A Critical Review on Huawei's Trusted Execution Environment
Unearthing the TrustedCore: A Critical Review on Huawei’s Trusted Execution Environment Marcel Busch, Johannes Westphal, and Tilo Müller Friedrich-Alexander-University Erlangen-Nürnberg, Germany {marcel.busch, johannes.westphal, tilo.mueller}@fau.de Abstract to error. In theory, any bug in the feature-rich domain, includ- ing severe kernel-level bugs, cannot affect the integrity and Trusted Execution Environments (TEEs) are an essential confidentiality of a TEE, as TEEs are isolated from the rest building block in the security architecture of modern mo- of the system by means of hardware primitives. As ARM is bile devices. In this paper, we review a TEE implementa- the predominant architecture used for chipsets in mobile de- tion, called TrustedCore (TC), that has been used on Huawei vices, the ARM TrustZone (TZ)[6] provides the trust anchor phones for several years. We unveil multiple severe design for virtually all TEEs in mobile devices, including Huawei and implementation flaws in the software stack of this TEE, models. which affect devices including the popular Huawei P9 Lite, Although TEEs have been extensively used by millions released in 2016, and partially the more recent Huawei P20 of products for years, security analyses targeting these sys- Lite, released in 2018. First, we reverse-engineer TC’s com- tems are rarely discussed in public since all major vendors, ponents, their interconnections, and their integration with the including Huawei, Qualcomm, and Samsung, maintain strict Android system, focusing on security aspects. Second, we ex- secrecy about their individual proprietary implementations. amine the Trusted Application (TA) loader of the TC platform However, the correct implementation of a TEE is complex and reveal multiple design flaws.
[Show full text]