Trusense: Information Leakage from Trustzone
TruSense: Information Leakage from TrustZone Ning Zhang∗, Kun Suny, Deborah Shandsz Wenjing Lou∗z, Y. Thomas Hou∗ ∗Virginia Polytechnic Institute and State University, VA yGeorge Mason University, Fairfax, VA zNational Science Foundation, Arlington, VA Abstract—With the emergence of Internet of Things, mobile Unlike software exploitations that target vulnerabilities in devices are generating more network traffic than ever. TrustZone the system, side-channel attacks target information leakage of is a hardware-enabled trusted execution environment for ARM a physical implementation via its interactions with the execu- processors. While TrustZone is effective in providing the much- needed memory isolation, we observe that it is possible to derive tion environment. Side-channel information can be obtained secret information from secure world using the cache contention, from different types of physical features, such as power [10], due to its high-performance cache sharing design. electromagnetic wave [11], acoustic [12] and time [13], [14], In this work, we propose TruSense to study the timing-based [15]. Among these side channels, the cache-based timing cache side-channel information leakage of TrustZone. TruSense attack is one of the most important areas of research [14], can be launched from not only the normal world operating system but also a non-privileged user application. Without access [15], [16], [8], [17], [18]. to virtual-to-physical address mapping in user applications, we Processor cache is one of the basic components in mod- devise a novel method that uses the expected channel statistics ern memory architecture to bridge the gap between the fast to allocate memory for cache probing.
[Show full text]