IETF is discussing Trusted Execution Environment Provisioning (TEEP) protocol to manage remote installation/update/deletion of a TA (Trusted Application) in TEE (Trusted Execution Environment) which provides hardware isolated environment in the CPU. TEEP is designed to be general among different CPU architectures. We have implementation of TEEP on the new RISC-V cpu. Our implementation is designed to be portable to another TEE architecture. The requirement for portability is discussed at the event.
IETF is discussing Trusted Execution Environment Provisioning (TEEP) protocol to manage remote installation/update/deletion of a TA (Trusted Application) in TEE (Trusted Execution Environment) which provides hardware isolated environment in the CPU. TEEP is designed to be general among different CPU architectures, but primary implementations are proceeding on Intel SGX and ARM TrustZone. Therefore, we have implemented of TEEP on Keystone which is a TEE project on RISC-V led by UC Berkeley.
TEEP consists of 3 major software components; “TEEP Broker” on the normal OS, “TEEP Agent” in the TEE, and “Trusted Application Manager (TAM)” on a remote server. These components manage certificates for authenticating TEE and TAM, and code signing of TA. All of the certificates are based on PKI key management. The challenges of having TEEP functionality on RISC-V is how to minimize the complexity of required features of TEEP inside TEE while keeping the portability of existing TA. The TEE is not meant to have full scale of POSIX API development environment which are convenient for developer but not ideal for minimizing security who would like to focus on code size.
Some of the features we have added to Keystone runtime are HTTP/HTTPS and Concise Binary Object Representation (CBOR) parser.
Our initial implementation of TEEP was implemented on Arm TrustZone with OP-TEE and then moved to Keystone on RISC-V. The presentation will also include instruction of basic concept and design of TEEP.
Speakers: Akira Tsukamoto