## 4 Design Methodologies and Key Aspects for Security Modules in Secure Zones
The most notorious attack classes of this group are Single Power Analysis (SPA), Differential Power Analysis (DPA), and Correlation Power Analysis (CPA). The first one consists of recovering data values by just observing the shape of a power trace; for instance, in a branched architecture where a certain value of processed information activates a certain branch rather than another one, isolating  
Figure 3: Scheme of operations of SCAs. By analyzing the leakage of information emitted through a side channel such as power, time, Electromagnetic Emissions (EM), or acoustics, an adversary is able to retrieve the secret key. the branch-specific power profile within a power trace makes it possible to recover the sequence of 0s and 1s. DPA and CPA attacks instead are more sophisticated, and they employ statistical methods to disclose secret information. As can be intuited from what has been expressed so far, each of these attacks requires a certain knowledge of architecture, especially in the case of DPA and CPA, which typically make use of a power consumption model to make a guess of the value of processed data: the further the model from the real architecture, the weaker the guess. For power analysis attacks, the countermeasures usually are implemented by adopting two techniques, masking or hiding, or a mix of both. The former is aimed to reduce or eliminate the dependencies between data and power consumption; the latter instead is aimed to jam the Side-Channel with noise in order to reduce the signal-to-noise ratio of leaked information. Masking typically introduces significant overhead in terms of area and critical path, by requiring up to 5 times the amount of logic resources employed by the unprotected module, and lowering the maximum frequency of the circuit up to 2/3 times [53; 56; 59; 61; 65]. On the other hand, hiding usually is realized by coupling the unprotected module in parallel to a block dedicated to noise generation, thus the critical path of the circuit is not affected and the overhead of resources is limited. In that case, the most significant cost concerns are the power consumption, which can introduce an overhead of up to 5 times larger [54; 55; 57]. * Electromagnetic analysis [62]: This category of attacks relies on leaked electromagnetic radiation. It is usually assimilated to the class of power analysis attack, under the rough assumption that electromagnetic radiation is highly correlated (or proportional) to power consumption. Therefore, attacks and defense mechanisms are developed accordingly to the one of power analysis, using electromagnetic probes, instead of an instrument to measure the current. * Differential fault analysis [63]: This type of attack has the purpose of discovering secrets by introducing faults while the system is running normally. The corresponding protection mechanisms typically involve architectural redundancy approaches and techniques for concurrent error detection. Confirmations of the severity of SCAs can be found, for example, in [66]. It analyzes the resistance of ARM TrustZone with respect to Side-Channel leakages and reports several violations of security due to fault attacks [67; 68; 69], cache attacks, [7; 8; 9; 10], and EMA [11; 12; 13]. According to the key aspects to be addressed for the development of a secure module, the security partitioning model illustrated in Figure 2 should be applied recursively to each layer and to each element of the chain involved in the construction of the TEE by dividing it into both trusted and non-trusted components. The results of this approach converge in the definition of a more accurate partitioning model that is represented in Figure 4. Such a model counts four abstraction layers that are, respectively from the top to the bottom, the protocol level, the software architecture level, the hardware micro-architecture level, and the circuit level. Each of these levels is characterized by the separation between security-related and non-security-related resources and a specific interface security policy between them.