May the Trust be with You: Empowering TrustZone-M with Multiple Trusted Environments

No ratings

Presented at BlackHat Asia 2020 by

Sandro Oliveira

Over the last decade, Arm TrustZone has been pivotal for securing hundreds of millions of mobile devices. Within the realm of the Internet of Things (IoT), Arm has recently introduced TrustZone on its new generation of microcontrollers (a.k.a. TrustZone-M). Although TrustZone has been used as a key enabling technology to implement trusted execution environments (TEEs), the sad reality is that, over the past years, TrustZone-assisted TEEs have been successfully attacked hundreds of times, causing highly damaging consequences across different sectors and platforms. One of the root causes of the prevailing vulnerabilities is motivated by the classic dual-world security model, which "imposes" the software needs to be split among a secure and non-secure environment. This dual-world architecture has intrinsic limitations and is falling short to address the increasing complexity and requirements of modern devices. In the future, where trillions of small TrustZone-enabled IoT devices are expected worldwide, this problem can extrapolate, imposing a significant threat for the security of our infrastructures.In this talk, we start by examining TrustZone(-M) technology and explaining why the intrinsic traditional dual-world security model is becoming impractical and inherently insecure. We then share our experience in designing and implementing the first multi-world TEE for modern TrustZone-M devices. Existing operating systems (e.g. Zephyr, FreeRTOS), micro-TEEs (e.g. Kinibi-M), and lightweight hypervisors for TrustZone-M microcontrollers are limited to a dual-world architecture; our solution provides an unlimited number of equally-secure execution environments. We demonstrate that the bedrock of the system relies on a lightweight and small TEE kernel that has a minimal impact on the performance and the trusted computing base (TCB) of the system. To close our talk, we will present a live demo of a fully-functional secure IoT stack for Industrial IoT applications running on a real TrustZone-M hardware platform.