Syracuse University SURFACE Dissertations - ALL SURFACE December 2020 SECURING USER INTERACTION CHANNELS ON MOBILE PLATFORM USING ARM TRUSTZONE Amit Ahlawat Syracuse University Follow this and additional works at: https://surface.syr.edu/etd Part of the Engineering Commons Recommended Citation Ahlawat, Amit, "SECURING USER INTERACTION CHANNELS ON MOBILE PLATFORM USING ARM TRUSTZONE" (2020). Dissertations - ALL. 1183. https://surface.syr.edu/etd/1183 This Dissertation is brought to you for free and open access by the SURFACE at SURFACE. It has been accepted for inclusion in Dissertations - ALL by an authorized administrator of SURFACE. For more information, please contact [email protected]. ABSTRACT Smartphones have become an essential part of our lives, and are used daily for important tasks like banking, shopping, and making phone calls. Smartphones provide several interaction channels which can be affected by a compromised mobile OS. This dissertation focuses on the user interaction channels of UI input and audio I/O. The security of the software running on smartphones has become more critical because of widespread smartphone usage. A technology called TEE (Trusted Execution Environment) has been introduced to help protect users in the event of OS compromise, with the most commonly deployed TEE on mobile devices being ARM TrustZone. This dissertation utilizes ARM TrustZone to provide secure design for user interaction channels of UI input (called Truz-UI) and Audio I/O for VoIP calls (called Truz-Call). The primary goal is to ensure that the design is transparent to mobile applications. During research based on TEE, one of the important challenges that is encountered is the ability to prototype a secure design. In TEE research one often needs to interface hardware peripherals with the TEE OS, which can be challenging for non-hardware experts, depending on the available support from the TEE OS vendor. This dissertation discusses a simulation based approach (called Truz-Sim) that reduces setup time and hardware experience required to build a hardware environment for TEE prototyping. SECURING USER INTERACTION CHANNELS ON MOBILE PLATFORM USING ARM TRUSTZONE by Amit Ahlawat B.Tech., Maharshi Dayanand University, 2010 M.S., Syracuse University, 2012 Dissertation Submitted in partial fulfillment of the requirements for the degree of Doctor of Philosophy in Electrical and Computer Engineering. Syracuse University December 2020 Copyright c Amit Ahlawat 2020 All Rights Reserved ACKNOWLEDGMENTS There are several people who I would like to thank for the successful completion of my PhD thesis. First and foremost, I would like to thank my advisor Dr. Wenliang Du for giving me the opportunity to work in his lab as a Research Assistant during my Masters degree and giving me a chance to work on a PhD degree under his guidance. I thank him for the training he provided related to formulating research problems, judging the merits of a formulated problem and applying constructive & critical thinking while doing research. I also thank him for the feedback he provided in all the project meetings we had over the years. I would like to thank Dr. Jae Oh, Dr. Richard Tang, Dr. Fanxin Kong, Dr. Bryan Kim, and Dr. Carlos E. Caicedo Bastidas, for agreeing to be on my thesis committee. I am extremely grateful for their time in reading my dissertation and commenting on my views. I would like to thank the department chair Dr. Jae Oh for his continued support during my PhD study. During my time in Dr. Wenliang Du’s lab, I have been very fortunate to have had the opportunity to work with several colleagues, including Dr. Kailiang Ying, Dr. Xiao Zhang, Dr. Yousra Aafer, Dr. Paul Ratazzi, Xing Jin, Ammar Salman, Francis Akowuah, Yifei Wang, Haichao Zhang, Hanyi Li, Yuexin Jiang, Carter Yagemann, Zhenyu Wang, iv Amey Ashok Patil, Gautam Peri, Priyank Thavai and Bilal Alsharifi. I would like to thank Dr. Andrew Henderson for all the guidance he provided on various projects in my thesis. I would like to thank my family for their support of my decision to pursue a PhD degree, and their continued support during my PhD study. Finally I would like to thank the various staff members of the EECS department and other departments responsible for ensuring the success of PhD students at Syracuse University. v TABLE OF CONTENTS Page ABSTRACT :::::::::::::::::::::::::::::::::::: i LIST OF TABLES ::::::::::::::::::::::::::::::::: x LIST OF FIGURES :::::::::::::::::::::::::::::::: xi 1 Introduction :::::::::::::::::::::::::::::::::: 1 1.1 Risks faced by Smartphone Channels :::::::::::::::::: 1 1.2 ARM Architecture and Trusted Execution Environment ::::::::: 3 1.3 Component Binding Across OS ::::::::::::::::::::: 4 1.4 Thesis Statement and Contributions ::::::::::::::::::: 5 1.5 Organization of Dissertation ::::::::::::::::::::::: 9 2 Background :::::::::::::::::::::::::::::::::: 10 2.1 ARM TrustZone ::::::::::::::::::::::::::::: 10 2.2 TrustZone Development Boards ::::::::::::::::::::: 12 2.3 Android Text Input :::::::::::::::::::::::::::: 13 2.3.1 Text Input UI Element :::::::::::::::::::::: 14 2.3.2 Text Input via Binding :::::::::::::::::::::: 16 2.4 Android Action Confirmation :::::::::::::::::::::: 18 2.4.1 Using AlertDialog for Confirmation ::::::::::::::: 18 2.4.2 Using Activity for Confirmation ::::::::::::::::: 19 2.4.3 Trigger Confirmation Code via Binding ::::::::::::: 22 2.5 Voice over IP (VoIP) Call :::::::::::::::::::::::: 24 3 Truz-UI: Secure Input Interaction ::::::::::::::::::::::: 26 3.1 Problem Overview :::::::::::::::::::::::::::: 26 3.2 Broken Binding between Code and UI :::::::::::::::::: 28 3.3 Main Idea: Cross-OS Binding :::::::::::::::::::::: 29 vi Page 3.4 Related Work :::::::::::::::::::::::::::::: 30 3.5 Securing Text Input ::::::::::::::::::::::::::: 31 3.6 Securing Action Confirmation :::::::::::::::::::::: 37 3.6.1 Action Confirmation using AlertDialog ::::::::::::: 37 3.6.2 Action Confirmation using Activity ::::::::::::::: 41 3.6.3 Attestation Using Android Keystore ::::::::::::::: 43 3.7 User Involved Access Control :::::::::::::::::::::: 44 3.8 Sending TEE Protected Data to Server :::::::::::::::::: 46 3.9 Hardware Implementation :::::::::::::::::::::::: 47 3.10 Security Analysis :::::::::::::::::::::::::::: 51 3.11 Evaluation :::::::::::::::::::::::::::::::: 53 3.11.1 Effectiveness ::::::::::::::::::::::::::: 53 3.11.2 Ease of Adoption :::::::::::::::::::::::: 55 3.11.3 Performance ::::::::::::::::::::::::::: 58 3.12 Publication :::::::::::::::::::::::::::::::: 58 4 Truz-Call: Secure Voice Interaction for VoIP Calling ::::::::::::: 59 4.1 Problem Overview :::::::::::::::::::::::::::: 59 4.2 Factors Influencing TEE Integration Design ::::::::::::::: 63 4.3 Related Work :::::::::::::::::::::::::::::: 64 4.4 Secure VoIP Calling Problem Scope ::::::::::::::::::: 65 4.4.1 Protocol Support ::::::::::::::::::::::::: 66 4.4.2 VoIP App Computation Stages :::::::::::::::::: 66 4.5 Main Idea :::::::::::::::::::::::::::::::: 68 4.6 TEE Invocation and Data Encoding ::::::::::::::::::: 70 4.6.1 Audio Data Encoding :::::::::::::::::::::: 71 4.6.2 Independent Audio Pipeline Stages ::::::::::::::: 72 4.6.3 TEE Bridges and TAs :::::::::::::::::::::: 74 4.7 VoIP Call Initiation ::::::::::::::::::::::::::: 75 4.8 TEE Invocation by Audio Framework :::::::::::::::::: 78 vii Page 4.8.1 TEE Invocation by AudioRecord :::::::::::::::: 79 4.8.2 TEE Invocation by AudioTrack ::::::::::::::::: 80 4.9 TEE Invocation by SRTP :::::::::::::::::::::::: 81 4.10 Reference Data Management :::::::::::::::::::::: 82 4.10.1 Data Management for Record :::::::::::::::::: 83 4.10.2 Data Management for Playback ::::::::::::::::: 85 4.11 Security Analysis :::::::::::::::::::::::::::: 87 4.12 Simulation Test Environment :::::::::::::::::::::: 89 4.13 Evaluation :::::::::::::::::::::::::::::::: 92 4.13.1 Performance ::::::::::::::::::::::::::: 93 4.13.2 VoIP Quality ::::::::::::::::::::::::::: 94 4.14 Publication :::::::::::::::::::::::::::::::: 96 5 Truz-Sim: Hardware Simulation to Assist TrustZone Research :::::::: 97 5.1 Problem Overview :::::::::::::::::::::::::::: 97 5.2 Related Work :::::::::::::::::::::::::::::: 100 5.3 Main Idea :::::::::::::::::::::::::::::::: 101 5.4 Design :::::::::::::::::::::::::::::::::: 102 5.4.1 High Level Design :::::::::::::::::::::::: 104 5.4.2 Camera Access Design ::::::::::::::::::::: 106 5.4.3 GPS Access Design ::::::::::::::::::::::: 107 5.5 Implementation ::::::::::::::::::::::::::::: 109 5.5.1 Trusted App APIs for Hardware Access ::::::::::::: 109 5.5.2 Simulation Driver :::::::::::::::::::::::: 111 5.5.3 Normal World App Testing ::::::::::::::::::: 112 5.5.4 Camera Access Implementation ::::::::::::::::: 113 5.5.5 GPS Access Implementation ::::::::::::::::::: 119 5.5.6 UI Touch Input ::::::::::::::::::::::::: 123 5.6 Evaluation :::::::::::::::::::::::::::::::: 127 5.6.1 GPS Testing ::::::::::::::::::::::::::: 127 viii Page 5.6.2 Camera Testing ::::::::::::::::::::::::: 131 5.6.3 UI Touch Input Testing ::::::::::::::::::::: 134 5.7 Discussion :::::::::::::::::::::::::::::::: 135 6 Conclusion And Future Work ::::::::::::::::::::::::: 137 6.1 Secure Input Interaction for Hybrid Applications :::::::::::: 138 6.2 VoIP Computation Stages in TEE :::::::::::::::::::: 139 6.3 Expanding Hardware Simulation Support :::::::::::::::: 139 LIST OF REFERENCES ::::::::::::::::::::::::::::: 141 VITA :::::::::::::::::::::::::::::::::::::::: 155 ix LIST OF TABLES Table Page 3.1 Evaluation Results for Open-Source Apps :::::::::::::::::: 56 3.2 Evaluation Result for Closed-Source