Dynamic Virtual Address Range Adjustment for Intra-Level Privilege Separation on ARM

Abstract

Privilege separation has long been considered as a fundamental principle in software design to mitigate the potential damage of a security attack. Much effort has been given to develop various privilege separation schemes where a monolithic OS or hypervisor is divided into two privilege domains where one domain is logically more privileged than the other even if both run at an identical processor privilege level. We say that privilege separation is intra-level if it is implemented for software of a certain privilege level without any involvement or assistance of more privileged software. In general, realizing intra-level privilege separation mandates developers to rely on certain security features of the underlying hardware. So far, such development efforts however have been much less focused on ARM architectures than on the Intel x86 family mainly because the architectural provision of ARM security features was relatively insufficient. Unlike on x86, as a result, there exists no full intra-level scheme that can be universally applied to any privilege level on ARM. However, as malware and attacks increase against virtually every level of privileged software including an OS, a hypervisor and even the highest privileged software armored by TrustZone, we have been motivated to develop a technique, named as Hilps, to realize true intra-level privilege separation in all these levels of privileged software on ARM. Pivotal to the success of Hilps is the support from a new hardware feature of ARM's latest 64-bit architecture, called TxSZ, which we manipulate to elastically adjust the accessible virtual address range for a program. In our experiments, we have applied Hilps to retrofit the core software mechanisms for privilege separation into existing system software and evaluated the performance of the resulting system. According to the experimental results, the system incurs on average just less than 1 % overhead; hence, we conclude that Hilps is quite promising for practical use in real deployments. Permission to freely reproduce all or part of this paper for noncommercial purposes is granted provided that copies bear this notice and the full citation on the first page. Reproduction for commercial purposes is strictly prohibited without the prior written consent of the Internet Society, the first-named author (for reproduction of an entire paper only), and the author's employer if the paper was prepared within the scope of employment.

The Trade-Off Between Performance and Security of Virtualized Trusted Execution Environment on Android

“…Not many studies focus on this approach due to less security provided. Related techniques proposed to enhance isolation for virtualization in ARM platforms [20,21]. Inter-privilege isolation: there are couple of techniques proposed to deploy isolation environment using ARM platform [22,23].…”

SofTEE: Software-Based Trusted Execution Environment for User Applications

“…In general, address space separation using shadow page table is widely used, but significant overhead is inevitable due to the memory management unit (MMU) configurations and TLB maintenance [29]. In some research [34], [69], the overhead of context switching between a normal kernel execution environment and a trusted kernel execution environment is reduced by reserving an ASID for the trusted kernel execution environment. Unlike the previous research, however, we considered ASID management for trusted applications.…”

“…For the entry gate, in SKEE [34], the authors suggested two solutions: 1) setting the kernel and secure kernel to use different translation table base registers (TTBR0 and TTBR1) respectively, and 2) using a zero register to update the TTBR register. In addition, Hilps [69] adjusted the virtual address range by updating a control register called the translation control register (TCR) at the entry and exit gates. In this case, the gates need to check whether the control register value is valid immediately after updating the register.…”