ARM TrustZone

ARM® TrustZone® technology is a System on Chip (SoC) and CPU system-wide approach to security. TrustZone is hardware-based security built into SoCs by semiconductor chip designers who want to provide secure end points and a device root of trust. The family of TrustZone technologies can be integrated into any ARM based system, from the smallest microcontrollers, with Trustzone for Cortex-M processors, to high performance applications processors, with TrustZone technology for Cortex-A processors.

At the heart of the TrustZone approach is the concept of secure and non-secure worlds that are hardware isolated from each other. Within the processor, software either resides in the secure world or the non-secure world; a switch between these two worlds is accomplished by a secure monitor (application processors) or via hardware (microcontrollers). This concept of secure (trusted) and non-secure (non-trusted) worlds extends beyond the CPU, its memory and software to include transactions on a bus, interrupts and peripheral interfaces within an SoC.

 

TrustZone technology for application processors

TrustZone technology within Cortex-A based application processors is commonly used to run trusted boot and a trusted OS to create a Trusted Execution Environment (TEE). Typical use cases include the protection of authentication mechanisms, cryptography, key material and DRM. Applications that run in the secure world are called Trusted Apps.

TrustZone technology for Cortex-A provides a foundation for system-wide security and the creation of a trusted platform. Any part of the system can be designed to be part of the secure world including debug, peripherals, interrupts and memory. By creating a security subsystem, assets can be protected from software attacks and common hardware attacks.

The partitioning of the two worlds is achieved by hardware logic present in the AMBA bus fabric, peripherals and processors. Each physical processor core has two virtual cores: one considered secure and the other non-secure and a robust mechanism is provided to context switch between them (Secure Monitor Call).  The entry to the secure monitor can be triggered by software executing a dedicated Secure Monitor Call (SMC) instruction or by a number of exception mechanisms. The monitor code typically saves the state of the current world and restores the state of the world being switched to.

In order to implement a Secure world in the SoC, trusted software (Trusted OS) needs to be developed to make use of the protected assets. This code typically implements trusted boot, the secure world switch monitor, a small trusted OS and trusted apps. Multiple levels of secure world privileges are provided for isolation between trusted boot, trusted OS and trusted apps. The combination of TrustZone based hardware isolation, trusted boot and a trusted OS make up a Trusted Execution Environment (TEE). The TEE offers the security properties of confidentiality and integrity to multiple Trusted Apps. Many TEE providers follow GlobalPlatform’s API standard to enable their TEE to deliver a common security capability across platforms and markets. A protection profile has been written by GlobalPlatform for TEEs and a security evaluation scheme developed that can be used by partners who want to gain security certification from an independent test laboratory.

 

ARM Trusted Firmware

SoC developers and OEMs can benefit from a reference implementation of low-level secure world software known as ARM Trusted Firmware. This software is available as open source on GitHub and includes trusted boot and a secure runtime that takes care of the switching between the normal (non-trusted) and secure (trusted) worlds using Secure Monitor Code Calling Convention (SMCCC). ARM Trusted Firmware can be integrated with a commercial or open source trusted OS to create a TEE.

To aid the system designer in creating a TrustZone based TEE, ARM has created a number of documents, reference software and training courses. These documents include:

To get access to these documents please make a request via your account manager or FAE.

 

Trusted - Non Trusted Diagram

TrustZone technology for microcontroller class systems

ARMv8-M architecture extends TrustZone technology to Cortex-M class systems such as microcontrollers, enabling robust levels of protection at all cost points.  TrustZone for ARMv8-M has the same high-level features as TrustZone on applications processors with the added benefit that switching between secure and non-secure worlds is done in hardware for faster transitions and greater power efficiency. Software productivity is enhanced as TrustZone for ARMv8-M is fully programmable in C language (in line with the rest of the ARMv8-M architecture) and offers protected debug operations corresponding to the security state of the processor. TrustZOne for Cortex-M may be used to protect firmware, provide peripheral and I/O protection, as well as providing isolation for secure boot, trusted update and root of trust implementation.

Discover more technical information on TrustZone for ARMv8-M