基于TrustZone的可信执行环境构建技术研究

摘要

As a technique for protecting data and programs, compared with the traditional security technology, the trusted execution environment (TEE) can actively prevent threats from outside and ensure the safety of host more effectively by means of hardware aided isolation. With the extensive application of the ARM processor with the built-in TrustZone, trusted execution environment development has been paid increasing attentions. At present, there have been many open source TEE projects based on TrustZone, but their applications still face with problems because of the lack of corresponding standards. Taking Open-TEE as an example, this paper deeply studies the overall structure of TEE, analyzes the architecture of software layer and operational process, and proposes the development method of trusted application. The performances of deployment, development and memory footprint of some TEEs are compared through experiments. The development method of TEE proposed in this paper has good software architecture and is easy to be developed.%可信执行环境（TEE）作为一种通过隔离的方法保护数据和程序的技术，与传统安全技术相比，能够主动防御来自外部的安全威胁，更有效地保障自身安全。随着内置TrustZone技术的ARM处理器的广泛应用，可信执行环境开发受到重视。目前已经出现了很多基于TrustZone的开源项目，但因缺乏相应标准等原因给应用开发带来了障碍。文章以Open-TEE为例，深入研究了可信执行环境的整体结构，分析了软件层的组件构成和运行流程，提出了可信应用的开发方法。通过实验，比较分析了几种可信执行环境在部署难易度、开发难易度、内存占用等方面的性能。文章提出的可信执行环境构建方法具有良好的软件结构，易于开发。