Operating System Support for Run-Time Security with a Trusted Execution Environment - Usage Control and Trusted Storage for Linux-based Systems - by Javier Gonz´alez Ph.D Thesis IT University of Copenhagen Advisor: Philippe Bonnet Submitted: January 31, 2015 Last Revision: May 30, 2015 ITU DS-nummer: D-2015-107 ISSN: 1602-3536 ISBN: 978-87-7949-302-5 1 Contents Preface8 1 Introduction 10 1.1 Context....................................... 10 1.2 Problem....................................... 12 1.3 Approach...................................... 14 1.4 Contribution.................................... 15 1.5 Thesis Structure.................................. 16 I State of the Art 18 2 Trusted Execution Environments 20 2.1 Smart Cards.................................... 21 2.1.1 Secure Element............................... 23 2.2 Trusted Platform Module (TPM)......................... 23 2.3 Intel Security Extensions.............................. 26 2.3.1 Intel TXT.................................. 26 2.3.2 Intel SGX.................................. 27 2.4 ARM TrustZone.................................. 29 2.5 Other Techniques.................................. 32 2.5.1 Hardware Replication........................... 32 2.5.2 Hardware Virtualization.......................... 33 2.5.3 Only Software............................... 33 2.6 Discussion...................................... 33 3 Run-Time Security 36 3.1 Access and Usage Control............................. 36 3.2 Data Protection................................... 39 3.3 Reference Monitors................................. 42 3.3.1 Policy Enforcement............................. 42 3.3.2 Intrusion Detection............................. 42 3.3.3 Code Integrity Protection......................... 43 3.4 Conclusion..................................... 45 4 Boot Protection 46 4.1 Boot Protection Mechanisms........................... 46 4.2 Discussion...................................... 48 2 5 Discussion 50 II Contribution 52 6 Split Enforcement 54 6.1 Background..................................... 55 6.2 Hypothesis..................................... 56 6.2.1 Application State.............................. 57 6.2.2 Application Monitoring.......................... 58 6.3 Design Space.................................... 59 6.3.1 Secure Drivers............................... 60 6.3.2 Split Enforcement............................. 62 6.3.3 Approach.................................. 64 6.4 Target Devices................................... 65 6.5 Conclusion..................................... 67 7 TrustZone TEE Linux Support 69 7.1 TrustZone TEE Framework............................ 69 7.1.1 Open Virtualization Analysis....................... 71 7.1.2 Summary.................................. 75 7.2 Generic TrustZone Driver for Linux Kernel................... 76 7.2.1 Design Space................................ 76 7.2.2 Design and Implementation........................ 79 7.2.3 Open Virtualization Driver........................ 84 7.3 Driver Status.................................... 86 7.4 Conclusion..................................... 87 8 Trusted Cell 89 8.1 Architecture..................................... 90 8.1.1 REE Trusted Cell............................. 92 8.1.2 TEE Trusted Cell............................. 96 8.2 Trusted Services.................................. 102 8.2.1 Trusted Storage............................... 102 8.2.2 Reference Monitor............................. 107 8.3 Prototype...................................... 112 8.4 Conclusion..................................... 116 9 Certainty Boot 118 9.1 Context....................................... 118 9.1.1 Example Scenario............................. 120 9.2 Architecture..................................... 120 9.2.1 First Phase Verification.......................... 122 9.2.2 Second Phase Verification......................... 123 9.2.3 Exchange OS and Boot Loader...................... 124 9.3 Conclusion..................................... 125 3 III Evaluation 127 10 Analytical Evaluation 129 10.1 Security Analysis.................................. 129 10.1.1 Types of Attacks.............................. 129 10.1.2 Hardware Protection Baseline....................... 131 10.1.3 Attacks against TrustZone Driver..................... 132 10.1.4 Attacks against Trusted Cell....................... 134 10.1.5 Attacks against Certainty Boot...................... 142 10.2 Design Requirements Compliance......................... 143 10.2.1 State Machine and Reference Monitor Abstraction........... 143 10.2.2 Low TCB.................................. 144 10.2.3 Protection vs. Innovative Applications.................. 144 10.2.4 Untrusted Commodity OS......................... 144 10.2.5 TrustZone Driver Genericity........................ 145 10.3 Conclusion..................................... 145 11 Experimental Evaluation 146 11.1 Experimental Setup................................ 147 11.2 Performance Overhead............................... 149 11.2.1 Application Benchmarks.......................... 150 11.2.2 Microbenchmarks.............................. 153 11.2.3 Applicability of Split-Enforcement.................... 158 11.3 Discussion...................................... 160 12 Conclusion 162 12.1 Conclusion..................................... 162 12.2 Future Work.................................... 163 12.2.1 Linux TEE support and Trusted Modules................ 164 12.2.2 Current Trusted Services......................... 165 12.2.3 New Trusted Services........................... 166 Glossary 168 4 Abstract Software services have become an integral part of our daily life. Cyber-attacks have thus become a problem of increasing importance not only for the IT industry, but for society at large. A way to contain cyber-attacks is to guarantee the integrity of IT systems at run-time. Put differently, it is safe to assume that any complex software is compromised. The problem is then to monitor and contain it when it executes in order to protect sensitive data and other sensitive assets. To really have an impact, any solution to this problem should be integrated in commodity operating systems. In this thesis we introduce run-time security primitives that enable a number of trusted services in the context of Linux. These primitives mediate any action involving sensitive data or sensitive assets in order to guarantee their integrity and confidentiality. We introduce a general mechanism to protect sensitive assets at run-time that we denote split-enforcement, and provide an implementation for ARM-powered devices using ARM TrustZone security extensions. We design, build, and evaluate a prototype Trusted Cell that provides trusted services. We also present the first generic TrustZone driver in the Linux operating system. We are in the process of making this driver part of the mainline Linux kernel. Resum´e Softwareservices er blevet en integreret del af vores hverdag. Cyber-angreb er dermed blevet et problem af stigende betydning, ikke blot for it-industrien, men for samfundet som helhed. En´ m˚adeat forhindre cyber-angreb p˚a,er ved at sikre it-systemers integritet ved run-time. Med andre ord kan man med sikkerhed g˚aud fra, at enhver kompleks software er kompro- mitteret. Problemstillingen bliver derfor, hvordan man monitorerer og sikrer, at systemet eksekverer i sikre omgivelser, s˚aman kan beskytte sensitiv data og andre sensitive aktiver. En løsning p˚adenne problemstilling skal, for at gøre en reel forskel, være integreret i hvad man kan kalde commodity operating systems. I denne afhandling introducerer vi grundprocedurer til run-time security, der muliggør ekse- kveringen af en række betroede services i en Linux kontekst. Disse grundprocedurer formidler enhver handling, der involverer sensitive data eller sensitive aktiver, for at kunne garantere deres integritet og fortrolighed. Vi introducerer en generel mekanik til at beskytte sensitive aktiver ved run-time, som vi kalder split-enforcement, og denne implementerer vi i ARM- baserede enheder som bruger ARM Trustzone sikkerhedsudvidelser. Vi designer, bygger og evaluerer en Trusted Cell prototype, som formidler betroede services. Vi præsenterer ogs˚a den første generiske TrustZone driver i Linux operativ systemet. Vi er i gang med at f˚adenne driver optaget i mainline Linux Kernel. Preface The journey that has led to this writing has been long; at times exciting and at many others difficult. However, as in any other long term commitment, it is the process of walking the new path that is worth the effort. There are many people to thank for their time, knowledge, and above all support during these years. I can only hope that I have expressed my gratitude enough to them, before they can identify themselves here. Thanks to Philippe Bonnet, my advisor, for taking care of me during these years: Thanks for not babysitting. Thanks for letting me hit the wall hard enough to know the feeling without getting hurt. Thanks for sharing your knowledge. But above all, thanks for helping me find something that I love doing. Thanks to INTERACT for financing my Ph.D. Also, thanks to Inger Vibeke Dorph for handling it on the IT University side: Paperwork would have killed me long ago had it not been for you. Thanks to my Ph.D and office colleagues, who have helped in all possible ways. Matias Bjørlig, Jonathan F¨urst,Aslak Johansen, Joel Granados, Niv Dayan, Jesper Wendel De- vantier, Mohammed Aljarrah, and Michal Mouˇcka: Thanks for the coffees, the discussions, the comments, and