Abstract:In ARM TrustZone-based architecture, shared memory is one of the most useful schemes to enable isolated execution environments supported by TrustZone to communicate between environments. However, it is already known that shared memory is vulnerable to man-in-the-middle attacks since mechanisms to check integrity or authenticate callers for the shared memory payload are not supported in TrustZone. While an encryption-based method that resolves this limitation does exist, there are some architectural limitations. Indeed, even with key protection countermeasures applied, there is a risk that encryption keys may be leaked, as they are placed in insecure user memory during communication. Moreover, countermeasures for key leakage cause system performance overhead. In this paper, we propose a lightweight and secure scheme for shared memory, called Software One-Time Programmable Memory (SOTPM). SOTPM is a software-implemented, one-time programmable shared memory. It is based on the idea that payload encryption in the shared memory layer is unnecessary because sensitive data is already encrypted in the application layer before being written to the shared memory. SOTPM is set to read-only after data is written into SOTPM due to the one-time programmable characteristic. Therefore, attackers are unable to manipulate content in SOTPM during communication. Since it is not necessary for SOTPM to encrypt the payload in order to prevent malicious payload manipulation, it is possible to remove the risk of key leakage posed in previous studies. Additionally, in contrast with the existing method, our method can dramatically reduce system performance overhead. We implemented our prototype on an open-source hardware board with an Armv8-A processor and performed a security analysis and performance evaluation. The results show that SOTPM provides a sufficient level of security and less than 1% performance overhead, implying that SOTPM is a reasonable so-ution for current commercial products.

Taking a Look into Execute-Only Memory

Armlock: Hardware-Based Fault Isolation For Arm

One Exploit to Rule them All? On the Security of Drop-in Replacement and Counterfeit Microcontrollers

MIPE: a Practical Memory Integrity Protection Method in a Trusted Execution Environment.

Co-processor-based Behavior Monitoring: Application to the Detection of Attacks Against the System Management Mode

When Memory Mappings Attack: On the (Mis)use of the ARM Cortex-M FPB Unit

Retrofitting XoM for Stripped Binaries without Embedded Data Relocation

Norax: Enabling Execute-Only Memory for Cots Binaries on Aarch64

SOTPM: Software One-Time Programmable Memory to Protect Shared Memory on ARM Trustzone

Transient Execution of Non-Canonical Accesses

EC: Embedded Systems Compartmentalization via Intra-Kernel Isolation

argXtract: Deriving IoT Security Configurations via Automated Static Analysis of Stripped ARM Binaries

Connecting the Dots: Privacy Leakage via Write-Access Patterns to the Main Memory

Resurrection Attack: Defeating Xilinx MPU's Memory Protection

Breaking and Fixing Destructive Code Read Defenses

Hardware-Assisted Monitoring For Instruction Security In Embedded System

Analyzing the Vulnerabilities of External SDRAM on System-on-Chip Field Programmable Gate Array Devices

Using Power-Anomalies to Counter Evasive Micro-Architectural Attacks in Embedded Systems

Fallout: Reading Kernel Writes From User Space

Return-to-Non-Secure Vulnerabilities on ARM Cortex-M TrustZone: Attack and Defense.

SoK: Where's the "up"?! A Comprehensive (bottom-up) Study on the Security of Arm Cortex-M Systems