Abstract:The Trusted Execution Environment (TEE) is designed to establish a safe environment that prevents the execution of unauthenticated programs. The nature of TEE is a continuous verification process with hashing, signing, and verifying. Such a process is called the Chain-of-Trust, derived from the Root-of-Trust (RoT). Typically, the RoT is pre-programmed, hard-coded, or embedded in hardware, which is locally produced and checked before booting. The TEE employs various cryptographic processes throughout the boot process to verify the authenticity of the bootloader. It also validates other sensitive data and applications, such as software connected to the operating system. TEE is a self-contained environment and should not serve as the RoT or handle secure boot operations. Therefore, the issue of implementing hardware for RoT has become a challenge that requires further investigation and advancement. The main objective of this proposal is to introduce a secured RISC-V-based System-on-Chip (SoC) architecture capable of securely booting a TEE using a versatile boot program while maintaining complete isolation from the TEE processors. The suggested design has many cryptographic accelerators essential for the secure boot procedure. Furthermore, a separate 32-bit MicroController Unit (MCU) is concealed from the TEE side. This MCU manages sensitive information, such as the root key, and critical operations like the Zero Stage BootLoader (ZSBL) and key generation program. Once the RoT is integrated into the isolated sub-system, it becomes completely unavailable from the TEE side, even after booting, using any method. Besides providing a secured boot flow, the system is integrated with essential crypto-cores supporting Transport Layer Security (TLS) 1.3. The chip is finally fabricated using the Complementary Metal–Oxide–Semiconductor (CMOS) 180 nm process.

A Server-Based Secure Bootstrap Architecture

Trusted Terminal Design of Distributed Environment

A Trustenclave-Based Architecture for Ensuring Run-Time Security in Embedded Terminals

Design of Secure Operating System

Securing Network-Booting Linux Systems at the Example of bwLehrpool and bwForCluster NEMO

Key Technologies for Trusted Computing Environment on Embedded Terminal

Customizable boot protocol for network computing

Design and Implementation of SecPod, A Framework for Virtualization-Based Security Systems.

Template for Preparation of Manuscripts for Tsinghua Science and Technology

Security analysis of the Bootstrap protocol for deny-by-default Mobile Ad-hoc Networks

RBIS: Security Enhancement for MRBP and MRBP2 Using Integrity Check

A Novel Server-Based Application Execution Architecture

Trusted Computing Base Using Virtualization Platform

Colaboot: A Cloud-based Diskless PC Booting Mechanism

Trusted Computing Model Based on Server-End Storage

Secguard: Secure And Practical Integrity Protection Model For Operating Systems

CARE: Lightweight Attack Resilient Secure Boot Architecturewith Onboard Recovery for RISC-V based SOC

Performance Modeling and Analysis of the Booting Process in a Transparent Computing Environment

A Trusted Execution Environment RISC-V System-on-Chip Compatible with Transport Layer Security 1.3

A New Highly Reliable Train Operation Monitoring Device

Cerberus: A Novel Hypervisor to Provide Trusted and Isolated Code Execution