uTango: an open-source TEE for IoT devices

Abstract

Security is one of the main challenges of the Internet of Things (IoT). IoT devices are mainly powered by low-cost microcontrollers (MCUs) that typically lack basic hardware security mechanisms to separate security-critical applications from less critical components. Recently, Arm has started to release Cortex-M MCUs enhanced with TrustZone technology (i.e., TrustZone-M), a system-wide security solution aiming at providing robust protection for IoT devices. Trusted Execution Environments (TEEs) relying on TrustZone hardware have been perceived as safe havens for securing mobile devices. However, for the past few years, considerable effort has gone into unveiling hundreds of vulnerabilities and proposing a collection of relevant defense techniques to address several issues. While new TEE solutions built on TrustZone-M start flourishing, the lessons gathered from the research community appear to be falling short, as these new systems are trapping into the déjà vu pitfalls of the past. In this paper, we present UTANGO, the first multi-world TEE for modern IoT devices. UTANGO proposes a novel architecture aiming at tackling the major architectural deficiencies currently affecting TrustZone(-M)-assisted TEEs. In particular, we leverage the very same TrustZone hardware primitives used by dual-world implementations to create multiple, equally-secure execution environments within the normal world. We demonstrate the benefits of UTANGO by conducting an extensive evaluation on a real TrustZone-M hardware platform, i.e., Arm Musca-B1. UTANGO will be open-sourced and freely available on GitHub in hopes of engaging academia and industry on securing the foreseeable trillion IoT devices.

BYOTee: Towards Building Your Own Trusted Execution Environments Using FPGA

“…S/T Haven [21] X SGXIO [81] X+H SGX-FPGA [82] X+F KeyStone [52] R Sanctum [32] R CURE [20] R Composite Encl. [71] R SANCTUARY [24] A TrustICE [77] A vTZ [43] A+H Ambassy [45] A+F − − − uTango [62] M Graviton [80] G HECTOR-V [60] N TEEOD [73] F To address the single TEE issue, vTZ [43] provides each guest virtual machine with a virtualized guest TEE by running a monitor within the secure world, which virtualizes memory mapping and world switching for the guest TEEs on Cortex-A TrustZone. SANCTUARY [24] addresses the same drawback by utilizing the memory access controller to provide multidomain isolation for sensitive applications.…”

“…TrustICE [77] creates multiple isolated computing environments in the normal domain and runs a monitor in the secure world. uTango [62] use the secure attribution unit of Cortex-M to create multiple secure execution environments within the non-secure state. The uTango kernel runs in the secure state privileged level, while other applications, services, OSes are isolated in their own non-secure state domains.…”