<t base Trusted Application Development

<t base Trusted Application

Development

Prepared for:

Praxisforum “Anwender und Anbieter im Dialog

– Mobile Sicherheit im Unternehmen”

am 4.12.2014 in München

Markus Katzenberger

Project Manager

Trustonic GmbH

Agenda

‹

Who we are

‹

The Trusted Execution Environment TEE

‹

<t-base OTA Ecosystem

‹

Typical Use Cases for TEE

‹

<t-base architecture and APIs

Trustonic

EXECUTIVE TEAM

Ben Cade

CEO EVP Sales & Marketing Olivier Leger Chris Jones COO EVP Engineering Stephan Spitz Jon Geater CTO

Seattle, Austin, San Francisco Cambridge, London, Maidenhead, Bath Helsinki Munich Sophia, Paris Tokyo Seoul Taipei

Trustonic

EXECUTIVE TEAM

Ben Cade

CEO _{EVP Sales & Marketing} Olivier Leger Chris Jones COO EVP Engineering Stephan Spitz Jon Geater CTO

Seattle, Austin, San Francisco Cambridge, London, Maidenhead, Bath Helsinki Munich Sophia, Paris Tokyo Seoul Taipei

OVER 100 EMPLOYEES LOCATED BETWEEN

2 years of Trustonic

(Dec 2012 –Dec 2014)

What an amazing 2 years it’s been. Trustonic technology can already be found

in over 300 Million smart devices

and our growing ecosystem of service providers

stands at over 50 companies spanning enterprise, content protection, commerce and identity management segments.

So, thank you to our partners for helping to establish this common foundation of trust in devices

Now 2015 promises to be a year full of opportunity for those looking to deliver

Why use a TEE?

MAIN OPERATING SYSTEM TRUSTONIC TEE

TRUSTZONE™ SYSTEM-ON-CHIP

LOGO

LOGO IN BLACK

LOGO COLOR VERSIONS

LOGO ON BLACK

SMART CONNECTED DEVICE

Normal App Security Critical Assets TEE Enabled App API Call on Security critical Routine Secure Container Trusted App - Secured Critical Assets

‹

Key assets

exposed

‹

Key assets

protected

‹

Isolated

space for

handling

high value

assets

Where does ‹t-base fit?

TRUSTZONE™ SYSTEM-ON-CHIP APPLICATIONS PROCESSOR LOGO LOGO IN BLACK

LOGO COLOR VERSIONS

LOGO ON BLACK

SMART CONNECTED DEVICE

TOUCHSCREEN

SENSOR BIOMETRIC SENSOR

NFC BLUETOOTH WI-FI RADIO SECURE ELEMENT BASEBAND RADIO A/V OUTPUT MASS STORAGE LOCATION SENSOR

TAM CHIP MAKER SILICON IP DEVICE MAKER APP DEVELOPERS APP STORE SERVICE PROVIDERS <t-base <t-kph <t-sdk LOGO LOGO IN BLACK

LOGO COLOR VERSIONS

LOGO ON BLACK

<t-dev

END USERS

<t-directory

Content Protection

‹

Trustonic protects video path

from studio to user

MAIN OS

TRUSTZONE™ SYSTEM-ON-CHIP

SMART CONNECTED DEVICE

TEE Enabled Content Service App DRM and Media Framework APIs Secure Container TRUSTONIC TEE DRM Decryption Secure Playback

‹

Secure Boot

‹

Device Authentication

‹

User Authentication

‹

DRM Protection

‹

Trusted time source

‹

Secure Playback

‹

Link Protection DTCP

‹

Downloadable Scheme

LOGO

LOGO IN BLACK

LOGO COLOR VERSIONS

LOGO ON BLACK

DTCP/IP

Content Service

Link Protection

Signed Sealed User Input Data

Payments

MAIN OS TRUSTZONE™ SYSTEM-ON-CHIP LOGO LOGO IN BLACK

LOGO COLOR VERSIONS

LOGO ON BLACK

SMART CONNECTED DEVICE TEE Enabled Wallet App API Call to Authenticate User Secure Container Login/Password or Biometric Secure Input TRUSTONIC TEE

‹

Trustonic protects PINs and Passwords

and access to Biometric sensors

Enterprise

LOGO

LOGO IN BLACK

LOGO COLOR VERSIONS

LOGO ON BLACK

APPLICATION LEVEL

• 2 Factor User Authentication • Identity Management

• Authorization and SSO

• Physical access control with HCE • Secure messaging: Voice and Data • Data loss prevention

SYSTEM LEVEL

• Secured dual persona • Secured MDM and MAM • Biometric matching

DEVICE LEVEL

• Secure boot and integrity checks • Bulk storage encryption

Automotive

‹

Identity Management

‹

PIN/Fingerprint Unlock

‹

Remote Lock/Unlock

‹

Car personalization

‹

Performance and comfort

‹

Insurance Interface

‹

Driver risk profiled discounts

‹

Location based payments

‹

Parking

‹

Fuel/recharging

‹

Road tolls

‹

Premium Traffic information

‹

Entertainment

‹

Movies

‹

Apps

BLUETOOTH LE NFC

Internet of Things

‹

User controls who can access what data

‹

Authentication

‹

Authorization

‹

Energy suppliers bid for contracts

‹

Smart meter

‹

Appliances request service

‹

Insurers discount on occupancy

‹

User location

‹

Temperature HOME GATEWAY SMART METER SMART DEVICE GATEWAY THERMO-

STAT CONNECTED APPLIANCES APPLIANCE

MAKER ADVERTISER

ENERGY

BROKERAGE INSURER HOME

CONNECTION REQUESTS

Healthcare

‹

Health card

‹

Identity/Authorization

‹

Secure access to records

‹

Sensors and monitoring

‹

Privacy protected activity

logging

‹

Secure connection to medical

equipment

‹

Secure Storage of medical data

MEDICAL EQUIPMENT

Trusted Application

Development

Container

<t-base Architecture

ARM TrustZone® enabled SoC

<t-base driver

Trusted Application Connector

Application

<t-base OS

CO

M

Trusted Application API

Normal-World

Secure-World

kernel

Trusted Application

<t-base Client API

Sy

stem Crypto

Sec

urity

<t-base daemon

TCI

Development Tools

‹

TA Development

‹

<t-sdk

(header files, libs, sample code, scripts)

‹

ARM DS-5 for compiling and debugging

‹

GNU GCC for compiling

‹

Secure Driver Development

‹

<t-ddk

(header files, libs, sample code, scripts)

‹

ARM DS-5 for compiling

‹

debugging via JTAG according to SoC Tools

‹

Normal-World Development

‹

Existing Android driver is open-source

<t-base Normal world

<t-base driver

Trusted Application Connector

Application

Normal-World

•

Device Access

•

Session Management

•

Memory Mapping

kernel

<t-base Client API <t-base daemon Dev ice Ses sion Mem ory

Containers

<t-base Secure World

<t-base OS

CO M

Secure-World

Trusted Application Sy

stem Crypto

Sec

urity

•

COM

a set of functions for

inter-world communication

•

System

<t-base system

information and functions

•

Crypto

<t-base crypto

provider

•

Security

Secure object

functions for binary data

Trusted Application API

GlobalPlatform API

‹

In addition to the <t-base-2xx APIs,

<t-base 300 introduced the key GP features

that are already standardized

‹

TEE Client API for client applications

‹

TEE Internal API for TA

‹

Cryptography

‹

Trusted Storage

‹

Memory Management

‹

Equivalent functionality of what is already available

TEE Client API

‹

TEEC_InitializeContext

‹

TEEC_FinalizeContext

‹

TEEC_OpenSession

‹

TEEC_CloseSession

‹

TEEC_InvokeCommand

‹

TEEC_AllocateSharedMemory

‹

TEEC_RegisterSharedMemory

‹

TEEC_ReleaseSharedMemory

‹

TA_CreateEntryPoint

‹

TA_DestroyEntryPoint

‹

TA_OpenSessionEntryPoint

‹

TA_CloseSessionEntryPoint

‹

TA_InvokeCommandEntryPoint

Trusted Applications are multi-instance

TEE Internal API:

TEE Internal API:

Memory Mgmt.

Functions

‹

TEE_CheckMemoryAccessRights

‹

TEE_SetInstanceData

‹

TEE_GetInstanceData

‹

TEE_Malloc

‹

TEE_Realloc

‹

TEE_Free

‹

TEE_MemMove

‹

TEE_MemCompare

‹

TEE_MemFill

TEE Internal API:

Object Functions

‹

TEE_GetObjectInfo

‹

TEE_GetObjectBufferAttribute

‹

TEE_GetObjectValueAttribute

‹

TEE_CloseObject

‹

TEE_AllocateTransientObject

‹

TEE_FreeTransientObject

‹

TEE_ResetTransientObject

‹

TEE_PopulateTransientObject

‹

TEE_InitRefAttribute

‹

TEE_InitValueAttribute

‹

TEE_CopyObjectAttributes

‹

TEE_GenerateKey

‹

TEE_OpenPersistentObject

‹

TEE_CreatePersistentObject

‹

TEE_CloseAndDeletePersistentObject

‹

TEE_ReadObjectData

‹

TEE_WriteObjectData

‹

TEE_TruncateObjectData

‹

TEE_SeekObjectData

TEE Internal API:

Cryptographic

Functions

‹

TEE_MACInit

‹

TEE_MACUpdate

‹

TEE_MACComputeFinal

‹

TEE_MACCompareFinal

‹

TEE_AsymmetricEncrypt

‹

TEE_AsymmetricDecrypt

‹

TEE_AsymmetricSignDigest

‹

TEE_AsymmetricVerifyDigest

‹

TEE_GenerateRandom

‹

TEE_AllocateOperation

‹

TEE_FreeOperation

‹

TEE_GetOperationInfo

‹

TEE_SetOperationKey

‹

TEE_DigestUpdate

‹

TEE_DigestDoFinal

‹

TEE_CipherInit

‹

TEE_CipherUpdate

‹

TEE_CipherDoFinal

‹

Arndale development board

‹

http://www.arndaleboard.org

‹

Exynos 5250 SoC

‹

System or Service Provider TAs

‹

Driver development

‹

Commercial Devices

‹

Each device must be added to Trustonic test

infrastructure

‹

TA can be bundled in your APK in the /res folder

‹

We will support demos and POCs

‹

We can advise on suitable devices