HyperTEE: A Decoupled TEE Architecture with Secure Enclave Management

作者：Yunkai Bai, Peinan Li, Yubiao Huang, Michael Huang, Shijun Zhao, Lutan Zhao, Fengwei Zhang, Dan Meng, Rui Hou · 年份：2024 · DOI：10.1109/micro61859.2024.00018 · 被引用次数：5 · 研究领域：Cloud Computing and Resource Management、Service-Oriented Architecture and Web Services、Business Process Modeling and Analysis

Trusted Execution Environment (TEE) architectures have been deployed in various commercial processors to provide secure environments for confidential programs and data. However, as a relatively new feature against security threats, existing designs still face a number of problems. Exploiting the management vulnerabilities, attackers can disclose secrets via controlled-channel or micro-architecture side-channel attacks. To address these problems, this paper proposes a novel TEE architecture, named HyperTEE. In our architecture, enclave management tasks are decoupled from the original computing subsystem to a dedicated, physically isolated Enclave Manage-ment Subsystem (EMS). A properly architected EMS prevents current management vulnerabilities and offers more secure enclave communication. We implemented the HyperTEE prototype on the FPGA platform. Experiments show that HyperTEE only introduces less than 1% area overhead, and 2.0 % and 1.9 % performance overhead on average for enclaves and non-enclave workloads, respectively.