## 4 Design Methodologies and Key Aspects for Security Modules in Secure Zones
Seal/unseal mechanisms can be used to protect keys from unauthorized access (by supporting different privilege levels), to bind the key for a specific usage (e.g., a specific cryptographic operation), and/or to limit its usage (e.g., for one, tens, or hundreds of times). Also, data access must be regulated. In this sense, an interface security policy mechanism may rely on a dedicated Finite State Machine (FSM) that strictly handles the data processing phases and allows access only once the cryptographic operation is completed. Any access attempt before the conclusion of the cryptographic operation may be logged and reported as a warning or as an alert. The third and last aspect, which is equally important, concerns the physical implementation. Indeed, also the physical implementation of a secure system or module can introduce vulnerabilities, even if the chosen security algorithm is robust and cannot be violated from a numerical or mathematical point of view. When the module executes the chosen algorithm, the physical level may emit sensitive information through physical quantities, such as time, power consumption, electromagnetic radiation, or sound. This constitutes an unintentional leakage of information through a secondary channel (or side channel), i.e., the physical one, and it can be exploited to perform an attack bypassing the interface security policy level. To give a more intuitive explanation, for example, it is enough to consider the physical processes involved in the usage of transistors implemented in CMOS technology. When these hardware elements treat digital information formed by 0s and 1s, they can be assimilated into a capacitor which is charged or discharged, according to the digit value. Therefore, by measuring the power consumption of transistors, it could be possible to recover the value of the processed data. Due to their nature, such attacks take the name Side-Channel Attacks (SCAs), and Figure 3 depicts their scheme of operation. Figure 2: Security partitioning model of a generic system integrating a TEE. SCAs are widely documented in the literature and constitute one of the hottest topics in the cybersecurity field. An exhaustive and systematic review of SCAs can be found in [44; 45; 46], while [47; 48; 49; 50; 51; 52; 53; 54; 55; 56; 57; 58; 59; 60; 61; 62; 63] report several examples of the most diffused categories of attacks that exploit the physical implementation of a device, which are listed below:  
* Cache attack [47; 48; 49]: This class of attacks is based on monitoring cache accesses in a shared physical system and, as the name suggests, it is mostly applied to software contexts. The protection strategies usually consist of replacing the LUTs with a series of equivalent logical operations, using alternative forms of LUTs, or creating an obvious memory access pattern (i.e., reading all LUT values in a fixed order and using only the one needed) [47; 48]. * Timing attack [50; 51; 52; 53]: This category of attacks concentrates on measuring the execution time of routines, targeting software implementations in which different instructions, branches, RAM cache hits, etc., cause time variation in the process. The protection mechanisms typically involve techniques for time equalization and reduction of unpredictable events (such as cache misses, etc. ), or insertion of random delays [51; 52; 53]. * Power analysis [53; 54; 55; 56; 57; 58; 59; 60; 61; 64; 65]: This family of attacks is one of the most effective on both hardware and software implementations, and it exploits the power consumption of underlying physical circuits. Concerning the software case, if each opcode of the instruction set architecture can be associated with a different and specific power trace shape, then the series of operations performed by a routine is revealed; on the hardware side, data dependencies over different power traces can be analyzed to recover secret information.