TEE Entry Address Validation in ATF Environment Switching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The ARM trusted firmware (ATF) in the TrustZone environment has weak security defense capabilities, making it a vulnerable target for hackers to attack and gain access to the TEE, thereby compromising critical assets.
Innovation Solution
Implement a method where the ATF checks if the entrance address for switching to the TEE is within a preset valid address range before proceeding, and disables the memory management unit (MMU) to prevent unauthorized modifications to page table entries, ensuring only valid addresses are used for switching.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If the ATF allows flexible address writing to the return address register for switching to TEE, then the switching flexibility is improved, but the security vulnerability increases allowing hacker attacks
Solution Approach 1:
The patent applies preliminary anti-action by pre-establishing a valid address range for TEE entrance addresses before the switching process. The ATF compares the written address against this predetermined valid range, preventing hacker-modified invalid addresses from being accepted. This proactive validation mechanism blocks potential attacks before they can compromise the TEE, resolving the contradiction between switching flexibility and security vulnerability.
2Reliability
If the ATF performs address validation checks before switching to TEE, then the security defense capability is improved, but the switching process complexity increases
Solution Approach 1:
The patent applies preliminary action by pre-defining and storing the valid address range in the ATF before any switching operations occur. During the switching process, the ATF simply compares the candidate address against this pre-established range rather than performing complex validation routines. This approach enhances security defense capability while minimizing the increase in switching process complexity through efficient address comparison.
3Object-affected harmful factors
If the ATF restricts entrance addresses to a preset valid range, then the security against hacker attacks is improved, but the adaptability of the switching mechanism deteriorates
Solution Approach 1:
The patent applies parameter changes by defining specific parameters for the valid address range (such as start address, end address, and granularity) that can be configured according to different security requirements and TEE implementations. This allows the switching mechanism to maintain adaptability through parameter adjustment while enforcing security constraints through the fixed valid range validation logic, resolving the contradiction between hacker attack resistance and switching mechanism adaptability.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
This application discloses a method for switching an execution environment and a related device thereof, to effectively prevent a hacker from maliciously accessing a TEE through ATF. The method in this application includes: After writing a first virtual address into a return address register of the TEE, the ATF determines whether the first virtual address is within a valid address range, and switches to the TEE based on the first virtual address only when determining that the first virtual address is within the valid address range.