mobile hardware platform security · embedded system security mobile hardware platform security...

Embedded System Security

Mobile Hardware Platform Security

Prof. Dr.-Ing. Ahmad-Reza Sadeghi

System Security Lab

Technische Universität Darmstadt

Germany

Summer Term 2017

1

This slide set is based on slides provided by Prof. N. Asokan, Aalto University, Finland

Acknowledgement

General model for mobile platform security

Key hardware security techniques and general architecture

Example

ARM TrustZone

Overview

Platform Security Architecture

Administrator

User

Application Installer

Reference Monitor

Mobile Device

System Updater Policy Database


Application

Boot Integrity

Device Identification

Application Database

Developer

Centralized Marketplace

Operator

Auxiliary Marketplace

Operator

Isolated Execution

Device Authentication

Platform Provider

Application Loader

Device Management

Third-party library

Third-party service

HW

Security A

PI

Secure Storage

Boot VerifierSecure Storage

Provider

Platform Security Component

Third-Party Software Component

Role

Legacy DACExecution Protection

Hardware-Security Functionality

Legend

Software isolation

System service

System library

IPC


Boot Integrity


Isolated Execution

Device Authentication

HW

Security A

PI

Secure Storage

Hardware Platform Security

Boot Integrity


Isolated Execution

DeviceAuthentication

HW

Security A

PI

Secure Storage

Trusted Execution Environment

What is a TEE?

Execution Environment

What is a TEE?

Processor, memory, storage, peripherals

Execution Environment

What is a TEE?

Isolated and integrity-protected


From the “normal” execution environment (Rich Execution Environment)


What is a TEE?

Isolated and integrity-protected


From the “normal” execution environment (Rich Execution Environment)

Chances are that:You have devices with hardware-based TEEs in them!But you don’t have (m)any apps using them


1. Platform integrity (“boot integrity”)

2. Secure storage

3. Isolated execution

4. Device identification

5. Device authentication

Platform integrity

Device certificate

Boot sequence

Device identification

Secure storage and isolated execution

Cryptographic mechanisms

Deviceauthentication

Base identity

Verification root

Device key KD

Identity

Device pub key PKD

Trusted application

TEE mgmtlayer

Non-volatile memory

Volatile memory

App

Mobile OS

REE

App

Trusted OS

Trusted app

Trusted app

TEE

Mobile device hardware

TEE Overview

Platform Integrity

TEE code

Platform integrity

Launch boot code

Boot sequence

Cryptographic mechanismsTrust anchor (Code)

Legend

External certificate

Trust anchor

(Hardware)

Volatile memory

Boot code certificate

Boot code hash

Verification root

Mobile device hardware TCB

Device key KD

Non-volatile

memory


Base identity

Trusted Application

(TA)

TEE management


Certified by device manufacturer: SigSKM

(H(boot code))

Platform Integrity

TEE code

Platform integrity

Launch boot code

Boot sequence

Cryptographic mechanismsTrust anchor (Code)

Legend


Trust anchor

(Hardware)

Volatile memory

Boot code certificate

Boot code hash

Verification root


Device key KD

Non-volatile

memory


Base identity

Trusted Application

(TA)

TEE management


Device manufacturer public key: PKM

Signature verification algorithm

Certified by device manufacturer: SigSKM

(H(boot code))

Stores measurements for authenticated boot

Volatile memory

Verification root

Secure Storage

TEE code

Secure storage


Trust anchor (Code)

Legend


Trust anchor (Hardware)

Device key KD

Non-volatile

memory



Base identity

Trusted Application

(TA)

TEE management

Platform integrity

Boot sequence

Sealed-data = AuthEncKD(data | ...)

Insecure Storage

Volatile memory

Verification root

Secure Storage

TEE code

Secure storage


Trust anchor (Code)

Legend



Device key KD

Non-volatile

memory



Base identity

Trusted Application

(TA)

TEE management

Platform integrity

Boot sequence

Sealed-data = AuthEncKD(data | ...)

Insecure Storage

Protected memory

Encryption algorithm

Rollback protection

Isolated Execution

TEE code

Secure storage and isolated

execution


Trust anchor (Code)

Legend



Trusted Application

(TA)


Volatile memory

Verification root

TEE management

TA code certificate

TA code hash

Device key KD

Non-volatile

memory

TEE Entry from Rich Execution Environment

Boot sequence

Platform integrity

Base identity


Controls TA execution

Certified by device manufacturer


TEE code


Trust anchor (Code)

Legend




Verification root

Identity certificate

Assigned identity


Base identity

Base identity

Platform integrity

Boot sequence

Volatile memory Device key KD

Non-volatile

memory

Trusted Application

(TA)

TEE management


One fixed device identity

Multiple assigned identities (Certified by device manufacturer)

Verification root

Device Authentication (and Remote Attestation)

TEE code


Trust anchor (Code)

Legend




Device certificate

Device public key PKD

Device authentication

Identity

Device key KD

External trust root

Volatile memory

Boot sequence

Platform integrity

Non-volatile

memory

Trusted Application

(TA)

TEE management


Verification root

Device Authentication (and Remote Attestation)

TEE code


Trust anchor (Code)

Legend




Device certificate

Device public key PKD

Device authentication

Identity

Device key KD

External trust root

Volatile memory

Boot sequence

Platform integrity

Non-volatile

memory

Trusted Application

(TA)

TEE management


Issued by device manufacturer

Used to protect/derive signature key

Sign system state in remote attestation

1. Platform integrity

– Secure boot

– Authenticated boot

TEE code

Platform integrity

TEE Entry from Rich Execution Environment

Identity certificate

Device certificate

Launch boot code

Boot code certificate TA code certificate

Boot sequence





Deviceauthentication

Trust anchor (Code)

Legend



Base identity

Verification root

External trust root

Device key KD

Base identity

Assigned identity

Boot code hash TA code hash

Identity

Device pub key PKD

Trusted application

TEE mgmtlayer

Non-volatile memory

Volatile memory

2. Secure storage

3. Isolated execution

– Trusted Execution Environment (TEE)

4. Device identification

5. Device authentication

– Remote attestation

Hardware Security Mechanisms (recap)

Device

App

Device OS

Rich execution environment (REE)

App

TEE management layer

Trusted app

Trusted app

TEE API

Trusted execution environment (TEE)

Device hardware and firmware with TEE support

Architectures with single TEE

• ARM TrustZone

• TI M-Shield

• Smart card

• Crypto co-processor

• Trusted Platform Module (TPM)

Architectures with multiple TEEs

• Intel SGX

• TPM (and “Late Launch”)

• Hypervisor

TEE entry

TEE System Architecture

External Security Co-processor

TEE component

On-SoC

RAM ROM

OTP Fields

External Peripherals

Processor core(s)

Off-chip memory

Internal peripherals

RAM ROM

OTP Fields


Processor core(s)

Off-chip Memory


On-chip Security Subsystem

On-SoC

External Secure Element(TPM, smart card)

Embedded Secure Element(smart card)

Processor Secure Environment(TrustZone, M-Shield)

On-SoC

RAM ROM

OTP Fields


Processor core(s)

Off-chip Memory


Legend:SoC : system-on-chipOTP: one-time programmable

TEE Hardware Realization Alternatives

Main CPUModem

Peripherals (touchscreen, USB, NFC…)

Memory controller

Memory controller

Off-chip/main memory (DDR)

System on chip (SoC)

Boot ROM

On-chip memory

TrustZone hardware architecture

Interrupt controller

Secure World and Normal World

ARM TrustZone Architecture

SoC internal bus (carries status flag)

Main CPUModem


Memory controller

Memory controller



Boot ROM

Access control hardware

On-chip memory







TEE entry

App

Mobile OS

Normal world (REE)

App

Trusted OS

Trusted app

Trusted app

Secure world (TEE)

Device hardware

TrustZone system architecture

SoC internal bus (carries status flag)

Main CPUModem


Memory controller

Memory controller



Boot ROM


On-chip memory







Secure World (SW)Normal World (NW)

User mode

Supervisor Supervisor

User User

SCR.NS=1

Boot sequence

Monitor

Secure Monitor Call (SMC)

SCR.NS=0

SCR.NS := 1

Privileged mode

TZ-aware MMU

SW RWNW NA

SW RONW WO

SW RWNW RW

physical address range

Address space controllers

On-chip ROM On-chip RAM Main memory

Legend:MMU: memory management unit

SCR.NS := 0

TrustZone Overview

TrustZone Example (1/2)

Secure World SupervisorBoot sequence

1. Boot begins in Secure World Supervisor mode (set access control) On-chip ROM

On-chip RAM

Main memory (off-chip)



1. Boot begins in Secure World Supervisor mode (set access control) On-chip ROM

On-chip RAM


SW RWNW NA

SW RWNW NA

SW RWNW NA



1. Boot begins in Secure World Supervisor mode (set access control)

2. Copy code and keys from on-chip ROM to on-chip RAM

Secure World Supervisor

On-chip ROM

On-chip RAM


SW RWNW NA

SW RWNW NA

SW RWNW NA

code (trusted OS)device key




3. Configure address controller (protect on-chip memory)




On-chip ROM

On-chip RAM


SW RWNW NA

SW RWNW NA

SW RWNW NA


SW NANW NA




4. Prepare for Normal World boot






On-chip ROM

On-chip RAM


SW RWNW NA

SW RWNW NA

SW RWNW NA


SW NANW NA

SW RWNW RW




4. Prepare for Normal World boot






On-chip ROM

On-chip RAM


SW RWNW NA

SW RWNW NA

SW RWNW NA


SW NANW NA

SW RWNW RW

code (boot loader)


5. Jump to Normal World Supervisor for traditional boot

Secure World Supervisor Normal World

Supervisor

An ordinary bootfollows: Set up MMU, load OS, drivers…

On-chip ROM

On-chip RAM


SW NANW NA

SW RWNW NA

SW RWNW RW

SCR.NS1




Supervisor


6. Set up trusted application execution

Supervisor

NormalWorld User

On-chip ROM

On-chip RAM


SW NANW NA

SW RWNW NA

SW RWNW RW

trusted app and parameters

SCR.NS1




Supervisor


6. Set up trusted application execution

Supervisor

NormalWorld User

Secure World Monitor

Normal World Supervisor

SMC, SCR.NS0

7. Execute trusted application

On-chip ROM

On-chip RAM


SW NANW NA

SW RWNW NA

SW RWNW RW

trusted app and parameters

SCR.NS1

Secure Boot vs. Authenticated Boot

Firmware

OS Kernel checker

pass/failBoot block

pass/fail

checker

checker

Secure Boot Authenticated Boot

Firmware

Boot block

OS Kernel measurer

measurer

measurer state

Why? State can be:- bound to stored secrets (sealing)- reported to external verifier (remote attestation)

Why?How will you implement a checker?- hardcode H(boot code) as reference value in checker (in Firmware)?

aggregated hash

TrustZone support available in majority of current smartphones

Mainly used for manufacturer internal purposes

Digital rights management, Subsidy lock…

APIs for developers?

Mobile TEE Deployment

TEE entry

App

Mobile OS

Normal world

App

Trusted OS

Trusted app

Trusted app

Secure world

Smartphone hardware

// create RSA key pair

Context ctx;

KeyPairGeneratorSpec spec = new KeyPairGeneratorSpec.Builder(ctx);

spec.setAlias(”key1")

…

spec.build();

KeyPairGenerator gen = KeyPairGenerator.getInstance("RSA", "AndroidKeyStore");

gen.initialize(spec);

KeyPair kp = gen.generateKeyPair();

// use private key for signing

AndroidRsaEngine rsa = new AndroidRsaEngine("key1", true);

PSSSigner signer = new PSSSigner(rsa, …);

signer.init(true, …);

signer.update(signedData, 0, signedData.length);

byte[] signature = signer.generateSignature();

Android Key Store example

Elenkov. Credential storage enhancements in Android 4.3. 2013.

Android Key Store API

http://nelenkov.blogspot.ch/2013/08/credential-storage-enhancements-android-43.html

Android Key Store Implementation

TEE entry

Android app

Android OS

Normal world

Android app

Qualcomm Secure Execution Environment

(QSEE)

Java Cryptography Extensions (JCE)

Secure world

ARM with TrustZone

Keymaster Trusted app

Android device

libQSEEcomAPI.so

Selected devices

• Android 4.3

• Nexus 4, Nexus 7

Keymaster operations

• GENERATE_KEYPAIR

• IMPORT_KEYPAIR

• SIGN_DATA

• VERIFY_DATA

Persistent storage on Normal World

Elenkov. Credential storage enhancements in Android 4.3. 2013.

http://nelenkov.blogspot.ch/2013/08/credential-storage-enhancements-android-43.html

What Protects Hardware Platform Security?

A well-known scientist (some say it was Bertrand Russell) once gave a public lecture on astronomy. He described how the earth orbits around the sun and how the sun, in turn, orbits around the center of a vast collection of stars called our galaxy. At the end of the lecture, a little old lady at the back of the room got up and said: "What you have told us is rubbish. The world is really a flat plate supported on the back of a giant tortoise." The scientist gave a superior smile before replying, "What is the tortoise standing on?" "You're very clever, young man, very clever," said the old lady. "But it's tortoises all the way down!“- Stephen Hawking, in A Brief History of Time

http://transversalinflections.files.wordpress.com/2011/06/turtles-all-the-way-down.png

http://en.wikipedia.org/wiki/Bertrand_Russell

http://transversalinflections.files.wordpress.com/2011/06/turtles-all-the-way-down.png

mobile hardware platform security · embedded system security mobile hardware platform security...

Documents