  Security is one of the main challenges of the Internet of Things (IoT). IoT
devices are mainly powered by low-cost microcontrollers (MCUs) that typically
lack basic hardware security mechanisms to separate security-critical
applications from less critical components. Recently, Arm has started to
release Cortex-M MCUs enhanced with TrustZone technology (i.e., TrustZone-M), a
system-wide security solution aiming at providing robust protection for IoT
devices. Trusted Execution Environments (TEEs) relying on TrustZone hardware
have been perceived as safe havens for securing mobile devices. However, for
the past few years, considerable effort has gone into unveiling hundreds of
vulnerabilities and proposing a collection of relevant defense techniques to
address several issues. While new TEE solutions built on TrustZone-M start
flourishing, the lessons gathered from the research community appear to be
falling short, as these new systems are trapping into the d\'ej\`a vu pitfalls
of the past. In this paper, we present uTango, the first multi-world TEE for
modern IoT devices. uTango proposes a novel architecture aiming at tackling the
major architectural deficiencies currently affecting TrustZone(-M)-assisted
TEEs. In particular, we leverage the very same TrustZone hardware primitives
used by dual-world implementations to create multiple, equally-secure execution
environments within the normal world. We demonstrate the benefits of uTango by
conducting an extensive evaluation on a real TrustZone-M hardware platform,
i.e., Arm Musca-B1. uTango will be open-sourced and freely available on GitHub
in hopes of engaging academia and industry on securing the foreseeable trillion
IoT devices.
