抗电路板级物理攻击的TEE防护技术研究

随着移动互联网时代对信息安全要求的提高，TEE技术在智能终端上得到了广泛应用，其自身安全性对保障移动支付等安全敏感业务的健康发展具有重要意义。本项目针对电路板级物理攻击这类易形成黑色产业、严重威胁TEE推广应用的攻击手段，结合SoC片内RAM的抗物理攻击能力和操作系统片内最小核构建方法，为整体TEE系统设计抗板级物理攻击方案：首先，提取维持CPU运行的操作系统基础组件形成TEE最小核，并构建片内RAM和片外RAM的传输通道达到将整个TEE系统运行在片内RAM的初始目标；然后，在最小核上扩展高效的片外内存保护机制使得整个TEE系统具备抗板级物理攻击的能力；最后采用内核嵌套隔离技术和安全上下文切换机制实现最小核与其余TEE组件的逻辑隔离。该项研究突破了TEE仅能抵抗软件攻击的保护界限，可增强当前智能终端的安全水平，还可将TEE扩展应用至需要抗物理攻击的领域，对TEE发展具有极大的促进意义。

As smartphones require higher security level than before in mobile internet era, TEE technology has been widely deployed in smartphones, and its security plays an important role in guaranteeing the healthy development of mobile payments and other security-sensitive applications. This project focuses on board-level physical attacks, which can be used to form black market easily and threaten the application and development of TEE. By combining the capability of resistance against physical attacks provided by on-chip RAM and a minimal kernel extracting from the OS, we propose a solution that can prevent board-level physical attacks against TEE systems. Firstly, we build a minimal TEE kernel by extracting basic components of TEE OS that maintaining the CPU and build a channel between the on-chip RAM and the off-chip RAM, then we can achieve the basic goal of running the whole TEE system in the on-chip RAM based on the minimal TEE kernel and the channel. Secondly, we implement an efficient memory protection mechanism for off-chip RAM in the minimal TEE kernel, and thus the whole TEE system obtains the ability to resist board-level physical attacks. Finally, we isolate the minimal TEE kernel from other components of the TEE system by leveraging the technology of nested kernel execution environment and the software-based secure context switching mechanism. This project breaks through the protection limit of TEE technology, which is designed to only provide software security level, and can improve the security of current smartphones, and can extend TEE to fields requiring physical security, so the research has a great promotional effect on the development of TEE.