The Dual-Execution-Environment Approach: Analysis and Comparative Evaluation

Abstract

Abstract. The dual-execution-environment approach (dual-EE) is a trusted model that was defined to allow mobile smart devices to guarantee tamper-resistant execution for highly sensitive applications. Although various solutions implementing dual-EE have been proposed in the literature, this model has not been formalized yet. In this paper, we revisit the dual-EE approach and propose a theoretical framework to systematize the design of dual-EE solutions regarding well-established primitives defined in the Multiple Independent Levels of Security (MILS) architecture. We provide a general classification of the different dual-EE proposals based on their isolation properties. We introduce a comparative framework allowing dual-EE solutions to be evaluated across a common set of criteria. The relevance of our framework is examined by applying it on three technologies, each one represents one category in our classification. Results are consistent and explain some hidden and unexpected properties of each technology. For instance, we find that bare-metal hypervisors are ill-adapted to provide high assurance security even though they might improve the overall security level of the system.

Edge-MultiAI: Multi-Tenancy of Latency-Sensitive Deep Learning Applications on Edge

“…Kernel Separation is a fundamental concept of the TEE architecture, as it underpins the essential property of isolated execution. This concept was first introduced in the context of a dual-execution environment model [17]. The primary objective of the separation kernel is to facilitate the cohabitation of diverse systems requiring different security levels on a single platform.…”

SECURECONFIG: NFC and QR-code based hybrid approach for smart sensor configuration

“…However, as SCs are not as powerful as generalpurpose controllers, splitting the execution environment into a secured world and into a normal world is suggested for instance by Vasudevan et al [16]. This splitting principle, also called security by isolation or dual-execution [17], is realized by implementing SCs as external hardware modules.…”

Secured and Easy-to-Use NFC-Based Device Configuration for the Internet of Things

“…Tamper resistant hardware [28] such as security controllers (SCs) can be used to provide protected execution environments as well as secured data storage that mitigate side-channel and physical attacks. However, since SCs are not as powerful as general purpose controllers or dedicated hardware components, splitting the execution environment into a secured world and a normal world is suggested [29]. This splitting principle by implementing SCs as external hardware modules that can then be combined with general purpose CPUs.…”