEE may perform the requested operation using the protected data.

Abstract: A device includes a processor, a hardware component, a communication channel between the processor and the hardware component, and a secure memory that stores a baseline value of an electrical characteristic of the connection. The processor is configured to determine, during a boot process of the computing device, a value of the electrical characteristic, the electrical characteristic being one or more of impedance, inductance, capacitance, or frequency response, determine whether the value is within a threshold amount of the baseline value, and, responsive to determining that the value of the electrical characteristic is within the threshold amount, complete the boot process, and, responsive to determining that the value of the electrical characteristic is not within the threshold amount, prevent the computing device from completing the boot process.

Abstract: A trusted execution environment (TEE) of a computing device may receive an operation request requiring use of a protected data accessible only to the TEE. Responsive to receiving the operation request, the TEE may generate first data. The computing device may send the first data to a remote computing device. Responsive to sending the first data, the TEE may receive second data. The TEE may validate the second data to verify the remote computing device generated the second data. Responsive to validating the second data was generated by the remote computing device, the TEE may perform the requested operation using the protected data.