A Design and Verification Methodology for a TrustZone Trusted Execution Environment

Abstract

Hardware support for isolated execution (e.g., ARM TrustZone) enables the development of a trusted execution environment (TEE) that ensures the security of the code and data while communicating with a compromised rich execution environment (REE). The ability to satisfy various security services is complicated and usually consists of trusted applications, a trusted kernel and a secure monitor. However, formally verifying the security of an entire TEE security remains challenging. We present a methodology for designing a TEE in a way that enables verification of its security properties. Our methodology consists of forcing a trusted application and kernel to communicate with an REE via a narrow interface and compile and link them with a small secure monitor that implements the interface and runs at the highest privilege level. We provide functional verification of the secure monitor to ensure that it correctly switches the TEE/REE, communicates with the REE at a pre-defined memory space and has no integer overflow vulnerability. We also perform a verification of the secure monitor's scheduler to ensure that it satisfies information flow noninterference. We present a modular verification framework that can prove an end-to-end security property for cross-language programmes (e.g., C and assembly languages). Our evaluation suggests that the methodology scales to real-world TEE applications. INDEX TERMS Formal verification, information flow noninterference, trusted execution environment, TrustZone. FIGURE 3. Secure storage method that illustrates the impact of different TEE design architectures on formal verification tasks.

STBEAT: Software Update on Trusted Environment Based on ARM TrustZone

“…Thanks to the TrustZone [10][11][12] support of the STM32MP157 microprocessor, our system protection solution is all encompassing and not limited to the CPU context. The architecture provides the bus and peripheral infrastructure to ensure that the secure world uses a fully secure pipeline to control secure peripherals.…”

An Optimization Methodology for Adapting Legacy SGX Applications to Use Switchless Calls

“…However, cloud-based services suffer from the lack of a mechanism to protect their software from the privileged software controlled by the cloud platform provider, which means that they have to trust the cloud platform not to leak, corrupt, or misuse their secrets. CPU vendors have released powerful hardware-based protection mechanisms called trusted execution environments (TEEs) [6][7][8] to address this. TEE ensures the integrity and confidentiality of the encrypted memory region and provides a trusted computing base (TCB) to launch a secure execution environment from the untrusted part of the system.…”