基于TrustZone的可信执行环境构建技术研究
|
摘要
可信执行环境(TEE)作为一种通过隔离的方法保护数据和程序的技术,与传统安全技术相比,能够主动防御来自外部的安全威胁,更有效地保障自身安全。随着内置TrustZone技术的ARM处理器的广泛应用,可信执行环境开发受到重视。目前已经出现了很多基于TrustZone的开源项目,但因缺乏相应标准等原因给应用开发带来了障碍。文章以OpenTEE为例,深入研究了可信执行环境的整体结构,分析了软件层的组件构成和运行流程,提出了可信应用的开发方法。通过实验,比较分析了几种可信执行环境在部署难易度、开发难易度、内存占用等方面的性能。文章提出的可信执行环境构建方法具有良好的软件结构,易于开发。
As a technique for protecting data and programs,compared with the traditional security technology,the trusted execution environment(TEE) can actively prevent threats from outside and ensure the safety of host more effectively by means of hardware aided isolation.With the extensive application of the ARM processor with the built-in TrustZone,trusted execution environment development has been paid increasing attentions.At present,there have been many open source TEE projects based on TrustZone,but their applications still face with problems because of the lack of corresponding standards.Taking Open-TEE as an example,this paper deeply studies the overall structure of TEE,analyzes the architecture of software layer and operational process,and proposes the development method of trusted application.The performances of deployment,development and memory footprint of some TEEs are compared through experiments.The development method of TEE proposed in this paper has good software architecture and is easy to be developed.
As a technique for protecting data and programs,compared with the traditional security technology,the trusted execution environment(TEE) can actively prevent threats from outside and ensure the safety of host more effectively by means of hardware aided isolation.With the extensive application of the ARM processor with the built-in TrustZone,trusted execution environment development has been paid increasing attentions.At present,there have been many open source TEE projects based on TrustZone,but their applications still face with problems because of the lack of corresponding standards.Taking Open-TEE as an example,this paper deeply studies the overall structure of TEE,analyzes the architecture of software layer and operational process,and proposes the development method of trusted application.The performances of deployment,development and memory footprint of some TEEs are compared through experiments.The development method of TEE proposed in this paper has good software architecture and is easy to be developed.
引文
[1]Global Platform.TEE System Architecture[EB/Ol].http://www.globalplatform.org/specificationsdevice.asp,2015-12-1.
[2]EKBERG J E.Securing Software Architectures for Trusted Processor Environments[EB/OL].http://urn.fi/URN:IS BN:978-952-60-3632-8,2015-5-31.
[3]Global Platform.Home Page[EB/OL].http://www.globalplatform.org,2015-5-31.
[4]Intel.SEP Driver[EB/OL].https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/tree/drivers/staging/sep?id=refs/tags/v3.14.32,2015-6-12.
[5]Apple.i OS Security[EB/OL].https://www.apple.com/ca/iphone/business/docs/i OS_Security_Feb14.pdf,2015-12-1.
[6]AZEMA J,FAYAD G.Shield Mobile Security Technology[EB/OL].http://focus.ti.com/pdfs/wtbu/ti_mshield_whitepaper.pdf,2015-5-31.
[7]MCKEEB F,ALEXANDROVICH L,BERENZON A,et al.Innovative Instructions and Software Model for Isolated Execution[EB/OL].http://doi.acm.org/10.1145/2487726.2488368,2015-6-12.
[8]马威,韩臻,成阳.可信云计算中的多级管理机制研究[J].信息网络安全,2015(7):20-25.
[9]ARM.ARM Security Technology-Building a Secure System Using Trust Zone Technology[EB/OL].http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.prd29-genc-009492c/index.html,2015-6-12.
[10]ARM.Trust Zone[EB/OL].http://www.arm.com/zh/products/processors/technologies/trustzone/index.php,2015-8-23.
[11]黄强,张德华,汪伦伟.可信计算硬件设备虚拟化关键保障机制研究[J].信息网络安全,2015(9):70-73.
[12]ARM.ARM Security Technology Building a Secure System Using Trust Zone Technology[EB/OL].http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.prd29-genc-009492c/index.html,2015-12-1.
[13]李海威,范博,李文锋.一种可信虚拟平台构建方法的研究和改进[J].信息网络安全,2015(1):1-5.
[14]Linaro.OP-TEE[EB/OL].https://wiki.linaro.org/Working Groups/Security/OP-TEE,2015-12-1.
[15]MCGILLION B,DETTENBORN T,NYMAN T,et al.OpenTEE--An Open Virtual Trusted Execution Environment[C]//IEEE.Trustcom/Big Data SE/ISPA,2015,August 20-22,2015,Helsinki,Finland.New York:IEEE,2015(1):400-407.
[16]Trust Kernel.T6[EB/OL].https://www.trustkernel.com/uploads/datasheets/T6_TEE_datasheet.pdf,2015-8-23.
[17]Android Open Source Project.Managing Your App’s Memory[EB/OL].http://wear.techbrood.com/training/articles/memory.html,2015-8-23.
[2]EKBERG J E.Securing Software Architectures for Trusted Processor Environments[EB/OL].http://urn.fi/URN:IS BN:978-952-60-3632-8,2015-5-31.
[3]Global Platform.Home Page[EB/OL].http://www.globalplatform.org,2015-5-31.
[4]Intel.SEP Driver[EB/OL].https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/tree/drivers/staging/sep?id=refs/tags/v3.14.32,2015-6-12.
[5]Apple.i OS Security[EB/OL].https://www.apple.com/ca/iphone/business/docs/i OS_Security_Feb14.pdf,2015-12-1.
[6]AZEMA J,FAYAD G.Shield Mobile Security Technology[EB/OL].http://focus.ti.com/pdfs/wtbu/ti_mshield_whitepaper.pdf,2015-5-31.
[7]MCKEEB F,ALEXANDROVICH L,BERENZON A,et al.Innovative Instructions and Software Model for Isolated Execution[EB/OL].http://doi.acm.org/10.1145/2487726.2488368,2015-6-12.
[8]马威,韩臻,成阳.可信云计算中的多级管理机制研究[J].信息网络安全,2015(7):20-25.
[9]ARM.ARM Security Technology-Building a Secure System Using Trust Zone Technology[EB/OL].http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.prd29-genc-009492c/index.html,2015-6-12.
[10]ARM.Trust Zone[EB/OL].http://www.arm.com/zh/products/processors/technologies/trustzone/index.php,2015-8-23.
[11]黄强,张德华,汪伦伟.可信计算硬件设备虚拟化关键保障机制研究[J].信息网络安全,2015(9):70-73.
[12]ARM.ARM Security Technology Building a Secure System Using Trust Zone Technology[EB/OL].http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.prd29-genc-009492c/index.html,2015-12-1.
[13]李海威,范博,李文锋.一种可信虚拟平台构建方法的研究和改进[J].信息网络安全,2015(1):1-5.
[14]Linaro.OP-TEE[EB/OL].https://wiki.linaro.org/Working Groups/Security/OP-TEE,2015-12-1.
[15]MCGILLION B,DETTENBORN T,NYMAN T,et al.OpenTEE--An Open Virtual Trusted Execution Environment[C]//IEEE.Trustcom/Big Data SE/ISPA,2015,August 20-22,2015,Helsinki,Finland.New York:IEEE,2015(1):400-407.
[16]Trust Kernel.T6[EB/OL].https://www.trustkernel.com/uploads/datasheets/T6_TEE_datasheet.pdf,2015-8-23.
[17]Android Open Source Project.Managing Your App’s Memory[EB/OL].http://wear.techbrood.com/training/articles/memory.html,2015-8-23.