移动终端TEE技术进展研究

doi:10.3969/j.issn.1671-1122.2018.02.012

信息网络安全 ›› 2018, Vol. 18 ›› Issue (2): 84-91.doi: 10.3969/j.issn.1671-1122.2018.02.012

移动终端TEE技术进展研究

刘志娟^1,²(), 高隽², 丁启枫³, 王跃武¹

1.中国科学院数据与通信保护研究教育中心,北京 100093
2.工业和信息化部产业发展促进中心,北京 100846
3.国家无线电监测中心检测中心,北京 100041

收稿日期:2017-11-15 出版日期:2018-02-10 发布日期:2020-05-11
作者简介:作者简介：刘志娟（1991—）,女,河北,工程师,硕士,主要研究方向为终端系统安全、网络安全;高隽（1979—）,女,北京,经济师,主要研究方向为网络安全、经济管理;丁启枫（1990—）,男,安徽,工程师,硕士,主要研究方向为系统安全、无线通信;王跃武（1975—）,男,河南,副研究员,博士,主要研究方向为网络与系统安全。
基金资助:
“十三五”国家密码发展基金密码理论研究课题[MMJJ20170215];工业和信息化部产业发展促进中心2016 年专题研究课题

Research on Development of Trusted Execution Environment Technology on Mobile Platform

Zhijuan LIU^1,²(), Jun GAO², Qifeng DING³, Yuewu WANG¹

1. The Data Assurance and Communication Security Research Center of Chinese Academy of Sciences, Beijing 100093, China
2. Industry Development and Promotion Center of Ministry of Industry and Information Technology of the People’s Republic of China, Beijing 100846, China;
3. The State Radio Monitoring Center Testing Center, Beijing 100041, China

Received:2017-11-15 Online:2018-02-10 Published:2020-05-11

摘要/Abstract

摘要：

移动终端TEE技术是目前移动应用安全保障的核心技术,受到产业和学术领域的广泛关注。文章全面分析TEE技术的安全特性对于相关研究开展具有重要参考价值。首先从TEE安全环境构建及安全功能可信提供两个角度,系统完整地总结了TEE技术的安全特征。然后,围绕TEE安全特征的实现,文章对相关软硬件技术发展进行了分析,提出了基本的移动终端TEE软硬件技术架构。在全面分析TEE技术的基础上,文章还将TEE技术与其他当前移动终端关注的系统安全技术进行了对比分析,为TEE技术的具体应用提供了借鉴。最后,文章还针对TEE技术发展总结了其面临的技术挑战,为TEE技术的下一步发展提供了参考。

关键词: 移动终端, 可信执行环境, 安全隔离, 可信用户交互, 安全证明

Abstract:

Trusted execution environment(TEE)as one of the most prevalent mobile device secure technology has attracted more and more attention from academy field and industry field. Thus, analyzing the security of TEE technology thoroughly is very valuable. According to TEE construction and TEE secure function providing, this paper presents five secure features of TEE in detail. Then, the software and hardware technologies used to implement the five secure features are investigated and the general software and hardware architecture are presented. In addition, we compare TEE technology with other mobile device secure technology carefully. Finally, the challenges faced by TEE technology development are listed. The work of this paper may be a good reference for TEE technology development.

Key words: mobile device, trusted execution environment, isolation, trustworthy user interface, security attestation

中图分类号:

TP309

刘志娟, 高隽, 丁启枫, 王跃武. 移动终端TEE技术进展研究[J]. 信息网络安全, 2018, 18(2): 84-91.

Zhijuan LIU, Jun GAO, Qifeng DING, Yuewu WANG. Research on Development of Trusted Execution Environment Technology on Mobile Platform[J]. Netinfo Security, 2018, 18(2): 84-91.

图/表 5

参考文献 23

[1]	GOOGLE.Google Wallet[EB/OL].,2017-10-15.
[2]	SAMSUNG.Knox Solutions Covered Every Step of the Way[EB/OL]. ,2017-10-15.
[3]	ARM.SoC and CPU System-wide Approach to Security[EB/OL]. ,2017-10-15.
[4]	范冠男,董攀. 基于TrustZone的可信执行环境构建技术研究[J].信息网络安全,2016(3):21-27.
[5]	MACHIRY A, GUSTAFSON E, SPENSKY C, et al. BOOMERANG: Exploiting the Semantic Gap in Trusted Execution Environments[EB/OL]. , 2017-10-15.
[6]	GOOGLE.Android Qualcomm Vulnerability Impacts 60 Percent of Devices[EB/OL]. ,2017-10-15.
[7]	VASUDEVAN A, OWUSU E, ZHOU Z, et al.Trustworthy Execution on Mobile Devices: What Security Properties Can My Mobile Platform Give Me?[C]// Springer .International Conference on Trust and Trustworthy Computing, June 13-15, Vienna, Austria. Berlin: Springer, 2012: 159-178.
[8]	EKBERG J E, KOSTIAINEN K, ASOKAN N.The Untapped Potential of Trusted Execution Environments on Mobile Devices[J].IEEE Security & Privacy, 2014 , 12(4) :29-37.
[9]	AZAB A M, SWIDOWSKI K, BHUTKAR R, et al. SKEE: A Lightweight Secure Kernel-level Execution Environment for ARM[EB/OL]. , 2017-10-15.
[10]	JANG J S, KONG S, KIM M, et al. SeCReT: Secure Channel between Rich Execution Environment and Trusted Execution Environment[EB/OL], 2017-10-15.
[11]	GE X, VIJAYAKUMAR H, JAEGER T.Sprobes: Enforcing kernel code integrity on the trustzone architecture[J]. Computer Science , 2014 , 25(6) :1793-1795.
[12]	SUN H, SUN K, WANG Y, et al.Trustotp: Transforming Smartphones into Secure One-time Password Tokens[C]// ACM.Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security, October 12 - 16, 2015,Denver, Colorado, USA.New York:ACM, 2015: 976-988.
[13]	NIST .NIST SP800-164Guidelines on Hardware-Rooted Security in Mobile Devices[EB/OL]. .
[14]	TRUSTEDCOMPUTINGGROUP.Mobile Trusted Module 2.0 Use Cases FAQ[EB/OL]. .
[15]	SUN H, SUN K, WANG Y, et al.Trustice: Hardware-assisted Isolated Computing Environments on Mobile Devices[J]. IEEE/IFIP International Conference on Dependable System & Networks, 2015 , 31(2) :367-378.
[16]	SMALLEY S,CRAIG R.Security Enhanced (SE) Android: Bringing Flexible MAC to Android[EB/OL]..
[17]	张涛,张勇,宁戈,等. 基于SELinux强制访问控制的进程权限控制技术研究与实现[J].信息网络安全,2015(12):34-41.
[18]	WANG R, ENCK W, REEVES D S, et al.EASE Android: Automatic Policy Analysis and Refinement for Security Enhanced Android via Large-Scale Semi-Supervised[C]// ACM. SEC'15 Proceedings of the 24th USENIX Conference on Security Symposium,August 12-14, 2015,Washington, D.C.New York:ACM, 2015:351-366.
[19]	WU C, ZHOU Y, PATEL K, et al. Air Bag: Boosting Smartphone Resistance to Malware Infection[EB/OL]. ,2017-10-15.
[20]	ANDRUS J,DALL C,HOF A V, et al.Cells: A Virtual Mobile Smartphone Architecture[C]// ACM .Proceedings of the Twenty-Third ACM Symposium on Operating Systems Principles, October 23-26, 2011,Cascais, Portugal. New York:ACM, 2011: 173-187.
[21]	DALL C, NIEH J.KVM/ARM: the Design and Implementation of the Linux ARM Hypervisor[C]// ACM.ASPLOS '14 Proceedings of the 19th international conference on Architectural support for programming languages and operating systems, March 1-5, 2014,Salt Lake City, Utah, USA.New York:ACM, 2014, 49(4): 333-348.
[22]	AZAB A M, NING P, SHAH J, et al.Hypervision across Worlds: Real-time Kernel Protection from the Arm Trustzone Secure World[C]// ACM.2014 ACM SIGSAC Conference on Computer and Communications Security. New York:ACM, 2014: 90-102.
[23]	宫月,李超,吴薇. 虚拟化安全技术研究[J].信息网络安全,2016(9):73-78.

移动终端TEE技术进展研究

Research on Development of Trusted Execution Environment Technology on Mobile Platform

RichHTML

PDF (PC)

可视化

摘要/Abstract

引用本文

使用本文

图/表 5

参考文献 23

相关文章 15

编辑推荐

Metrics

本文评价

[1]	唐雨, 张驰. 一种基于Intel SGX的信息中心网络隐私保护方案[J]. 信息网络安全, 2023, 23(6): 55-65.
[2]	KELEKET GOMA Christy Junior Yannick, 易文哲, 王鹃. 一种基于SGX的轻量Fabric链码可信执行环境构建方法[J]. 信息网络安全, 2022, 22(7): 73-83.
[3]	尤玮婧, 刘丽敏, 马悦, 韩东. 基于安全硬件的云端数据机密性验证方案[J]. 信息网络安全, 2020, 20(12): 1-8.
[4]	叶阿勇, 金俊林, 孟玲玉, 赵子文. 面向移动终端隐私保护的访问控制研究[J]. 信息网络安全, 2019, 19(8): 51-60.
[5]	李涛, 时俊贤, 胡爱群. 基于签名查验的移动终端应用软件合法性判别技术[J]. 信息网络安全, 2019, 19(11): 56-62.
[6]	王晋, 喻潇, 刘畅, 赵波. 智能电网环境下一种基于SDKey的智能移动终端远程证明方案[J]. 信息网络安全, 2018, 18(7): 1-6.
[7]	胡卫, 吴邱涵, 刘胜利, 付伟. 基于国密算法和区块链的移动端安全eID及认证协议设计[J]. 信息网络安全, 2018, 18(7): 7-9.
[8]	赵凯利, 李丹仪, 李强, 马存庆. 基于智能移动终端密码模块的身份认证方案实现[J]. 信息网络安全, 2017, 17(9): 107-110.
[9]	刘明达, 马龙宇. 一种基于SR-IOV技术的虚拟环境安全隔离模型[J]. 信息网络安全, 2016, 16(9): 84-89.
[10]	范冠男, 董攀. 基于TrustZone的可信执行环境构建技术研究[J]. 信息网络安全, 2016, 16(3): 21-27.
[11]	方军, 王建权, 王连印, 王会方. 基于NFC和云计算技术的电梯维保管理系统设计与实现[J]. 信息网络安全, 2016, 16(12): 74-80.
[12]	胡雪, 封化民, 陈迎亚, 吴阳阳. 一种增强WAPI安全性的改进方法[J]. 信息网络安全, 2015, 15(8): 47-52.
[13]	李建熠, 李晖, 黄梦媛. 基于内核日志的移动终端恶意软件检测[J]. 信息网络安全, 2015, 15(7): 58-63.
[14]	王琦魁，李昕，赵甫. 工控系统信息安全与加工网络防护方案研究[J]. 信息网络安全, 2014, 14(9): 120-122.
[15]	. 一种基于 Android 平台的安全图片传输技术[J]. , 2014, 14(3): 57-.