Security is one of the main challenges of the Internet of Things (IoT). IoT devices are mainly powered by low-cost microcontrollers (MCUs) that typically lack basic hardware security mechanisms to separate security-critical applications from less critical components. Recently, Arm has started to release Cortex-M MCUs enhanced with TrustZone technology (i.e., TrustZone-M), a system-wide security solution aiming at providing robust protection for IoT devices. Trusted Execution Environments (TEEs) relying on TrustZone hardware have been perceived as safe havens for securing mobile devices. However, for the past few years, considerable effort has gone into unveiling hundreds of vulnerabilities and proposing a collection of relevant defense techniques to address several issues. While new TEE solutions built on TrustZone-M start flourishing, the lessons gathered from the research community appear to be falling short, as these new systems are trapping into the same pitfalls of the past. In this paper, we present UTANGO, the first multi-world TEE for modern IoT devices. UTANGO proposes a novel architecture aiming at tackling the major architectural deficiencies currently affecting TrustZone(-M)-assisted TEEs. In particular, we leverage the very same TrustZone hardware primitives used by dual-world implementations to create multiple and equally secure execution environments within the normal world. We demonstrate the benefits of UTANGO by conducting an extensive evaluation on a real TrustZone-M hardware platform, i.e., Arm Musca-B1. UTANGO will be open-sourced and freely available on GitHub in hopes of engaging academia and industry on securing the foreseeable trillion IoT devices.

Virtualization technology starts becoming more and more widespread in the embedded systems arena, driven by the upward trend for integrating multiple environments into the same hardware platform. The penalties incurred by standard software-based virtualization, altogether with the strict timing requirements imposed by real-time virtualization are pushing research towards hardware-assisted solutions. Among existing commercial off-the-shelf (COTS) technologies, ARM TrustZone promises to be a game-changer for virtualization, despite of this technology still being seen with a lot of obscurity and scepticism. In this paper we present a Lightweight TrustZoneassisted Hypervisor (LTZVisor) as a tool to understand, evaluate and discuss the benefits and limitations of using TrustZone hardware to assist virtualization. We demonstrate how TrustZone can be adequately exploited for meeting the real-time needs, while presenting a low performance cost on running unmodified rich operating systems. While ARM continues to spread TrustZone technology from the applications processors to the smallest of microcontrollers, it is undeniable that this technology is gaining an increasing relevance. Our intent is to encourage research and drive the next generation of TrustZone-assisted virtualization solutions.

With the advent of the Internet of Things (IoT), security has emerged as a major design goal for smart connected devices. This explosion in connectivity created a larger attack surface area. Software-based approaches have been applied for security purposes; however, these methods must be extended with security-oriented technologies that promote hardware as the root of trust. The ARM TrustZone can enable trusted execution environments (TEEs), but existing solutions disregard real-time needs. Here, the authors demonstrate why TrustZone is becoming a reference technology for securing IoT edge devices, and how enhanced TEEs can help meet industrial IoT applications real-time requirements.

Trusted Execution Environments (TEEs) are fundamental in securing a broad spectrum of applications and are prevalent on various platforms, from mobile and embedded devices to cloud servers. However, the existing landscape of TEE technologies is notably heterogeneous, posing substantial interoperability and compatibility challenges for application developers and system designers. These hurdles are not limited to well-established technologies like Arm TrustZone and Intel SGX, but also extend to newer generations of TEE models. In this context, we introduce AnyTEE, a new framework that allows application developers to use multiple TEE models in their applications and system designers to engineer customized TEE models across multiple Instruction Set Architectures (ISAs). Essentially, AnyTEE harnesses widely available hardware virtualization primitives to facilitate the development of Software Defined TEEs (sdTEEs). Our implementation of AnyTEE includes sdTEE versions of the SGX and TrustZone models for Arm and RISC-V, respectively, along with an sdTEE variant of SGX that incorporates fine-grained isolation mechanisms. Our evaluation shows that AnyTEE achieves near-native performance (<3% overhead).

The pervasive use of embedded computing systems in modern societies altogether with the industry trend towards consolidating workloads, openness and interconnectedness, have raised security, safety, and real-time concerns. Virtualization has been used as an enabler for safety and security, but research works have proven that it must be extended and improved with hardware-based security foundations. ARM Trustzone has been used for the realization of Trusted Environments, however in this case real-time requirements are completely disregarded. This work in progress paper presents FreeTEE, an embedded architecture that emphasizes and preserves the real-time properties of the system but still guarantees security from the outset. TrustZone technology is exploited to implement the basic building blocks of a Trusted Execution Environment (TEE) as a lower-priority thread of a RTOS. Preliminary results demonstrated that the real-time properties of the RTOS remain practically intact.

Virtualization has been deployed as a key enabling technology for coping with the ever growing complexity and heterogeneity of modern computing systems. However, on its own, classical virtualization is a poor match for modern endpoint embedded system requirements such as safety, security and real-time, which are our main target. Microkernel-based approaches to virtualization have been shown to bridge the gap between traditional and embedded virtualization. This notwithstanding, existent microkernel-based solutions follow a highly para-virtualized approach, which inherently requires a significant software engineering effort to adapt guest operating systems (OSes) to run as userland component s. In this paper, we present μRTZVisor as a new TrustZone-assisted hypervisor that distinguishes itself from state-of-the-art TrustZone solutions by implementing a microkernel-like architecture while following an object-oriented approach. Contrarily to existing microkernel-based solutions, μRTZVisor is able to run nearly unmodified guest OSes, while, contrarily to existing TrustZone-assisted solutions, it provides a high degree of functionality and configurability, placing strong emphasis on the real-time support. Our hypervisor was deployed and evaluated on a Xilinx Zynq-based platform. Experiments demonstrate that the hypervisor presents a small trusted computing base size (approximately 60KB), and a performance overhead of less than 2% for a 10 ms guest-switching rate.

O aumento de dispositivos no âmbito da Internet of Things (IoT), levou a um aumento significativo no uso de microcontroladores (MCUs). Os MCUs são usados em diversos sistemas, desde eletrónica de consumo até às nossas infraestruturas mais críticas. Apesar da sua utilização generalizada, os MCUs continuam a ser dispositivos com recursos limitados, de computação limitada e funcionalidades de hardware mínimas. À medida que enfrentam requisitos e desafios conflituantes, tais como ciber-ataques, mais desempenho e problemas de previsibilidade, os MCUs estão a passar por uma transformação tecnológica. Perante as crescentes preocupações de segurança, a Arm introduziu a tecnologia TrustZone nas suas arquiteturas Cortex-M (Armv8-M). Em processadores de alto desempenho, o TrustZone tem sido o principal impulsionador na implementação de Trusted Execution Environments (TEEs). Os TEEs providenciam arquiteturas seguras que protegem aplicações de segurança. No entanto, os TEEs assistidos pela Trust- Zone enfrentaram hoje inúmeras vulnerabilidades, que colocam em causa a sua segurança. Entretanto, para satisfazer as exigências de desempenho das aplicações de computação intensiva, os fabricantes de MCUs estão a adotar progressivamente arquiteturas multi-core que melhoram o desempenho e, ao mesmo tempo, respondem aos requisitos relacionados com peso, tamanho, e eficiência energética (SWaP-C). No entanto, os MCUs estão na base de vários sistemas de criticidade mista em que a previsibilidade é fundamental. Como tal, a mudança para multi-core introduz desafios devido à contenção sobre recursos partilhados que dificultam a previsibilidade destes sistemas. Nesta tese, abordamos três desafios no desenvolvimento de sistemas para MCUs: (i) explorar μ-TEEs para melhorar a sua segurança, (ii) ultrapassar as suas inerentes limitações, e (iii) mitigar a contenção em recursos partilhados de MCUs multi-core. Na primeira contribuição é analisado sistematicamente os μ-TEEs existentes, identificando-se problemas de segurança que guiaram o desenvolvimento do uTango. Na segunda contribuição, é apresentado o uTango, um μ-TEE inovador que expande o modelo de segurança do TrustZone para múltiplos ambientes isolados. Finalmente, na terceira contribuição, é introduzido o μTPArtc, um mecanismo para mitigar contenção e assegurar a previsibilidade de MCUs multi-core.

ARM TrustZone é um “Ambiente de Execução Confiável” disponibilizado em processadores da ARM, que equipam grande parte dos sistemas embebidos. Este mecanismo permite assegurar que componentes críticos de uma aplicação executem num ambiente que garante a confidencialidade dos dados e integridade do código, mesmo que componentes maliciosos estejam instalados no mesmo dispositivo. Neste projecto pretende-se tirar partido do TrustZone no contexto de uma framework segura de monitorização em tempo real de sistemas embebidos. Especificamente, pretende-se recorrer a components como o ARM Trusted Firmware, responsável pelo processo de secure boot em sistemas ARM, para desenvolver um mecanismo de atestação que providencie garantias de computação segura a entidades remotas.

Os computadores pessoais e dispositivos móveis tornaram-se ubíquos, por isso, garantir a segurança de dados sensíveis tornou-se fundamental. No entanto, com o aumento da complexidade destes siste mas, vulnerabilidades surgem e quebram os seus mecanismos de segurança. Os Trusted Execution Environments (TEEs) fornecem um ambiente de execução isolado, e são por isso a tecnologia vigente para proteger os sistemas actuais. Assim sendo, surgiram várias tecnologias TEE nas arquitecturas de processador mais comuns, onde cada arquitectura oferece uma solução de TEE que cumpre com requisitos de segurança específicos ao seu caso de uso. A tecnologia TrustZone da Arm é amplamente adoptada para implementar TEEs, fornecendo mecanis mos necessários à minimização da Trusted Computing Base (TCB) e à protecção de dados. É assumido que o software destes sistemas é mais seguro do que os Sistemas Operativos (SOs) comuns; no entanto, a divulgação sistemática de vulnerabilidades, afectando bilhões de dispositivos no mundo inteiro, tem levantado dúvidas sobre quais as verdadeiras garantias de segurança que estes sistemas em oferecem. Esta tese tem como objectivo melhorar a segurança dos sistemas TEE baseados em TrustZone, através: i) da análise e classificação de vulnerabilidades em sistemas baseados em TrustZone; e ii) desenvolvimento de mecanismos e soluções inovadoras que sejam capazes de mitigar eficazmente os principais problemas destes sistemas. Das contribuições resultantes, destacamos: i) primeiro, uma análise abrangente de vulnerabilidades de segurança em sistemas TrustZone, na qual identificamos três principais grupos de problemas, e onde propomos uma taxonomia detalhada para a sua classificação; ii) segundo, uma abordagem para diminuir os privilégios do mundo seguro da TrustZone, mitigando assim o impacto de vulnerabilidades e melhorando a segurança do sistema; e iii) finalmente, uma framework para desenvolvimento de software-defined TEEs que suporta a execução de SOs confiáveis em máquinas virtuais, o que fornece uma outra solução para mitigar vulnerabilidades de sistemas TrustZone, e permite resolver questões de interoperabilidade e compatibilidade entre TEEs devido às suas diferenças em termos de funcionalidade e modelos de programação. No geral, as nossas contribuições abordam questões fundamentais sobre a segurança de sistemas TEE baseados em TrustZone, abrindo o caminho para melhorar a segurança destes sistemas.

Virtualization technology allows the coexistence and execution of multiple operating systems on top of the same hardware platform. In the embedded systems domain, virtualization has been focused on the isolation of critical requirements like real-time, security and safety from non-critical characteristics. The strict confinement of guest partitions typically provided by virtualization does not suit the modular and inter-cooperative nature of embedded systems. The need for inter-partition communication has been addressed by multiple virtualization solutions, either to enable guest-level device para-virtualization or to ensure increased flexibility regarding cooperative partitions. However, the majority of existing approaches follow an ad hoc approach with limited to none applicability outside their solution's scope. This paper presents TZ-VirtIO, an asynchronous standardized inter-partition communication (IPC) mechanism on top of a TrustZone-assisted dual-OS hypervisor (LTZVisor). The implemented IPC uses the standard VirtIO transport layer. The experiments conducted on a physical platform show a scalable, high-bandwidth and low-overhead solution for both single-core and multi-core architectures.