ARM 기반 가상화 환경에서의 소프트웨어 TPM 지원 방법

Abstract

As the embedded system is applied in various fields, the rate of use of smart devices such as smartphone, tablet PC and IoT devices increases drastically. It creates various services to utilize the smart devices, and the applications like mobile bank, navigation application, and health managers are the examples of the new services for using smart devices. Users store password, health information, GPS, bank account and etc. in their smart device to use the services, but there are lots of attacks to steal users’ sensitive information. The attacks can be available by using vulnerabilities of software (e.g. OpenSSL heartbleed) or by using rootkit for kernel manipulation. Thus, it is important to protect the sensitive information in smart devices. To protect the sensitive information in smart devices, it is common to use security framework running on the operating systems. Security framework usually protect data by using encryption and it is very vulnerable to make encryption key or manage the encryption key with software, because the key generated by software can be leaked out due to the vulnerabilities of software. Thus, it should be required to manage the encryption key at the hardware-level. Hardware security module is typical device for hardware-level security device. It manages encryption key, digital signature, and other keys at the hardware level, and is equipped in the system externally. It aims to protect its encryption functions against hacker unless hackers robs the hardware security module. Cost of maintaining hardware security modules, however, is a huge problem because it should substitute older chip with newer one if there is an update for standard. Additionally, if there is an update due to the vulnerability in the existing hardware chip, the substitution of hardware chip can be more serious. In case of Trusted Platform Module (TPM), the chips (TPM v1.2) is already equipped more than 2.3 billion systems, and the newer version (TPM v2.0) is published at 2014, but hardware chip is not ready for manufacture. If the TPM v2.0 chip is released, it gives rise to a huge substitution cost. To overcome the limitation of hardware security module, there is another approach; virtualized hardware security module. With virtualization, it supports identical functionalities as hardware chip, and users can utilized the chip as if there is real hardware chip. Additionally, it can solve the cost problem of hardware chip by updating the software. In case of mobile device, however, hardware security module is not supported well and it is hard to apply virtualization-based skill owing to limited resources of the device. In this thesis, we suggest the method to support software TPM at the ARM-based mobile virtualization environment to improve the security in the mobile environment. To achieve the goal, we separate security framework (e.g. TPM) from operating systems, and we virtualize the security framework. We choose the TPM as an example of security framework, and we support the TPM as a software at the hypervisor-level. To virtualize the TPM, we use our thin hypervisor which is appropriate for mobile environment. Additionally, the software TPM at the hypervisor level follows the TCG TPM standard and it consists of TPM interface, TPM engine and cryptographic libraries. We demonstrate that the software TPM follows the standard of TPM ver1.2 and TPM ver2.0. In addition to demonstration of software TPM functionalities, we also evaluate the performance of software TPM. Most of the results show better performance than hardware TPM chip, but a few commands need optimization for better performance.