TEE-Time: A Dynamic Cache Timing Analysis Tool for Trusted Execution Environments - Archive ouverte HAL
Communication Dans Un Congrès Année : 2024

TEE-Time: A Dynamic Cache Timing Analysis Tool for Trusted Execution Environments

Résumé

In this article, we present a tool to analyze cache timing vulnerabilities in trusted execution environments. First, we present a platform based on the well-known gem5 simulator capable of booting GlobalPlatform Compliant TEEs for ARMV8 architecture. Next, we present the associated GDB instrumentation which allows us to dynamically reconfigure the gem5 simulator and access detailed micro-architectural state after each simulation step. Unmodified Linux/TEE binaries can be run on this platform, from which detailed execution and cache access traces are gathered and analyzed on-the-fly.We demonstrate the usage of this tool, first with an in-vitro experiment to explain the concepts of Key-Cache lines, Key-Execution Points, a method to rank these lines in an increasing order of vulnerability, and code coverage. We show that real vulnerabilities can be detected with our tool, in an otherwise constant-time RSA implementation inside an open Source TEE called OP-TEE.
Fichier non déposé

Dates et versions

hal-04704063 , version 1 (20-09-2024)

Identifiants

Citer

Quentin Forcioli, Sumanta Chaudhuri, Jean-Luc Danger. TEE-Time: A Dynamic Cache Timing Analysis Tool for Trusted Execution Environments. 2024 25th International Symposium on Quality Electronic Design (ISQED), Apr 2024, San Francisco, California, United States. pp.1-8, ⟨10.1109/ISQED60706.2024.10528744⟩. ⟨hal-04704063⟩
28 Consultations
0 Téléchargements

Altmetric

Partager

More