Trusted Execution Environment Virtualization With Microkernel VMM
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face challenges in providing a scalable, flexible, and secure execution environment for safety- and security-critical applications, as general-purpose operating systems like Linux have a substantial attack surface due to their complexity, and solutions like Arm TrustZone and microkernels fall short in virtualizing multiple operating systems.
Innovation Solution
A system architecture that incorporates a microkernel-based virtual machine monitor (VMM) to control Trusted Execution Environments (TEEs) and Rich Execution Environments (REEs) within virtual machines, enabling dynamic reconfiguration, fine-grain access control, and compatibility with Arm TrustZone, using a seL4 kernel for secure isolation and communication between TEEs and REEs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a monolithic core is employed to provide secure execution environment, then security isolation is achieved, but system complexity and size increase substantially
Solution Approach 1:
The system is segmented into distinct execution environments (secure world and non-secure world) with separate kernels. The secure world contains a minimal trusted kernel for security-critical functions, while the non-secure world runs a full-featured OS. This segmentation allows security isolation without requiring a single complex monolithic core, as each world can be optimized independently for its specific purposes.
Solution Approach 2:
A virtual machine monitor (VMM) is introduced as an intermediary layer between the hardware and the execution environments. The VMM manages the secure world, non-secure world, and their interactions, providing a controlled interface that enables security isolation while maintaining system manageability. This intermediary prevents direct access between worlds, reducing the complexity of implementing security in a monolithic system.
2Reliability
If Arm TrustZone is used to partition system into secure and non-secure worlds, then security-critical functionality is protected, but scalability and dynamic allocation are limited
Solution Approach 1:
The system implements dynamic allocation and management of execution environments through the VMM. Multiple secure and non-secure worlds can be created, modified, and destroyed as needed. The VMM dynamically manages memory, resources, and access controls between worlds, allowing the system to adapt to changing security requirements and workload demands without being constrained by static partitions.
Solution Approach 2:
The VMM provides universal management capabilities that work across multiple secure and non-secure worlds. It implements a standardized interface for resource allocation, access control, and world management that can be applied consistently across different security scenarios. This multi-functional approach enables the system to handle diverse workloads and security requirements within a unified framework, enhancing scalability.
3Adaptability or versatility
If multiple operating systems are virtualized, then system versatility increases, but attack surface and security risks expand
Solution Approach 1:
Each virtualized operating system is placed in its own execution environment (secure or non-secure world) with strict access controls. The VMM segments the system into isolated worlds, preventing attacks from propagating across OS boundaries. Security-critical functions are further segmented into the secure world, while non-critical functions remain in the non-secure world, limiting the attack surface in each segment.
Solution Approach 2:
The VMM acts as an intermediary that mediates all interactions between virtualized operating systems and the hardware. It enforces access controls and validates requests between worlds, preventing direct access that could exploit vulnerabilities. This intermediary layer filters and controls communications, reducing the effective attack surface by blocking unauthorized access paths between OS instances.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The present disclosure relates to a system for providing a secure environment, the system comprising at least one processor. The at least one processor is configured to provide a system kernel, provide at least one virtual machine, VM, wherein the system kernel is configured to control at least one virtual machine monitor, VMM, wherein the VMM is configured to control at least one Trusted Execution Environment, TEE, in the at least one VM and a Rich Execution Environment, REE, in the at least one VM and to provide communication between the at least one TEE and the at least one VM and between the REE and the at least one VM.