## 3 State of the Art of RoT-Based Trusted Environments  
Several implementations of hardware security solutions are released by the main GPP vendors like ARM, Intel, and AMD targeting different uses such as isolated execution and TEE, acceleration of security functions, random number generation, and memory protection. ARM proposes the so-called TrustZone [24; 25], which is a system-wide technology integrating security features into the ARM processors, bus fabric, and peripherals. Instead of protecting assets in a dedicated hardware block, the TrustZone architecture adds security functionalities to any part of the System-on-Chip (SoC). The TrustZone strategy is based on the partitioning of all the SoC resources (both hardware and software) in two worlds: the Secure world for the Security Subsystem and the Normal world for everything else. At the hardware level, the division of the world is implemented through different hardware features: the bus fabric can ensure that no Secure world resources can be accessed by  
Figure 1: Layered organization of TEEs as Chain-of-Trust or Tree-of-Trust. the Normal world components. This is accomplished through the Advanced eXtensible Interface (AXI) bus, which contains a dedicated bit to determine secure and non-secure read/write operations; hardware extensions are included into the processor in order to enable it to execute code from both the Normal world and the Secure world in a time-sliced fashion. This feature removes the need for a dedicated processor for the security part, so the single processor runs the secure software when its state is secure, and the normal software when it is in the non-secure state; introduction of a hardware classification of the memory-mapped devices as secure or non-secure through the TrustZone Address Space Controller (TZASC) and memory division into secure and non-secure through the TrustZone Memory Adapter (TZMA); and distinction between secure and non-secure prioritized processes interrupts through the interrupt controller. Each world manages the resources for applications belonging to its world's space. The two different software stacks (i.e., secure software and non-secure software) are executed one at a time on the same processor. The context switching between Secure and Normal world is handled by monitor mode, which is the highest privilege level of the Secure world and can access both worlds' system's resources. ARM TrustZone is integrated inside Cortex-A [26], as well as in Cortex-M [27] with some differences related mainly to privilege levels of the processor. The Intel Software Guard eXtensions (SGX) is an isolation technology included in almost all the 6 th generation of Intel processors, which virtually creates a secure zone for secure code. This technology, unlike the ARM TrustZone, does not divide the execution process into two worlds (i.e., Secure and Normal world) but creates a secure computing space within the untrusted application: the Enclave. The Enclave is a protected container the applications can instantiate, which ensures confidentiality and integrity by using memory access checks and by encrypting data and code that goes outside the CPU. At the hardware level, the architectures supporting SGX are equipped with a set of security-related instructions and dedicated hardware components like the Enclave Page Cache (EPC) to support the multitasking of different Enclaves and the Enclave Page Cache Map (EPCM) to track page space of each Enclave. As discussed in [28], a user application can instantiate an Enclave using a trusted process. Such a process communicates with the EPC to assign an enclave page to the application, and the page information is checked by the EPCM. The target process is executed thanks to the Enclave and after its completion, the Enclave is destroyed and the page space released. Further information about the Intel SGX technology can be found in [29; 30; 31; 32; 33]. AMD proposes the Platform Security Processor (PSP) [34], which is a standalone coprocessor embedded inside the main AMD CPU.