CaSE: Cache-Assisted Secure Execution on ARM Processors N1 N1NG - - PowerPoint PPT Presentation

▶

May 02, 2023 38 likes •251 views

CaSE: Cache-Assisted Secure Execution on ARM Processors N1 N1NG NG ZHA ZHANG , KUN SUN, WENJING LOU, TOM HOU Talk Outline Motivation and Background Why this work ? Threat Model What are we defending against ? CaSE:

SLIDE 1

CaSE: Cache-Assisted Secure Execution on ARM Processors

N1 N1NG NG ZHA ZHANG, KUN SUN, WENJING LOU, TOM HOU

SLIDE 2

Talk Outline

üMotivation and Background – Why this work ? üThreat Model – What are we defending against ? üCaSE: Cache-Assisted Secure Execution – How does it work? üCaSE highlight – Challenges ? üEvaluation – How did we do ? üConclusion and future Work

SLIDE 3

Threat to Mobile devices

SLIDE 4

ARM TrustZone – Trusted Execution Environment (TEE)

System Wide Protection

üDivides system resources into two worlds üNormal World runs the content rich OS üSecure World runs security critical services üThe protection of resources includes

processor, memory and IO devices

Normal World Secure World

SLIDE 5

Many Products use ARM TrustZone

SLIDE 6

Smart Devices Going Mo

Mobile

SLIDE 7

Hardware Attacks - Cold Boot Attack

SLIDE 8

Previous Works on Coldboot Defense

TRESOR Sec 2011 – Register-based RAM-less AES encryption Copker NDSS 2014 – Cache-based RAM-less RSA encryption PixelVault CCS 2014 – GPU based RAM-less encryption Sentry ASPLOS 2015 – Cache-based RAM-less encryption Mimosa S&P 2015 – Transactional-based RAM-less encryption

SLIDE 9

Multi-vector Adversary

SLIDE 10

Introducing CaSE - Goals

üDefense against Multi-Vector adversary

üPhysical memory disclosure attack – Cold boot üCompromised rich OS

üProvide confidentiality and integrity to both the code and data of the binaries in TEE

üConfidentiality – Protects IP, secret code, sensitive data üIntegrity – Program behavior

SLIDE 11

System On Chip (SoC)

Threat Model

DRAM

Secure Cache NonSecure Normal World Memory Secure Memory Secure OS NonSecure Rich OS NonSecure Cache Processor Cache

SLIDE 12

Case-Assisted Execution in Secure World

System On Chip (SoC) DRAM

NonSecure Normal World Memory Secure Memory Secure OS NonSecure Rich OS Processor Cache

Secure storage Packer

0101010110101101 1101 1001 1101 0101 0101010110101101

Context

SLIDE 13

Case-Assisted Execution in Normal World

System On Chip (SoC) DRAM

Secure Memory NonSecure Normal World Memory NonSecure OS Secure Rich OS Processor Cache

Secure storage Packer

0101010110101101 1101 1001 1101 0101

Context

0101010110101101 1101 0101010110101101011010100 0101 1101 0101010110101101011010100 0101

CaSE Manager

SLIDE 14

Controlling the Cache

üCache Locking is available through L2 cache lockdown CP15 coprocessor üThe granularity of locking is per cache way üOn Cortex-A8, which has 8 way total 256KB L2 unified cache

SLIDE 15

SoC-Bound Execution – Cache Locking

SLIDE 16

Self Modifying Program

System On Chip (SoC)

L1 Instruction Cache L1 Data Cache L2 Unified Cache

SLIDE 17

Self Modifying Program

System On Chip (SoC)

L1 Instruction Cache L1 Data Cache L2 Unified Cache

SLIDE 18

Feasibility of using Cache as Memory

SLIDE 19

Performance Impact to the Application

SLIDE 20

Performance Impact to the System

SLIDE 21

Conclusion

üA secure cache-assisted SoC-bound execution framework

üProvide confidentiality and integrity to sensitive code and data of applications üProtect against both software attacks and cold boot attack.

üIn the future, we would like to further study efficient method to provide OS support to the TEE.