TEEを中⼼とするCPUセキュリティ
機能の動向 (RISC-V, ARM, etc)
国⽴研究開発法⼈ 産業技術総合研究所
サイバーフィジカルセキュリティ研究センター
須崎有康

Do you know TEE?
• I asked same question at RISC-V Day Tokyo 2018 and
MICRO51 RISC-V workshop 2018.
• Only 10% attendees know it.

Do you know there words?
• Real Product• TPM (Trusted Platform Module)• ARM TrustZone• ARM SCP (System Co Processor)• Intel SMM (System Management Mode)• Intel TXT (Trusted Execution Technology)• Intel SGX (Software Guarded Extension)• Intel ME (Management Engine)• AMD PSP (Platform Security Processor)• Research *• IBM 4765 Secure Coprocessor• FIPS 140-2 level 4• Wikipeida: FIPS 140-2 Level 4 makes the physicalsecurity requirements more stringent, andrequires robustness against environmental
attacks.

• MIT Aegis Secure Processor [ICSʼ03]• MIT Sanctum [USENIX Secʼ15]• Google Titan• MS Azure Pluton• Apple Secure Enclave• Apple T2* Secure Processors Part I: Background, Taxonomy for Secure
Enclaves and Intel SGX Architecture [2017, Srinivas Devadas]

Contents• What is CPU Security?
• What is TEE?
• Implementation• Related topic (TEEP)• Intel ME, Google NERF, Google Titan, MS Azure, etc. (Messy)

Why is CPU Security needed?
• Application is not trustable.
• Quality is not managed.

• OS kernel is not trustable.
• Too large for TCB.
• Security function (e.g.,Reference Monitor) isa part of OS.
• Hardware isolation (privilege) is not enough.

CPU which runs apps,
kernel, and hypervisor is
not trustful.

• Hypervisor is not trustable.
• Hardware isolation (virtualization) is notenough.

HIEE (Hardware-assisted Isolated
Execution Environments) is required.
* SoK：A Study of Using Hardware-assisted Isolated Execution Environments for Security[HASP16]

History of HIEE
1990
Orange Book
“Trusted Computer
System Evaluation
Criteria”(83,85,05)

2010

2000

MS NGSCB: NextGeneration Secure
Computing Base
(2002)TPM of TCG: Trusted Computing Group
2006 Intel Mac
2009 as ISO/IEC 11889
Ver1.2 March 3, 2011
Static Root of Trust Ver2.0 Sep 29, 2016

Intel SMM
i386SL (1990)
Suspend/Resume
20 MHz clock

Dynamic Root of TrustIntel TXT(2007)
Intel ME(2008)

ARM TrustZone (02〰)Cortex-A
Cortex-M (ARMv8-M)

TEEIntel SGX
(2015 Skylake)(2014 QEMU by GIT)

GlobalPlatfromʼs TEE
July 2010

Comparison of HIEE

From: SoK：A Study of Using Hardware-assisted Isolated Execution Environments for Security[HASP16]

Comparison of CPU mechanism

From: Secure Processors Part I: Background, Taxonomy for Secure Enclaves and Intel SGX
Architecture [2017, Srinivas Devadas]

Stakeholder map
CPU/Product vendor

BIOS/UEFI vendor

User Programmable

Service Provider / UserIntel SGX
TrustedApplication
ARM TurstZone

Intel ME (MINIX)
Updateable
Apple T2
Google Titan
MS Azure Pluton

hardcoded
TPM

Trusted OS
Intel SMM

What is TEE?

• TEE: Trusted Execution Environment.
• TEE separates computing world into “normal” and “secure”.
• Secure world is used to run a critical code (e.g., authentication, DRM, etc).
Secure World

Normal World
App

TEE

Normal OS

CPU• GlobalPlatform defines TEE specification.
• https://globalplatform.org/technical-committees/trusted-execution-environment-tee-committee/

10GlobalPlatfrom TEE• Requirements:• https://globalplatform.org/wp-content/uploads/2018/05/Introduction-to-Trusted-Execution-Environment-15May2018.pdf

1.

Isolation from the Rich OS• all trusted applications and their related data are separated from the rich environment.

2. Isolation from other TAs• TAs are isolated within the TEE, and from the TEE itself.

3. Application management control• any modification of the TA and the TEE can only be performed by the authenticated entity.

4. Identification and binding• where the boot process is bound to the System-onChip (SoC), enforcing authenticity and integrity of
TEE firmware and TAs.

5. Trusted storage• TA and TEE data is stored security to ensure integrity, confidentiality and binding to the TEE (or anticloning).

6. Trusted access to peripherals• the TEE offers APIs access to trusted peripherals such as the screen, biometric sensors and SEs,
under the control of the TEE.

7. State of the art cryptography• random number generation, cryptography and monotonic time stamps are key assets for value added
services.

Privileges for TEE• Global Platform's TEE specification assumes plural privileges on bothworlds.
• Normal world runs normal applications on a normal OS.
• Secure world runs trusted applications (TAs) on a trusted OS.
Normal World

Secure World
Trusted Application (TA)Trusted OS

GP TEE API

AppNormal OS

CPU• ARM Trust Zone offers same privileges to normal and secure world.
• Intel SGX has only one privilege (enclave).
• Enclave is different from Ring architecture.
12

POSIX API

Trusted OS on ARM Trust Zone

• GlobalPlatform model
Exception Level
EL0: User
EL1: Privilege

Secure world

Normal world
Normal Applications

Trusted Applications (TA)Normal OS

Trusted OS

EL2: Hypervisor

Dynamic allocate
Hard
Static allocate

SMC (Secure Monitor Call)
instruction

SecureMonitorEL3: Secure

ARM

Core
UART

Core

Memory
NIC

eMMC
13

Trusted OS on ARM Trust Zone

• GlobalPlatform model• Interrupt is also separated. (depending on configurations)• Exception Level
EL0: User
EL1: Privilege

Secure world

Normal world

Normal OS

Trusted OS

SMC (Secure Monitor Call)
instruction

SecureMonitorEL3: Secure
Dynamic
allocate
Static allocate

ARM

Core
UART

IRQ

IRQ

FIQ

EL2: Hypervisor

Hard

Normal Applications

Trusted Applications (TA)Core

Memory
NIC

eMMC
14

Difference of Implementation of Trusted OS• Cortex-A 32bit (ARMv7) and 64bit (ARMv8)

Different
EL
Same Response isELimportant forsafetyhttps://www.slideshare.net/linaroorg/arm-trusted-firmareforarmv8alcu13

Layered Architecture
Security is importantComparing Cortex-A and Cortex-M

Cortex-A

Cortex-M• Cortex-A follows the layer architecture of GlobalPlatform TEE.
• Cortex-Mʼs mode (thread or handler) can be privilege or unprivileged.
• Cortex-M TrustZone doesnʼt provide monitor mode, because latency is important for safety.
Bernard Ngabonziza, Daniel Martin, Anna Bailey, Haehyun Cho and Sarah Martin, “TrustZone Explained: Architectural Features and Use Cases”,IEEEInternational Conference on Collaboration and Internet Computing (2016)

Hardware components to build TrustZone• TZASC: TrustZone Address Space Controller• TZPC: TrustZone Protection Controller• TZMA: TrustZone Memory Adapter• Each Peripheral has Non-Secure bit• IRQ for Normal World• FIQ for Secure World

Peripheral managed by TZASCMemory managed by TZASC

https://developer.arm.com/docs/ddi0431/b/introduction/about-the-tzasc

http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.prd29-genc-009492c/ch04s01s01.html

OP‐TEEのソースでは Address Space ControllerにTZC‐380とTZC‐400の記述がありました。
ARM Trusted FirmwareではTZC‐400はありますが、TZC‐380が⾒つからない。

Boot Sequence on ARM Trust Zone

• BL: Boot Loader• EL: Exception Level

Secure World

Normal WorldPower on
EL3:Secure

EL2:Hypervisor EL1:Priviledge

EL0:User

EL3:Secure

EL2:Hypervisor EL1:Priviledge

BL1:
BootROM
BL2:
Trusted
Boot
Firmware

BL31:
SecureMonitor
18

BL32:
Trusted OS

BL33:
Normal OS

EL0:UserTrusted OS• Trusted OS is not a normal OS• Trusted OS is TCB (Trusted Computing Base). It must be secure (small).
• No POSIX API, No dynamic link library• TA becomes a static linked binary.

• Trusted OS needs the help of normal OS• Because Trusted OS has no File System, no device driver (except some special
devices, e.g., UART)• When a TA want to save a data, the data is encrypted and saved on FS of normal OS.

19

Implementation of Trusted OS• Open Source Trusted OS• OP-TEE (Linaro) https://github.com/OP-TEE• Open-TEE (Aalto University[TrustCom15]) https://open-tee.github.io/• Trusty (Google) https://source.android.com/security/trusty/index.html• SierraTEE (Sierra) https://www.sierraware.com/open-source-ARM-TrustZone.html• SafeG (Nagoya University) https://www.toppers.jp/en/safeg.html• Enterprise Trusted OS• Appleʼs Secure Enclave• Qualcommʼs QTEE, ex. QSEE https://www.qualcomm.com/solutions/mobile-computing/features/security• Samsungʼs Knox https://www.samsungknox.com/en• Samsungʻs Teegris http://developer.samsung.com/teegris• Trustonicʼs Kinibi OS, ex. Mobicore/t-base/G&D• Huaweiʼs TrustedCore
20

How to run a TA on OP-TEE
Secure World
Major Roll
• TA-Client loads a TA on OP-TEE••

TA needs a signature to load on OP-TEE
TA has a UUID to communicate with TAClient and TEE-Supplicant

Exception Level

Load a TATA
Use a TA signature

TA
with

EL0: User

libutee.a• TA-Client sends a request to TA
TEE internal API only (No POSIX sys call)• TA replies an answer to TA-Client• TA sends a request to TEEOP-TEE
Supplicant (e.g., to save an encrypted EL1: Privilege(signature check)data on File System)(dispatch by UUID)

EL2: Hypervisor
EL3: Secure21

Normal World

Secure Monitor

TA-Client

Helper of TA
TEESupplicant

libtee.so/dev/tee0 /dev/teeprev0Linuxwith op-tee driver

Memory Map of OP-TEE• ARM 96Board Hikey 2GB

0x7FFFFFFF (2GB)
OP-TEE & TA 16MB

SecureWorld

0x7F000000
Shared Memory 4 MB
0x7EC0000

Secure Data
Path Buffer 4 MB

0x7E80000
Reserved• Software size: Our experience• Secure world
NormalWorld• Secure Monitor 33KB
• OP-TEE
281KB• TA
1,200KB• Normal World (on Linux)

0x7E00000
Linux Kernel
with SMC driver
22

8 MB

• SoC: Kirin 620• Cortex-A53 Octa-core 64-bit 1.2GHz(ARM v8 instruction set)

• TA-Client
17KB• TEE-Supplicant 197KB

TEE Vulnerabilities• Many attacks exist on software and hardware.
• Software• Boomerang [NDSSʼ17]• Pointer exploit. TA can access any memory region. Attacker exploits TA to get sensitive data on
normal world.

• QSEE TrustZone Kernel Integer Overflow [BlackHat14]• Exploiting Trustzone on Android [BlackHat15]• Hardware• Foreshadow [USENIX Secʼ18] (aka L1TF: L1 Terminal Fault)• Intel SGX Vulnerability of out-of-order execution• Microcode update mitigate this vulnerability• Prime+Count [ACSACʼ18] by Samsung• ARM Trust Zone Cross-world Covert Channels on using cache.

• Cache Attack [EuroSecʼ17] https://www1.cs.fau.de/sgx-timing• Intel SGX Cache Timing Attack23

Boomerang Flaw[NDSS18]

TEE name

VendorImpactBug Detail

TrustedCore

HuaweiArbitrary writeCVE-2016-8762

QSEE

Qualcomm

Arbitrary writeCVE-2016-5349

Trustonic

As used by Samsung

Arbitrary write

SierraTEE

Sierraware

Arbitrary write

OP-TEE

LinaroWrite to other applicationʼs memory*Security issues with ARM TrustZone [TestingStage18]

HIEE on RISC-V
On RISC-V• SMM: System Management Mode ⇒ Machine Mode
• Used by BIOS/UEFI for ACPI, etc.

• Intelʼs ME: Management Engine.
• Run MINIX. Used for remote wakeup.

• Intel SGX• ARM TrustZone

25

⇒

???

⇒・ Sanctum of MIT
・ Keystone of UCB⇒・ MultiZone of Hex-Fife
・ TEE WG of RISC-V
Foundation

They are notprogrammable for auser.
They areprogrammable for auser.
They are used for TEE.

RISC-V TEE project• Rahul Mahadevʼs OP-TEE on seL4 [Google Summer of Code 2016]• Sanctum [USENIX Secʼ16]• KeyStone [2018]• MultiZone of Hex-Five[Sep/2018]• TERP of SiFive[RISC-V Summit Dec/2018]• TEE Working Group of RISC-V foundation

OP-TEE on RISC-V using seL4
• Rahul Mahadevʼs Google Summer of Code 16• http://mahadevrahul.blogspot.com/
App• The TrustZone features and secure monitor must be
implemented as a seL4 library.
• OPTEE is paravirtualized, all calls referencing ARM
Trusted Firmware and secure monitor are replacedwith new calls.

27

TA

Paravirtualized OPTEERich OS(Linux)

Library toemulateTrustZone
seL4

VMM

Sanctum [USENIX Secʼ16]• Figure of software stack
https://www.usenix.org/sites/default/files/conference/protected-files/security16_slides_costan.pdf• Enclave is created o User Mode.
• Secure Monitor on Machinemode helps the secure creationof enclave.
• Successor project “KeyStone” of
UCB and MIT.
• https://keystone-enclave.org/

28

MultiZone of Hex-Five• MultiZone is announced• MultiZone is based on nanokernel.
•

https://hex-five.com/wpcontent/uploads/2018/09/hex_five_multizone_datasheet.20180920.pdf• System Requirements• 32 bit or 64 bit RISC-V ISA with ʻSʼ or ʻUʼ extensions• Physical Memory Protection compliant with Ver. 1.10
• 4KB FLASH and 1KB RAM

29

SiFive TERP: A Trusted Execution Reference
Platform for Embedded Secure Applications• The goal of TERP is to describe all the components
necessary to build an embedded RISC-V processor which
provides isolated multi-tenancy.
• It will be open at RISC-V Summit 5/Dec/2018.

TEE Working Group of RISC-V foundation• Remote conference every week
• Discuss memory protection, privilege mode, etc.

• When we implement OP-TEE on RISC-V, we must develop• Boot sequence: Trusted Boot Firmware, Secure Monitor• Linux kernel driver• Libraries (libutee.a for TA and libtee.so for Linux Apps)• Linux application to assist TA (TEE-supplicant)Other Implementation of TEE• Hardware• FPGA TEE “Iso-X” (SUNY at Binghamton) [Micro47 2014]• GPU TEE “Graviton” (Microsoft Research) [OSDIʼ18]• Requires NVIDIA GPU extension• Software• TrustZone virtualization “vTZ” (Shanghai Jiao Tong University) [USENIX Secʼ17]• Virtualize TrustZone for VMs• TEE delegation “DelegaTEE” (ETH Zurich) [USENIX Secʼ18]• DelegaTEE is implemented by Intel SGX• TEE Migration (INRIA) [IFIP WISTPʼ15]• privacy-preserving TEE profile migration protocol

32

IETFʼs TEEP
• Trusted Execution Environment Provisioning• https://datatracker.ietf.org/wg/teep/about/• Protocol to manage TA: Trusted Application.
• TAM(Trusted Application Manager) controls life cycle of TA (create, update, anddelete).

• TEEʼs API (Trusted OS) is important.
33

Survey papers• Secure Processors Part I: Background, Taxonomy for Secure
Enclaves and Intel SGX Architecture [2017, Srinivas Devadas]• SoK：A Study of Using Hardware-assisted Isolated Execution
Environments for Security[HASP16]• Security issues with ARM TrustZone [TestingStage18]• Trusted Execution Environment: What It is, and What it is Not[TrustCom15]• TrustZone Explained: Architectural Features and Use Cases[CIC16]

⽇本語参考• FFRI Monthly Research 「ARMv8-M TrustZone：組み込みデバイス向けアーキテクチャとセキュリティ機能」• https://www.ffri.jp/blog/2016/03/2016-03-18.htm• セキュアハードウェアの登場とその分析• https://www.ffri.jp/assets/files/monthly_research/MR201303_Trust
Zone.pdf• TrustZone のユースケースと動向• https://www.ffri.jp/assets/files/monthly_research/MR201703_Trust
Zone_use_case_and_trend_JPN.pdf

Intel ME (Management Engine)• Micro controller on chipset• MINIX runs
• HTTPS server runs

• Intel AMT (Active Management Technology)• Remote boot which works as IPMI

• Update with BIOS (Size info https://github.com/corna/me_cleaner)• Generation 2 (Nehalem-Broadwell, ME version 6 -10)
• 1.5 MB (non-AMT firmware) 5 MB (AMT firmware)• Generation 3 (from Skylake onwards, ME version >= 11)• 2 MB (non-AMT firmware) 7 MB (AMT firmware)Position of Intel MEIntel ME: The Way of the Static Analysis [TROOPERS17]

Replace your exploit-ridden firmware with a Linux kernel [LinuxCon17]

Overview of Intel ME• https://itsfoss.com/fact-intel-minix-case/

Igor Skochinsky, Intel ME Secrets, CODE BLUE 2014

Network of Intel ME• HECI: Host Embedded Controller Interface• communication using a PCI memory-mapped area

• Network protocol is SOAP(HTTP or HTTPS)
Igor Skochinsky, Intel ME Secrets, CODE BLUE 2014

Vulnerability of Intel ME• Intel ME Manufacturing Mode: obscured dangers and theirrelationship to Apple MacBook vulnerability, CVE-2018-4251• http://blog.ptsecurity.com/2018/10/intel-me-manufacturing-modemacbook.html• Intel ME 11.x Firmware Images Unpacker• https://github.com/ptresearch/unME11• Vulnerability INTEL-SA-00086 allows to activate JTAG for IntelManagement Engine core.
• https://github.com/ptresearch/IntelTXE-PoC• ”Silent Bob is Silent”, Escalation of privilege vulnerability onIntel AMT, CVE-2017-5689

Googleʼs stance• Ring2-3 has many functions (in MINIX)• IP stacks (4 and 6)• File systems• Drivers (disk, net, USB, mouse)• Web servers

They work even if the main OS is terminated.

They increase attack surface.

Replace your exploit-ridden firmware with a Linux kernel [LinuxCon17]

Googles Answer
NERF: Non-Extensible Reduce Firmware• De-blobbed ME• UEFI reduced to its most basic parts• SMM disabled or vectored to Linux• Userland written in Go (http://u-root.tk)• u-root [USENIXʼ15]

Replace your exploit-ridden firmware with a Linux kernel [LinuxCon17]

Googleʼs Titan• Google proposes “secure chip” which integrated between chipset
and boot flash.
Titan: enabling a transparent siliconroot of trust for Cloud [HotChips18]• It resembles to TPM.
• “Towards Understanding Google Titan”• https://harry.uno/post/google-titan.html

TPM v.s. Googleʼs Titan• TPMʼs trusted boot (measured boot)• No mechanism to stop

From Power on, it
measures

CRTM

TPM

Peripherals
OptionROMs

TCG‐BIOS

Boot Loader

Root of Trust

App

Store hashvalue.

PCR0
…
PCR15

OS

RequestCreate Platform
Integrity, and certify it.

Certify• Titanʼs verified bootRemote Attestation• Stop if verification fails

Titan: enabling a transparent silicon root of trust for Cloud [HotChips18]

MS Azure Pluton• MediaTek MT3620The first Azure Sphere class Microcontroller• Securely isolated subsystems.
• Units has HW firewalls.
• HW based attestation• Security processor is first to boot• Initial code is in ROM.

• Software is signed.
• SW rollback protection.

The Hardware Security Platform Behind Azure Sphere [HotChips 18]

Conclusions• Many CPU security faculties.
• The common feature is “HIEE: Hardware-assisted Isolated Execution
Environments”.

• Related Talks• 29/Nov 第7回サイバーセキュリティ国際シンポジウム@慶応⼤学• RISC-V Panel• https://cysec-lab.keio.ac.jp/sympo1811/index-j.html• 13/Dec ハードウェアセキュリティフォーラム2018 ＠東⼤• http://www.ieice.org/~hws/