Implement Android Tamper-Resistant Secure Storage and Secure it in Virtualization - Bing Zhu, Intel
Channel: The Linux Foundation
Date: 2018-10-27

Implement Android Tamper-Resistant Secure Storage and Secure it in Virtualization - Bing Zhu, Intel Corporation 

Tamper-resistant secure storage is a key feature of Android TEE (Trusted Execution Environment). Typically it is used as critical data (e.g. keys/certificates) storage in IoT system so that malicious software cannot tamper with data even if normal Linux kernel is compromised.

In this talk, Bing will talk about how to implement full software stack of such storage service based on RPMB in eMMC flash device including RPMB key generation and hardware root binding, factory key provisioning, and software interfaces.

Furthermore, in order to enable it in embedded ACRN hypervisor for supporting multiple Linux guest and TEE instances, he will also talk about secure storage virtualization architecture in ACRN including how to create root sub-keys for each guest to encrypt its data for storage confidentiality, how to build a "one-vm, two-world" to protect TEE and how to isolate memory between guest TEE worlds and Hypervisor.

The presentation topic of this project is also contributed by Yang Huang, Tomas Winkler, Yadong Qi, Wei A Deng, Luhai Chen, Eddie Dong, 

About Bing Zhu
Bing Zhu is currently working as software security architect. He has been working at Intel for 12 years with rich experience in security and virtualization areas, including security of processor/chipset, firmware, trusted computing, OS kernel and storage, secure communication protocols, TEE (Trusted Execution Environment) and platform virtualization security. He previously worked as key developer of anti-malware engine for McAfee DeepSafe Technology, recently he is working as software architect for virtualization-based TEE (Trusty) development on x86 platforms, and also as security architect for ACRN hypervisor project (https://projectacrn.org/).