256 research outputs found
Proceedings of the Workshop on web applications and secure hardware (WASH 2013).
Web browsers are becoming the platform of choice for applications that need to work across a wide range of different devices, including mobile phones, tablets, PCs, TVs and in-car systems. However, for web applications which require a higher level of assurance, such as online banking, mobile payment, and media distribution (DRM), there are significant security and privacy challenges. A potential solution to some of these problems can be found in the use of secure hardware – such as TPMs, ARM TrustZone, virtualisation and secure elements – but these are rarely accessible to web applications or used by web browsers. The First Workshop on Web Applications and Secure Hardware (WASH'13) focused on how secure hardware could be used to enhance web applications and web browsers to provide functionality such as credential storage, attestation and secure execution. This included challenges in compatibility (supporting the same security features despite different user hardware) as well as multi-device scenarios where a device with hardware mechanisms can help provide assurance for systems without. Also of interest were proposals to enhance existing security mechanisms and protocols, security models where the browser is not trusted by the web application, and enhancements to the browser itself
SoK: A Systematic Review of TEE Usage for Developing Trusted Applications
Trusted Execution Environments (TEEs) are a feature of modern central
processing units (CPUs) that aim to provide a high assurance, isolated
environment in which to run workloads that demand both confidentiality and
integrity. Hardware and software components in the CPU isolate workloads,
commonly referred to as Trusted Applications (TAs), from the main operating
system (OS). This article aims to analyse the TEE ecosystem, determine its
usability, and suggest improvements where necessary to make adoption easier. To
better understand TEE usage, we gathered academic and practical examples from a
total of 223 references. We summarise the literature and provide a publication
timeline, along with insights into the evolution of TEE research and
deployment. We categorise TAs into major groups and analyse the tools available
to developers. Lastly, we evaluate trusted container projects, test
performance, and identify the requirements for migrating applications inside
them.Comment: In The 18th International Conference on Availability, Reliability and
Security (ARES 2023), August 29 -- September 01, 2023, Benevento, Italy. 15
page
Keys in the Clouds: Auditable Multi-device Access to Cryptographic Credentials
Personal cryptographic keys are the foundation of many secure services, but
storing these keys securely is a challenge, especially if they are used from
multiple devices. Storing keys in a centralized location, like an
Internet-accessible server, raises serious security concerns (e.g. server
compromise). Hardware-based Trusted Execution Environments (TEEs) are a
well-known solution for protecting sensitive data in untrusted environments,
and are now becoming available on commodity server platforms.
Although the idea of protecting keys using a server-side TEE is
straight-forward, in this paper we validate this approach and show that it
enables new desirable functionality. We describe the design, implementation,
and evaluation of a TEE-based Cloud Key Store (CKS), an online service for
securely generating, storing, and using personal cryptographic keys. Using
remote attestation, users receive strong assurance about the behaviour of the
CKS, and can authenticate themselves using passwords while avoiding typical
risks of password-based authentication like password theft or phishing. In
addition, this design allows users to i) define policy-based access controls
for keys; ii) delegate keys to other CKS users for a specified time and/or a
limited number of uses; and iii) audit all key usages via a secure audit log.
We have implemented a proof of concept CKS using Intel SGX and integrated this
into GnuPG on Linux and OpenKeychain on Android. Our CKS implementation
performs approximately 6,000 signature operations per second on a single
desktop PC. The latency is in the same order of magnitude as using
locally-stored keys, and 20x faster than smart cards.Comment: Extended version of a paper to appear in the 3rd Workshop on
Security, Privacy, and Identity Management in the Cloud (SECPID) 201
Virtual HSM: Building a Hardware-backed Dependable Cryptographic Store
Cloud computing is being used by almost everyone, from regular consumer to IT
specialists, as it is a way to have high availability, geo-replication, and resource elasticity
with pay-as-you-go charging models. Another benefit is the minimal management effort
and maintenance expenses for its users.
However, security is still pointed out as the main reason hindering the full adoption
of cloud services. Consumers lose ownership of their data as soon as it goes to the cloud;
therefore, they have to rely on cloud provider’s security assumptions and Service Level
Agreements regarding privacy and integrity guarantees for their data.
Hardware Security Modules (HSMs) are dedicated cryptographic processors, typically
used in secure cloud applications, that are designed specifically for the protection of
cryptographic keys in all steps of their life cycles. They are physical devices with tamperproof
resistance, but rather expensive. There have been some attempts to virtualize
HSMs. Virtual solutions can reduce its costs but without much success as performance is
incomparable and security guarantees are hard to achieve in software implementations.
In this dissertation, we aim at developing a virtualized HSM supported by modern
attestation-based trusted hardware in commodity CPUs to ensure privacy and reliability,
which are the main requirements of an HSM. High availability will also be achieved
through techniques such as cloud-of-clouds replication on top of those nodes. Therefore
virtual HSMs, on the cloud, backed with trusted hardware, seem increasingly promising
as security, attestation, and high availability will be guaranteed by our solution, and it
would be much cheaper and as reliable as having physical HSMs
Towards Runtime Customizable Trusted Execution Environment on FPGA-SoC
Processing sensitive data and deploying well-designed Intellectual Property
(IP) cores on remote Field Programmable Gate Array (FPGA) are prone to private
data leakage and IP theft. One effective solution is constructing Trusted
Execution Environment (TEE) on FPGA-SoCs (FPGA System on Chips). Researchers
have integrated this type TEE with Trusted Platform Module (TPM)-based trusted
boot, denoted as FPGA-SoC tbTEE. But there is no effort on secure and trusted
runtime customization of FPGA-SoC TEE. This paper extends FPGA-SoC tbTEE to
build Runtime Customizable TEE (RCTEE) on FPGA-SoC by additive three major
components (our work): 1) CrloadIP, which can load an IP core at runtime such
that RCTEE can be adjusted dynamically and securely; 2) CexecIP, which can not
only execute an IP core without modifying the operating system of FPGA-SoC TEE,
but also prevent insider attacks from executing IPs deployed in RCTEE; 3)
CremoAT, which can provide the newly measured RCTEE state and establish a
secure and trusted communication path between remote verifiers and RCTEE. We
conduct a security analysis of RCTEE and its performance evaluation on Xilinx
Zynq UltraScale+ XCZU15EG 2FFVB1156 MPSoC
Recommended from our members
An analysis of BYOD architectures in relation to mitigating security risks
As the adaptation of smartphones and tablets to conduct business activities increases, enterprise mobility becomes a rising trend in business environments providing a flexible work environment that modernizes how workers accomplish their tasks. One significant part of the current enterprise mobility movement is the adoption of the Bring Your Own Device (BYOD) strategy. BYOD allows employees to use their personal mobile devices to access corporate resources and conduct business tasks while maintaining the usage of these devices for personal activities. This underlying feature of the BYOD solution presents serious concerns for enterprises in terms of securing the storage and access of the corporate data. This report will explore the BYOD strategy and analyze the business requirements that are tied to the secure storage and management of corporate data. The report will also study existing architectural approaches as they relate to the BYOD movement, and explore how these approaches attempt to minimize the security risks and challenges associated with the BYOD strategy.Electrical and Computer Engineerin
- …