## 2 Definitions, Principles, and Outline of Roots-of-Trust and Trusted Environments  
A Root-of-Trust (RoT), sometimes referred to as Trust Anchor, is a fundamental component in computer and information security. It is an element, typically implemented in hardware or firmware, that is considered implicitly trusted and forms the basis for establishing and verifying the authenticity and integrity of various system components, software, and data. The primary purpose of an RoT is to provide the secure foundations for building and maintaining trust within a computing environment. For instance, it is used for the following:* Secure Boot and Initialization. The RoT ensures that a computer system starts up securely. It verifies the integrity of the bootloader and firmware during the boot process, ensuring no malicious code has been injected into these critical components. This helps prevent firmware-level attacks and rootkits from compromising the system. * Code and Data Authentication. The RoT mechanisms can be used to authenticate and verify the integrity of software applications and data. This ensures that only trusted and authorized code and data are executed or accessed on a system. * Cryptographic Operations. The RoT often includes cryptographic capabilities and can generate and manage cryptographic keys. This is crucial for secure communication, data encryption, and authentication between different system components and devices. * Secure Storage. Some RoT implementations provide secure storage for sensitive data, such as cryptographic keys or biometric templates, ensuring that this data cannot be easily tampered with or stolen. * Remote Attestation. The RoT can be used for remote attestation, allowing a system to prove its trustworthiness to remote entities. This is particularly important in scenarios like cloud computing, where a remote server needs assurance that a client device is secure before granting access. * Hardware-Based Security. Many RoT implementations are designed to be tamper-resistant and are stored in secure hardware modules, making it difficult for attackers to compromise their integrity. * Trust in Supply Chain. The RoT can establish trust in the supply chain by ensuring that hardware components and software are genuine and have not been tampered with during manufacturing, distribution, or deployment. * Protecting Against Insider Threats. The RoT can also help protect against insider threats by limiting access to sensitive information and functions based on authentication and authorization policies. The RoT is the key element for building Trusted Execution Environments, typically through secure boot routines. In this sense, a TEE can be seen as a layered structure in which each layer is enabled (and configured) upon verification of the previous layer. The resulting environment constitutes a secure zone where code and data can be executed and processed securely. Each layer provides specialized security mechanisms that rely on the ones of the lower layer and support the higher layer. In case of an attack on any of the elements of a layer, the corresponding layer can attempt to counter the attack with its security mechanisms, and, in case of failure, that layer can be isolated by leveraging the lower layer. The highest layer of the security chain is the one connected with the main operating system, other parts of the processor, and eventually external systems, which are insecure. In some cases, not only can the highest layer be interfaced with insecure elements or zones, but also lower layers can, for instance, to provide advanced specialized services. In the former case, the TEE can be modeled as a Chain-of-Trust (CoT), i.e., the organization of the layers is purely sequential; in the latter case, the TEE can be modeled as a Tree-of-Trust (ToT), i.e., some layers concur with each other. A representation of the two different topologies is given in Figure 1.  
The separation between the secure zone and the non-secure zone can be physical or logical.