Abstract:PDF HTML XML Export Cite reminder Refinement-based Modeling and Formal Verification for Multiple Secure Partitions of TrustZone DOI: 10.21655/ijsi.1673-7288.00301 Author: Affiliation: Clc Number: Fund Project: Article | Figures | Metrics | Reference | Related | Cited by | Materials | Comments Abstract:As a trusted execution environment technology on ARM processors, TrustZone provides an isolated and independent execution environment for security-sensitive programs and data on the device. However, running the trusted OS and all the trusted applications in the same environment may cause problems---The exploitation of vulnerabilities on any component may affect the others in the system. Although ARM proposed the S-EL2 virtualization technology, which supports multiple isolated partitions in the secure world to alleviate this problem, there may still be security threats such as information leakage between partitions in the real-world partition manager. Current secure partition manager designs and implementations lack rigorous mathematical proofs to guarantee the security of isolated partitions. This study analyzes the multiple secure partitions architecture of ARM TrustZone in detail, proposes a refinement-based modeling and security analysis method for multiple secure partitions of TrustZone, and completes the modeling and formal verification of the secure partition manager in the theorem prover Isabelle/HOL. First, we build a multiple secure partitions model named RMTEE based on refinement: an abstract state machine is used to describe the system running process and security policy requirements, forming the abstract model. Then the abstract model is instantiated into the concrete model, in which the event specification is implemented following the FF-A specification. Second, to address the problem that the existing partition manager design cannot meet the goal of information flow security verification, we design a DAC-based inter-partition communication access control and apply it to the modeling and verification of RMTEE. Lastly, we prove the refinement between the concrete model and the abstract model, and the correctness and security of the event specification in the concrete model. The formalization and verification consist of 137 definitions and 201 lemmas (more than 11,000 lines of Isabelle/HOL code). The results show that the model satisfies confidentiality and integrity, and can effectively defend against malicious attacks on partitions. Reference Related Cited by

Formal Verification of Virtualization-Based Trusted Execution Environments

Runtime Verification for Trustworthy Computing

CVTEE: A Compatible Verified TEE Architecture With Enhanced Security

Dtee: A Declarative Approach to Secure IoT Applications Using TrustZone

Towards Trust Proof for Secure Confidential Virtual Machines

Practical and Scalable Security Verification of Secure Architectures

ProveriT: A Parameterized, Composable, and Verified Model of TEE Protection Profile

On Securing Cloud-Hosted Cyber-Physical Systems Using Trusted Execution Environments

Scanclave: Verifying Application Runtime Integrity in Untrusted Environments

Remote Credential Management with Mutual Attestation for Trusted Execution Environments

HasTEE: Programming Trusted Execution Environments with Haskell

Refinement-based Modeling and Formal Verification for Multiple Secure Partitions of TrustZone.

A Trustenclave-Based Architecture for Ensuring Run-Time Security in Embedded Terminals

Tailoring and Verification of the Trust Boundaries in a Heterogeneous TEE Landscape

Research Directions for Verifiable Crypto-Physically Secure TEEs

Secure System Virtualization: End-to-End Verification of Memory Isolation

End-to-End Security for Distributed Event-Driven Enclave Applications on Heterogeneous TEEs

A Last-Level Defense for Application Integrity and Confidentiality

Trusted Computing Base Using Virtualization Platform

TEEI - A Mobile Security Infrastructure for TEE Integration

Verifying Rust Implementation of Page Tables in a Software Enclave Hypervisor