Architectures for Security: A comparative analysis of hardware security features in Intel SGX and ARM TrustZone

Abstract

A variety of applications are executing on a large untrusted computing base, which includes the operating system, hypervisor, firmware, and hardware. This large computing base is becoming complex and unverifiable. This untrusted computing base problem opens a way for a malicious application to steal secrets of a security-critical application by compromising the untrusted computing base. To resolve the untrusted computing base problem, computer architectures have introduced a concept of the trusted execution environment, which aim to ensure the sensitive data to be stored and processed in an isolated environment. Existing popular trusted execution environments are relying on hardware to isolate the environments without or minimum relying on system software. However, existing hardware assisted trusted execution environments are still vulnerable to sophisticated attacks. This paper analyses popular trusted execution environments that are Intel SGX and ARM TrustZone in order to provide better insights about the intended scope of the protection. This paper illustrates the functionality, implementation and security analysis.