The Challenges Pitfalls and Threats of TrustZone
2022-01-0140
03/29/2022
- Content
- A Trusted Execution Environment (TEE) is an environment for executing code where the executing code can have high levels of trust in the asset management compared to surrounding environment because it can avoid threats from the unknown rest of the device . Trustzone provides an isolation to security critical components in the system by providing hardware separation between rich operating system, from a much smaller secure operating system. It enables two environment , secure world and normal world to run simultaneously on a single core yet separating secure world from the rest of the system . Its been used extensively in automotive products by many OEM's . Even though TEE is the starting point for establishing a device root of trust but a number of published attacks against TEE implementations request a second opinion on their security. The aim of this research is to provide an analytical and educational exploration of TrustZone-based TEE vulnerabilities with the goal of pinpointing design , lack of design in security and highlighting implementation flaws, for example, Trusted User Interface (TUI) for smartphone applications authenticates the user and control the car (ex: digital key app), which can cause mobile application security vulnerabilities in the vehicle. We will analyze about the commonly used Trusted Application executed over TEE like keymaster , crypto manager , gatekeeper and provide critical observation regarding their behavior. Lastly , we will propose possible improvements that could be adopted by TEE implementers to modify and improve the security aspect of TrustZone .
- Citation
- Sivakumar, G., Shahare, R., Kochi Peedikayil, M., and Varshney, S., "The Challenges Pitfalls and Threats of TrustZone," SAE Technical Paper 2022-01-0140, 2022, .