Cross-World Covert Channel on ARM Trustzone through PMU

Area of Science:

• Computer Science
• Cybersecurity
• Hardware Security

Background:

• ARM TrustZone technology provides a Trusted Execution Environment (TEE) for secure code execution, isolating it from the normal world in processors widely used in IoT devices.
• Existing covert channels leveraging Performance Monitoring Unit (PMU) events within TrustZone suffer from limited bandwidth due to high event latency.
• Lack of synchronization between PMU operations introduces noise, complicating data encoding and decoding in covert channels.

Purpose of the Study:

• To demonstrate a novel cross-world covert channel vulnerability in ARM TrustZone, allowing data exfiltration from the secure world to the normal world.
• To investigate the impact of different synchronization mechanisms (synchronous, semi-synchronous, asynchronous) on covert channel performance.
• To propose and evaluate the use of microarchitectural PMU events for enhanced covert channel bandwidth compared to traditional cache-based events.

Main Methods:

• Developed an encoding program to generate PMU event footprints representing secret data.
• Utilized machine learning models, trained on user-space PMU data, for decoding secret information from the event footprints.
• Implemented and experimented with three synchronization strategies to mitigate noise in the covert channel.
• Compared the performance of covert channels using microarchitectural PMU events against those using L1/LLC cache PMU events.

Main Results:

• Demonstrated a functional secure-to-normal world covert channel using PMU events within TrustZone.
• Observed a significant increase in covert channel bandwidth by switching from cache-based PMU events to microarchitectural events (approx. 15x higher).
• Achieved a throughput of approximately 11 Kbits/s using microarchitectural events, a substantial improvement over the previous 760 bits/s.
• Evaluated the effectiveness of synchronous, semi-synchronous, and asynchronous synchronization models in managing channel noise.

Conclusions:

• The proposed use of microarchitectural PMU events offers a significantly higher bandwidth covert channel within ARM TrustZone.
• Synchronization strategies are crucial for managing noise and improving the reliability of PMU-based covert channels.
• This research highlights a critical security vulnerability in TrustZone, emphasizing the need for robust defenses against covert channel attacks.