type
status
date
slug
summary
tags
category
icon
password
URL
OP-TEE (Open Portable Trusted Execution Environment) is an open-source TEE (Trusted Execution Environment) built on ARM's TrustZone technology. It is primarily maintained by Linaro and offers an isolated, secure environment for executing trusted applications, essential for tasks involving cryptography, secure data storage, and ensuring device integrity.
1. OP-TEE Architecture
OP-TEE is based on the concept of separating the system into:
- Rich Execution Environment (REE): The standard world, typically running a rich OS like Linux.
- Trusted Execution Environment (TEE): The secure world, used to run trusted applications (TAs).
These environments communicate via shared memory, using messages managed by the ARM security monitor or ARM Trusted Firmware. The separation ensures that secure operations are isolated from potentially vulnerable, non-secure operations.
2. Software Components
OP-TEE comprises several key components:
- Trusted OS: A lightweight, standalone operating system running in the secure world.
- Kernel Driver (optee.ko): A driver running in the REE to facilitate communication with OP-TEE.
- Client Library (libteec.so): The user-space library provides an API to interact with the TEE.
3. Key Features
OP-TEE provides numerous features to support secure execution:
- Isolation: Utilizes ARM TrustZone to allocate separate secure and non-secure resources, including memory and peripherals.
- Input Validation: Ensures that all data and commands from the REE are validated before being processed.
- Secure Storage: Offers secure storage mechanisms (such as encrypted data stored in eMMC RPMB) to protect sensitive information.
4. Typical Boot Process
The typical OP-TEE boot sequence involves multiple steps:
- BootROM: Loads and verifies the first-stage bootloader.
- 1st Stage Bootloader: Loads the ARM Trusted Firmware, preparing to switch to secure mode.
- Secure Monitor/ARM TF: Loads the OP-TEE OS.
- 2nd Stage Bootloader: Loads the Linux kernel in the REE.
5. Data and Peripheral Isolation
OP-TEE achieves secure system operation by isolating data and peripherals, enforcing the boundaries between secure and non-secure worlds. The use of secure storage, such as the RPMB (Replay Protected Memory Block), further ensures data integrity by preventing tampering.
ARM Trusted Firmware
ref
Β