Mr-TEE
Practical Trusted Execution of Mixed-Criticality Code
Tom Van Eyck 
Hamdi Trimech
Sam Michiels
Danny Hughes
Majid Salehi
Hassaan Janjua
Abstract
Industry 4.0 is increasingly using commodity hardware and software in place of dedicated control systems to lower costs and increase flexibility. However, this means that critical control code must compete for resources with an increasingly complex software stack that exposes a new attack surface. The Mixed Criticality Trusted Execution Environment (Mr-TEE) tackles this problem at its root, by delivering availability for safety-critical control code, while running untrusted applications in a minimally modified Linux stack. This is achieved by providing a real-time scheduler and novel peripheral sharing system in the Secure World. Mr-TEE hence provides the best of both worlds for Industry 4.0 developers, ensuring the trusted execution of time-sensitive control applications, while minimizing design effort and restrictions for untrusted applications. Evaluation on an Arm TrustZone-enabled Cortex MCU demonstrates a worst-case overhead of 1.88% to support real-time scheduling in the TEE.
This is the documentation for Mr-TEE, presented in the paper “Mr-TEE: Practical Trusted Execution of Mixed-Criticality Code”. It explains the details of a TEE implementation that provides hardware isolation and real-time execution of safety-critical applications for Cyber-Physical systems, while transparantly sharing peripherals with little developer overhead.
Mr-TEE has also been presented at FOSDEM 2023: “Keeping safety-critical programs alive when Linux isn’t able to”.
With the support of VLAIO via the ICON-TACOS and ICON-TRUSTI projects.
This project has received funding from the European Union’s Horizon 2020 research and innovation programme under grant agreement No 101020416.
References
[1]
Fritz Alder, Jo Van Bulck, Frank Piessens, and Jan Tobias Mühlberg. 2021. Aion: Enabling open systems through strong availability guarantees for enclaves. In Proceedings of the 2021 ACM SIGSAC conference on computer and communications security (CCS ’21), Association for Computing Machinery, New York, NY, USA, 1357–1372. DOI:https://doi.org/10.1145/3460120.3484782
[2]
Mahmoud Ammar, Bruno Crispo, Bart Jacobs, Danny Hughes, and Wilfried Daniels. 2019. SV security MicroVisor: A formally-verified software-based security architecture for the internet of things. IEEE Transactions on Dependable and Secure Computing 16, 5 (2019), 885–901. DOI:https://doi.org/10.1109/tdsc.2019.2928541
[3]
Raad Bahmani, Ferdinand Brasser, Ghada Dessouky, Patrick Jauernig, Matthias Klimmek, Ahmad-Reza Sadeghi, and Emmanuel Stapf. 2021. CURE: A security architecture with CUstomizable and resilient enclaves. In 30th USENIX security symposium (USENIX security 21), USENIX Association, 1073–1090. Retrieved from https://www.usenix.org/conference/usenixsecurity21/presentation/bahmani
[4]
Jo Van Bulck, Marina Minkin, Ofir Weisse, Daniel Genkin, Baris Kasikci, Frank Piessens, Mark Silberstein, Thomas F. Wenisch, Yuval Yarom, and Raoul Strackx. 2018. Foreshadow: Extracting the keys to the intel SGX kingdom with transient Out-of-Order execution. In 27th USENIX security symposium (USENIX security 18), USENIX Association, Baltimore, MD, 9911008. Retrieved from https://www.usenix.org/conference/usenixsecurity18/presentation/bulck
[5]
Eric J Byres, Matthew Franz, and Darrin Miller. 2004. The use of attack trees in assessing vulnerabilities in SCADA systems. In Proceedings of the international infrastructure survivability workshop, Citeseer, 3–10.
[6]
Shu Cheng, Jim Woodcock, and Deepak D’Souza. 2015. Using formal reasoning on a model of tasks for FreeRTOS. Formal Aspects of Computing 27, 1 (January 2015), 167–192. DOI:https://doi.org/10.1007/s00165-014-0308-9
[7]
Victor Costan and Srinivas Devadas. 2016. Intel SGX explained. Retrieved from https://eprint.iacr.org/2016/086
[8]
Wilfried Daniels, Danny Hughes, Mahmoud Ammar, Bruno Crispo, Nelson Matthys, and Wouter Joosen. 2017. SV - the security microvisor: A virtualisation-based security middleware for the internet of things. In Proceedings of the 18th ACM/IFIP/USENIX middleware conference: Industrial track (Middleware ’17), Association for Computing Machinery, New York, NY, USA, 36–42. DOI:https://doi.org/10.1145/3154448.3154454
[9]
EEMBC. CPU benchmark - MCU benchmark - CoreMark. Retrieved September 28, 2023 from https://www.eembc.org/coremark/
[10]
GlobalPlatform. 2018. Introduction to trusted execution environments. Retrieved from https://globalplatform.org/resource-publication/introduction-to-trusted-execution-environments/
[11]
Michele Grisafi, Mahmoud Ammar, Marco Roveri, and Bruno Crispo. 2022. PISTIS: Trusted computing architecture for low-end embedded systems. In 31st USENIX security symposium (USENIX security 22), USENIX Association, Boston, MA, 3843–3860. Retrieved from https://www.usenix.org/conference/usenixsecurity22/presentation/grisafi
[12]
Zhichao Hua, Jinyu Gu, Yubin Xia, Haibo Chen, Binyu Zang, and Haibing Guan. 2017. vTZ: Virtualizing ARM TrustZone. In 26th USENIX security symposium (USENIX security 17), USENIX Association, Vancouver, BC, 541–556. Retrieved from https://www.usenix.org/conference/usenixsecurity17/technical-sessions/presentation/hua
[13]
Wei Huang, Vasily Rudchenko, He Shuang, Zhen Huang, and David Lie. 2018. Pearl-TEE: Supporting untrusted applications in TrustZone. In Proceedings of the 3rd workshop on system software for trusted execution (SysTEX ’18), Association for Computing Machinery, New York, NY, USA, 8–13. DOI:https://doi.org/gssrdm
[14]
Hassaan Janjua, Mahmoud Ammar, Bruno Crispo, and Danny Hughes. 2019. Towards a standards-compliant pure-software trusted execution environment for resource-constrained embedded devices. In Proceedings of the 4th workshop on system software for trusted execution (SysTEX ’19), Association for Computing Machinery, New York, NY, USA. DOI:https://doi.org/10.1145/3342559.3365338
[15]
Sangjun Kim, Yuchang Won, In-Hee Park, Yongsoon Eun, and Kyung-Joon Park. 2019. Cyber-physical vulnerability analysis of communication-based train control. IEEE Internet of Things Journal 6, 4 (2019), 6353–6362. DOI:https://doi.org/10.1109/jiot.2019.2919066
[16]
Chen-Kai Lin and Bow-Yaw Wang. 2022. Analyzing FreeRTOS scheduling behaviors with the spin model checker. (2022). DOI:https://doi.org/10.48550/arxiv.2205.07480
[17]
Linaro. 2022. Open Portable Trusted Execution Environment. Retrieved October 13, 2022 from https://www.op-tee.org/
[18]
Aravind Machiry, Eric Gustafson, Chad Spensky, Christopher Salls, Nick Stephens, Ruoyu Wang, Antonio Bianchi, Yung Ryn Choe, Christopher Kruegel, and Giovanni Vigna. 2017. BOOMERANG: Exploiting the semantic gap in trusted execution environments. In Proceedings of the network and distributed systems security symposium (NDSS). DOI:https://doi.org/10.14722/ndss.2017.23227
[19]
Elizabeth Montalbano. 2021. Florida water plant hack: Leaked credentials found in breach database. threatpost. Retrieved from https://threatpost.com/florida-water-plant-hack-credentials-breach/163919/
[20]
Shoei Nashimoto, Daisuke Suzuki, Rei Ueno, and Naofumi Homma. 2020. Bypassing isolated execution on RISC-V with fault injection. Cryptology ePrint Archive (2020). Retrieved from https://eprint.iacr.org/2020/1193
[21]
Job Noorman, Pieter Agten, Wilfried Daniels, Raoul Strackx, Anthony Van Herrewege, Christophe Huygens, Bart Preneel, Ingrid Verbauwhede, and Frank Piessens. 2013. Sancus: Low-cost trustworthy extensible networked devices with a zero-software trusted computing base. In 22nd USENIX security symposium (USENIX security 13), USENIX Association, Washington, D.C., 479–498. Retrieved from https://www.usenix.org/conference/usenixsecurity13/technical-sessions/presentation/noorman
[22]
Job Noorman, Jo Van Bulck, Jan Tobias Mühlberg, Frank Piessens, Pieter Maene, Bart Preneel, Ingrid Verbauwhede, Johannes Götzfried, Tilo Müller, and Felix Freiling. 2017. Sancus 2.0: A low-cost security architecture for IoT devices. ACM Transactions on Privacy and Security (TOPS) 20, 3 (2017), 1–33. DOI:https://doi.org/10.1145/3079763
[23]
Igor Pavlov. 2022. 7-Zip. Retrieved October 13, 2022 from https://www.7-zip.org/
[24]
Majid Salehi, Luca Degani, Marco Roveri, Danny Hughes, and Bruno Crispo. 2023. Discovery and identification of memory corruption vulnerabilities on bare-metal embedded devices. IEEE Transactions on Dependable and Secure Computing 20, 2 (2023), 1124–1138. DOI:https://doi.org/10.1109/TDSC.2022.3149371
[25]
Majid Salehi, Danny Hughes, and Bruno Crispo. 2020. SBS: Static binary sanitization of bare-metal embedded devices for fault observability. In 23rd international symposium on research in attacks, intrusions and defenses (RAID 2020), USENIX Association, San Sebastian, 381–395. Retrieved from https://www.usenix.org/conference/raid2020/presentation/salehi
[26]
Amazon Web Services. 2017. The FreeRTOS reference manual. Retrieved from https://www.freertos.org/Documentation/RTOS\_book.html
[27]
Pooja Singh and Lalit Kumar Singh. 2021. Reliability and safety engineering for safety critical systems: An interview study with industry practitioners. IEEE Transactions on Reliability 70, 2 (2021), 643–653. DOI:https://doi.org/10.1109/tr.2021.3051635
[28]
Zhichuang Sun, Bo Feng, Long Lu, and Somesh Jha. 2020. OAT: Attesting operation integrity of embedded devices. In 2020 IEEE symposium on security and privacy (SP), IEEE, 1433–1449. DOI:https://doi.org/10.1109/sp40000.2020.00042
[29]
Jinwen Wang, Ao Li, Haoran Li, Chenyang Lu, and Ning Zhang. 2022. RT-TEE: Real-time system availability for cyber-physical systems using ARM TrustZone. In 2022 IEEE symposium on security and privacy (SP), IEEE Computer Society, 1573–1573. DOI:https://doi.org/10.1109/sp46214.2022.9833604