ARM TrustZone Security Guide

G5 Cyber Security

2 weeks ago

TL;DR

This guide explains how to understand and work with ARM TrustZone, separating your device into a secure world for sensitive tasks and a normal world for everyday operations. It covers basic concepts, checking if your processor supports it, setting up a simple environment (using QEMU), and some key security considerations.

1. What is ARM TrustZone?

ARM TrustZone is a system-wide hardware security extension found in many ARM processors. It creates two virtual execution environments:

Normal World: This is where your standard operating system (like Android or Linux) runs – the world you interact with daily.
Secure World: A highly protected environment for sensitive operations like key storage, DRM, and secure boot. It’s isolated from the Normal World to prevent tampering.

Think of it as a separate computer *inside* your computer, designed specifically for security.

2. Does My Processor Support TrustZone?

Most modern ARM processors do, but you need to confirm. Here’s how:

Check the Datasheet: The most reliable method is to consult your processor’s datasheet from the manufacturer (e.g., Qualcomm, MediaTek, Samsung). Look for mentions of “TrustZone”, “Secure Monitor Call (SMC)”, or “ARM Security Extension”.
Linux Command (if applicable): If you have a Linux system running on an ARM processor, try this command:
```
cat /proc/cpuinfo | grep 'Features'
```
Look for the flag secure in the output. This isn’t foolproof but is a quick check.
dmesg Output: Examine the kernel boot messages using:
```
dmesg | grep TrustZone
```
Any relevant messages will indicate TrustZone support.

3. Setting Up a Basic Environment (QEMU)

We’ll use QEMU to simulate an ARM system with TrustZone. This is ideal for experimentation without needing physical hardware.

Install QEMU: On Debian/Ubuntu:

sudo apt update && sudo apt install qemu-system-arm

On Fedora/CentOS/RHEL:

sudo dnf install qemu-system-arm

Download a TrustZone Demo Image: Several demo images are available online. A good starting point is the ARM Trusted Firmware (ATF) examples. Download one suitable for your architecture (e.g., Cortex-A53).
Run QEMU: The exact command depends on the image you downloaded, but it will generally look like this:
```
qemu-system-arm -M versatilepb -kernel  -dtb  -cpu cortex-a53 -m 256
```
Replace placeholders with the correct paths to your kernel and device tree files.
Monitor Interaction: QEMU will start a monitor session. You can interact with it using commands like info cpu to view CPU registers and status, including TrustZone-related information.

4. Secure Monitor Calls (SMC)

The Normal World communicates with the Secure World via SMCs. These are special instructions that trigger a context switch to the Secure World.

SMC Handler: The Secure World contains an SMC handler – code that receives and processes SMC requests from the Normal World.
Normal World Code: To call the Secure World, you use the smc instruction (or equivalent assembly). This requires knowing the correct SMC number corresponding to the desired function in the Secure World.
```
// Example ARM Assembly (simplified)
```
```
mov r0, #1  ; SMC number for a specific service
```
```
smc 0      ; Execute the SMC call
```

5. Key Security Considerations

Secure Boot: Ensure your device uses Secure Boot to verify the integrity of both Normal World and Secure World software before execution.
Isolation: Properly isolate the Secure World from the Normal World. Prevent direct memory access between the two environments.
SMC Handler Security: The SMC handler is a critical component. Thoroughly audit its code for vulnerabilities, as it’s a potential attack surface.
Key Management: Implement robust key management practices within the Secure World. Protect keys from extraction or modification. Use hardware-backed security features where available.
Regular Updates: Keep both Normal World and Secure World software up to date with the latest security patches.

6. Further Resources

ARM Trusted Firmware (ATF): https://github.com/arm-trusted-firmware
OP-TEE: https://optee.org/ (Open Portable Trusted Execution Environment)