Towards a standards-compliant pure-software trusted execution environment for resource-constrained embedded devices

Trusted execution environments (TEEs) are becoming a requirement to protect a wide range of platforms, from cloud servers to embedded sensors. In this paper, we take a first step towards providing a pure-software Trusted Execution Environment (TEE) for resource-constrained embedded devices that lack basic hardware-based security features, such as Memory Protection Units (MPUs). Our key instrument in providing the features of TEEs is a formally-verified software-based memory isolation technique called the Security MicroVisor (SµV), that serves as a programmable trusted layer, which provides isolation by policing and regulating the execution of assembly-level instructions. This paper contributes the first architecture of a pure software TEE that supports all of the features that have been standardized by the GlobalPlatform Organization. Our implementation and evaluation results demonstrate the feasibility of implementing a standards-compliant software-based TEE for low-end embedded devices without hardware support or modification that has proven security against all networked attacks.