| Intel, ARM collaborate on device security |
Oct. 15, 2007
ARM Ltd. and Intel are collaborating on a set of hardware and software technologies aimed at improving security in devices such as mobile phones, PDAs, and set-top boxes. The effort will integrate ARM's TrustZone hardware/software authentication with Intel's Authenticated Flash memory, targeting next-generation system-on-chip (SoC) designs, according to the companies.
ARM launched TrustZone in 2003, touting it as a hardware mechanism for cordoning off designated areas of on- and off-chip memory, for exclusive use by "trusted" data and applications. TrustZone can be used to establish a "parallel world" in which trusted programs and data can work and live in isolation from a device's rich OS, including at boot time, ARM says.
TrustZone architecture concept
TrustZone was launched as a standard component of ARM's ARM1176-JZ core, and is also standard in the company's later Cortex-A8 and Cortex-A9 cores. TrustZone is also available as an add-on to ARM7 and ARM9 cores.
In addition to a hardware component, TrustZone includes a configurable, portable software stack exposing a TrustZone Software API for custom application access. Suggested applications include access control, secure storage, crytpographic services, and integrity checking for secure boot, SIMLock, and IMEI (international mobile equipment identity) protection. Additionally, there's an optional STIP (small terminal interoperability platform) smartcard interface.
ARM TrustZone stack components
(Click to enlarge)
According to ARM, Intel's Authenticated Flash, interposes hardware cryptographic engines directly in front of the flash memory device, with the goals of preventing unauthorized modifications, providing hardware access control, and supporting protected key storage.
Standard flash (left) and Intel Authenticated Flash (right)
(Click to enlarge)
ARM and Intel say that in practice, integrating their respective products is "simple and straightforward," despite "many variations." An HMAC (hash-keyed message authentication code) can be shared between the SoC and the flash, permanently binding them together. Alternatively, an RSA public key can be installed on the flash device, with the private key "available locally or maintained external to the specific device." Or, both approaches may be combined, as depicted below.
TrustZone and Authenticated Flash configured for both RSA and HMAC authentication
Touted benefits of the combined technologies are said to include:- SoC resources can be reduced (i.e., crytographic hardware may not be needed).
- No need for separate, secure ROM (read-only memory) devices, such as a boot ROM, since the authenticated memory can provide "equivalent protection."
- Less RAM may be needed, as the setup supports "direct execution" techniques (i.e., XIP, or execute-in-place). ARM says, "applications that reside in external flash, but are integrity checked before being loaded into SoC RAM can instead remain in external authenticated flash and be directly executed. The need for secure RAM is then limited to the needs such as stack, heap, and dynamic data."
- "Key fuses" can be reduced. "A single key stored on the SoC can be used to bind the flash to the host processor. All other keys needed by the system can be protected by the authenticated memory," ARM says.
Jim McGregor, research director at In-Stat, stated, "The need for security protection of wireless applications represents a significant issue for the embedded world. With complementary technologies from players like ARM and Intel, In-Stat believes the industry is heading in a positive direction."
Tiago Alves, security solutions manager at ARM, stated, "We are enabling system security by integrating protective measures into the heart of our processors and providing secure software to complement the efforts of our partners."
Availability
The combined technology is available now, and supports "open" OSes such as Linux, Symbian, and Windows CE, according to ARM. Additional details are available in a PDF whitepaper on the combined products, currently available both from ARM and from Intel.
Related Stories:
(Click here for further information)
|
|
|
FUEL Database on MontaVista Linux
Whether building a mobile handset, a car navigation system, a package tracking device, or a home entertainment console, developers need capable software systems, including an operating system, development tools, and supporting libraries, to gain maximum benefit from their hardware platform and to meet aggressive time-to-market goals.
Breaking New Ground: The Evolution of Linux Clustering
With a platform comprising a complete Linux distribution, enhanced for clustering, and tailored for HPC, Penguin Computing¿s Scyld Software provides the building blocks for organizations from enterprises to workgroups to deploy, manage, and maintain Linux clusters, regardless of their size.
Data Monitoring with NightStar LX
Unlike ordinary debuggers, NightStar LX doesn¿t leave you stranded in the dark. It¿s more than just a debugger, it¿s a whole suite of integrated diagnostic tools designed for time-critical Linux applications to reduce test time, increase productivity and lower costs. You can debug, monitor, analyze and tune with minimal intrusion, so you see real execution behavior. And that¿s positively illuminating.
Virtualizing Service Provider Networks with Vyatta
This paper highlights Vyatta's unique ability to virtualize networking functions using Vyatta's secure routing software in service provider environments.
High Availability Messaging Solution Using AXIGEN, Heartbeat and DRBD
This white paper discusses a high-availability messaging solution relying on the AXIGEN Mail Server, Heartbeat and DRBD. Solution architecture and implementation, as well as benefits of using AXIGEN for this setup are all presented in detail.
Understanding the Financial Benefits of Open Source
Will open source pay off? Open source is becoming standard within enterprises, often because of cost savings. Find out how much of a financial impact it can have on your organization. Get this methodology and calculator now, compliments of JBoss.
Embedded Hardware and OS Technology Empower PC-Based Platforms
The modern embedded computer is the jack of all trades appearing in many forms.
Data Management for Real-Time Distributed Systems
This paper provides an overview of the network-centric computing model, data distribution services, and distributed data management. It then describes how the SkyBoard integration and synchronization service, coupled with an implementation of the OMG¿s Data Distribution Service (DDS) standard, can be used to create an efficient data distribution, storage, and retrieval system.
7 Advantages of D2D Backup
For decades, tape has been the backup medium of choice. But, now, disk-to-disk (D2D) backup is gaining in favor. Learn why you should make the move in this whitepaper.
|
|
|
|
|
news feed