• Journal of KIISE
• /
• v.42 no.5
• /
• pp.551-557
• /
• 2015

The technology using ARM TrustZone draws attention as a new embedded virtualization approach. The ARM TrustZone defines two virtual execution environment, the secure world and the normal world. In such an environment, the inter-world communication is important to extend function of software. However, the current monitor software does not sufficiently support the inter-world communication. This paper presents a new inter guestOS communication scheme, for each world, for the ARM TrustZone virtualization. The proposed communication scheme supports bidirectional inter-world communication for single core and multicore environment. In this paper, It is implemented on a NVIDIA Tegra3 processor based on the ARM Cortex-A9 MPCore and it showed a bandwidth of 30MB/s.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2023.05a
• /
• pp.192-193
• /
• 2023

게임 산업의 성장에 맞춰 그에 따른 게임시스템 보안, 무결성 보장의 중요성 또한 커지고 있다. 본 논문에서는 게임 시스템과 TrustZone을 결합시켜 TrustZone의 Normal World와 Secure World 영역과 그 기능을 활용하여 게임 내 주요 데이터의 위·변조를 방지하여 시스템의 무결성을 보다 높은 수준에서 보장하는 방식을 탐구해보고자 한다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.32 no.3
• /
• pp.487-499
• /
• 2022

Machine learning such as deep learning have been widely used in recent years. Recently deep learning is performed in a trusted execution environment such as ARM TrustZone to improve security in edge devices and embedded devices with low computing resource. To mitigate this problem, we propose TPMP that efficiently uses the limited memory of TEE through DNN model partitioning. TPMP achieves high confidentiality of DNN by performing DNN models that could not be run with existing memory scheduling methods in TEE through optimized memory scheduling. TPMP required a similar amount of computational resources to previous methodologies.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.33 no.6
• /
• pp.929-938
• /
• 2023

ARM processors, utilized in mobile devices, have integrated the hardware isolation framework, TrustZone technology, to implement two execution environments: the trusted domain "Secure World" and the untrusted domain "Normal World". Rootkit is a type of malicious software that gains administrative access and hide its presence to create backdoors. Detecting the presence of a rootkit in a Secure World is difficult since processes running within the Secure World have no memory access restrictions and are isolated. This paper proposes a technique that leverages the hardware based PMU(Performance Monitoring Unit) to measure events of the Secure World rootkit and to detect the rootkit using deep learning.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2020.05a
• /
• pp.260-263
• /
• 2020

현재 전 세계 수많은 모바일 기기들은 보안에 민감한 애플리케이션들과 운영체제 요소들을 보호하기 위하여 ARM TrustZone 기반 신뢰실행환경 (Trusted Execution Environment) 을 사용한다. 하지만, 신뢰실행환경이 제공하는 높은 보안성에도 불구하고, 이에 대한 성공적인 공격 사례들이 지속적으로 확인되고 있다. 본 논문에서는 이러한 공격들을 가능하게 하는 ARM TrustZone 기반 신뢰실행환경의 취약점들을 소개한다. 이와 더불어 취약점들을 보완하기 위한 다양한 방어 기법 연구에 대해 살펴본다.

• IEMEK Journal of Embedded Systems and Applications
• /
• v.8 no.6
• /
• pp.303-309
• /
• 2013

Cloud storage services are used for efficient sharing or synchronizing of user's data across multiple mobile devices. Although cloud storages provide flexibility and scalability in storing data, security issues should be handled. Currently, typical cloud storage services offer data encryption for security purpose but we think such method is not secure enough because managing encryption keys by software and identifying users by simple ID and password are main defectives of current cloud storage services. We propose a secure data access method to cloud storage in mobile environment. Our framework supports hardware-based key management, attestation on the client software integrity, and secure key sharing across the multiple devices. We implemented our prototype using ARM TrustZone and TPM Emulator which is running on secure world of the TrustZone environment.

• The Journal of the Institute of Internet, Broadcasting and Communication
• /
• v.15 no.6
• /
• pp.1-9
• /
• 2015

Recently, with smart device proliferation and providing the various services using this, they have interested in mobile and Smart TV security. Smartphone users are enjoying various service, such as cloud, game, banking. But today's mobile security solutions and Study of Smart TV Security simply stays at the level of malicious code detection, mobile device management, security system itself. Accordingly, there is a need for technology for preventing hacking and leakage of sensitive information, such as certificates, legal documents, individual credit card number. To solve this problem, a variety of security technologies(mobile virtualization, ARM TrustZone, GlobalPlatform, MDM) in mobile devices have been studied. In this paper, we propose an efficient method to implement security technology based on TYPE-I virtualization using ARM TrustZone technology.

• IEMEK Journal of Embedded Systems and Applications
• /
• v.10 no.6
• /
• pp.335-343
• /
• 2015

As the usage of mobile devices becomes diverse, a number of attacks on Android also have increased. Among the attacks, Android can be compromised by flashing a new image of compromised Android Linux. In order to solve this problem, we propose SeBo (Secure Boot System) which prevents compromised Android Linux by guaranteeing secure boot environment for mobile devices based on ARM TrustZone architecture. SeBo checks the hash value of the Android Linux image before the Android Linux executes. SeBo detects all the attacks within 5 seconds. Moreover, since SeBo only trusts the Secure Bootloader from Secure World, SeBo can reduce the additional overhead of checking the Normal Bootloader from Normal World.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.26 no.5
• /
• pp.1151-1160
• /
• 2016

A TrustZone-based rootkit detecting solution using a secure timer ensures the integrity of monitoring system, because ARM TrustZone technology provides isolated environments from a monitored OS against intercepting and modifying invoke commands. However, it is vulnerable to transient attack due to periodic monitoring. Also, Address Translation Redirection Attack (ATRA) cannot be detected, because the monitoring is operated by using the physical address of memory. To ameliorate this problem, we propose a snoop-based kernel introspection system. The proposed system can monitor a kernel memory in real-time by using a snooper, and detect memory-bound ATRA by introspecting kernel pages every context switch of processes. Experimental results show that the proposed system successfully protects the kernel memory without incurring any significant performance penalty in run-time.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.25 no.4
• /
• pp.863-872
• /
• 2015

Kernel rootkit is recognized as one of the most severe and widespread threats to corrupt the integrity of an operating system. Without an external monitor as a root of trust, it is not easy to detect kernel rootkits which can intercept and modify communications at the interfaces between operating system components. To provide such a monitor isolated from an operating system that can be compromised, most existing solutions are based on external hardware. Unlike those solutions, we develop a kernel introspection system based on the ARM TrustZone technology without incurring extra hardware cost, which can provide a secure memory space in isolation from the rest of the system. We particularly use a secure timer to implement an autonomous switch between secure and non-secure modes. To ensure integrity of reference, this system measured reference from vmlinux which is a kernel original image. In addition, the flexibility of monitoring block size can be configured for efficient kernel introspection system. The experimental results show that a secure kernel introspection system is provided without incurring any significant performance penalty (maximum 6% decrease in execution time compared with the normal operating system).