TEE Execution Switching With ATF Return Address Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The ARM trusted firmware (ATF) in the TrustZone architecture has weak security defenses, making it a vulnerable target for hackers to attack and gain access to the TEE, compromising user assets.
Innovation Solution
Implement a method where the ATF writes a virtual address into a return address register of the TEE, checks if it's within a preset valid range, and only switches to the TEE if it is, ensuring the address is valid, and further secures the process by disabling the MMU and setting page table entries to read-only to prevent unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the ATF is used to implement switching between REE and TEE, then the switching function is achieved, but the security defense capability is weak and vulnerable to hacker attacks
Solution Approach 1:
The patent applies preliminary action by pre-setting a valid address range for the TEE entrance address before the switching process occurs. The ATF checks whether the address in the return address register falls within this predetermined valid range, preventing hackers from using arbitrary addresses to maliciously access the TEE. This proactive measure strengthens security without compromising the switching function.
2Adaptability or versatility
If the ATF allows arbitrary entrance addresses to switch to TEE, then switching flexibility is improved, but security vulnerability increases
Solution Approach 1:
The patent applies local quality by restricting the valid entrance addresses to specific locations within the TEE memory space, defined by a predetermined address range. Instead of allowing arbitrary addresses throughout the entire address space, only addresses falling within the designated range are accepted for switching. This localized restriction maintains necessary switching flexibility while eliminating security vulnerabilities associated with arbitrary address access.
3Reliability
If the ATF checks address validity before switching to TEE, then security is improved, but the switching process complexity increases
Solution Approach 1:
The patent applies parameter changes by transforming the security verification process into a simple range comparison operation. Instead of implementing complex security checks, the system compares the address parameter in the return address register against the predetermined valid address range parameters. This parameter-based approach enhances security while minimizing additional process complexity, as range comparison is a computationally simple operation.
Data Source
AI summary
The present disclosure discloses a method for switching an execution environment and a related device thereof, to effectively prevent a hacker from maliciously accessing a TEE through ATF. The method in the present disclosure includes: After writing a first virtual address into a return address register of the TEE, the ATF determines whether the first virtual address is within a valid address range, and switches to the TEE based on the first virtual address only when determining that the first virtual address is within the valid address range.