Apparatus and method for providing secure execution environment for mobile cloud

A cloud server, comprising:

• a general communicator to receive authentication information from a general executor of a secure execution environment provision apparatus installed in a user terminal, individually verify the general executor and a secure executor of the secure execution environment provision apparatus using the authentication information, and transmit a security key required for secure communication to the general executor when verification of the general executor and the secure executor succeeds;
• a secure communicator to perform the secure communication with the secure executor of the secure execution environment provision apparatus when the secure executor has verified the security key received from the general executor;
• and
• a storage to store data corresponding to a cloud service,
• wherein the general executor generates the authentication information that includes general authentication information corresponding to the general executor and generated by the general executor and secure authentication information received from the secure executor,
• wherein the cloud server registers the secure execution environment provision apparatus by receiving registration request information including executor information, including secure executor information corresponding to the secure executor and general executor information corresponding to the general executor, from the general executor and transmitting registration confirmation information to the general executor,
• wherein the secure communicator performs the secure communication with the secure executor that runs a service execution monitor by establishing a secure communication channel with the secure executor or by performing data encryption, and
• wherein when a data storage request is received from the secure executor, the secure communicator transmits the data, which is encrypted using a public key of the secure executor, to the secure executor.

A method for providing a secure execution environment for a mobile cloud, comprising:

• transmitting, by a general executor of a secure execution environment provision apparatus installed in a user terminal, authentication information that includes secure authentication information and general authentication information to a cloud server;
• individually verifying, by the cloud server, the general executor and a secure executor of the secure execution environment provision apparatus, based on the authentication information;
• transmitting, by the cloud server, a security key required for secure communication to the secure executor through the general executor when verification of the general executor and the secure executor succeeds;
• verifying, by the secure executor, the security key and running a service execution monitor;
• and
• providing, by the cloud server, a service by performing the secure communication with the secure executor that runs the service execution monitor,
• wherein the general authentication information corresponds to the general executor and is generated by the general executor, and the secure authentication information is generated by the secure executor, and
• wherein the method further comprises:
• generating, by the general executor, executor information that includes secure executor information received from the secure executor and general executor information corresponding to the general executor;
• transmitting, by the general executor, registration request information including the executor information to the cloud server;
• and
• receiving, by the general executor, registration confirmation information from the cloud server that has completed registration of the secure execution environment provision apparatus,
• wherein the method further comprises:
• requesting, by the secure executor, the cloud server to store data;
• receiving, by the secure executor, encrypted data from the cloud server;
• and
• decrypting and storing, by the secure executor, the encrypted data,
• wherein the method further comprises:
• receiving, by the secure executor, the registration confirmation information from the general executor;
• decrypting, by the secure executor, a passcode included in the registration confirmation information;
• and
• re-encrypting and storing, by the secure executor, the passcode, and
• wherein the secure authentication information includes the passcode encrypted using a public key of the cloud server.