Poster: Integrating a Secure Processing Environment in an IoT Operating System Lena Boeckmann HAW Hamburg Hamburg, Germany lena.boeckmann@haw-hamburg.de Thomas C. Schmidt HAW Hamburg Hamburg, Germany t.schmidt@haw-hamburg.de Matthias W¨ahlisch TU Dresden Dresden, Germany m.waehlisch@tu-dresden.de Abstract—Trusted Execution Environments (TEE) and secure enclaves with hardware support are promising concepts for en- hancing security in constrained environments. These approaches provide protected processing areas within a SOC, in which security-critical applications can execute, and at the same time prevent unauthorized access to sensitive data and program code. New microcontrollers with the Armv8-M architecture offer Trustzone-M, a hardware feature to protect memory and support TEEs. To facilitate adoption, Arm provides an open source reference implementation for a secure processing environment (Trusted Firmware-M). In this poster, we present how we integrated this secure firmware in an IoT operating system and measure the overhead cost in memory and execution time. Index Terms—Internet of Things, IoT, Security, Trusted Exe- cution Environment, Trustzone-M I. INTRODUCTION Internet of Things (IoT) devices store, process and transmit sensitive data, while often being insecure and easily physically accessible by potential attackers. Vulnerable devices can serve as entry points to larger networks for compromising critical system components and infrastructure. To secure IoT systems we need measures to make those devices trustworthy. One way to achieve this are Trusted Execution Environ- ments (TEE) [1]. Those are isolated components in which trusted applications (TA) can perform security critical oper- ations, such as secure storage of data and cryptographic key material, cryptographic operations, device authentication and attestation and secure over-the-air (OTA) updates. TEEs can provide a reduced set of operations only required to establish trust between communication partners and ex- pose a smaller attack surface than a rich OS. An OS could be compromised by malware or through a physical attack. Separating critical operations from the OS provides an extra layer of security and allows for independent attestation and verification. In the constrained IoT, hardware-supported TEEs can help to protect devices. On Arm Cortex-M devices with the Armv8- M and Armv8.1-M architectures, TrustZone-M allows for a memory-map based system separation [2]. Flash and memory are split into secure and non-secure address regions, allowing access to secure addresses only, when the CPU runs in a secure state. CPU state transitions are performed in hardware, either by triggering interrupts or through non-secure callable veneer functions, aiming to make them fast and efficient. Non-Secure Hardware Trusted Firmware-M HAL Secure Hardware Core (IPC, SPM, Interrupts) Secure Boot Updates Storage Crypto Attestation PSA APIs Non-Secure Apps Fig. 1. TF-M in combination with a non-secure operating system like RIOT To increase the security of the IoT operating system RIOT [5], we aim to integrate a secure firmware with the OS. RIOT is an open source project aiming at a small memory footprint and support for many different architectures. This is achieved by a minimalistic core, which can be extended with optional feature modules. One existing candidate for a secure firmware on Arm Cortex-M platforms, is the open source project Trusted Firmware-M (TF-M) [4]. TF-M is a reference implementation of a Secure Processing Environment (SPE) [3], which has been specified as part of the Arm Platform Security Architecture (PSA) framework. Since RIOT already supports the PSA Crypto API [6], we decided to also evaluate the suitability of TF-M as a secure firmware in RIOT. In this poster, we report on ongoing work to leverage TEE technologies in RIOT. We partly integrated TF-M with the OS and document the steps needed to run RIOT side by side with the firmware (§ II). We then measur