Extending Trust to Embedded Mobile Systems
August 23, 2018
Blog
Arm-based systems are becoming ubiquitous. Make sure your security matches.
With more than 95% market share in smart phone processors, Arm, now a part of Japan's SoftBank Group, has provided compelling reasons for mobile system designers to choose its architecture. The first Windows 10 laptops and convertibles with Arm-based processors started shipping in 2018 with several leading suppliers planning to add to the product offerings. Among the claims for these devices is longer battery life and faster built-in LTE connectivity. Of course, with this connectivity comes the need for increased security and trust to prevent software attacks and/or unauthorized updates.
The Trusted Computing Group’s Trusted Platform Module (TPM) specification has been providing the basis for trust in computing and server applications for almost two decades. The latest version, TPM 2.0, also known as ISO/IEC 11889, allows for discrete, integrated, firmware, software and even virtual implementations to extend its use in mobile and embedded applications. Used to measure the code that will be executed (known as measured boot), a TPM can also authenticate and secure platforms using passwords, certificates, digital signatures, and/or encryption keys. In general, the process of securing a platform with TPM 2.0 starts with the platform system BIOS and its support of any underlying firmware.
As a replacement or enhancement for the BIOS, the Unified Extensible Firmware Interface (UEFI) spec developed by the UEFI Forum defines a new model for the interface between a computer’s operating system (OS) and platform firmware. UEFI firmware performs the equivalence of the BIOS, by initializing the platform and loading the OS. Incorporating TPM 2.0, UEFI firmware with the TCG2 protocol supports a more secure system, a faster boot time and improved performance with UEFI Secure Boot helping to defend against malware attacks before the OS loads. The processor architecture agnostic approach of UEFI firmware supports x86, x64, and Arm designs.
With the recently announced support of American Megatrends (AMI) for TPM on Arm-based systems running the company’s Aptio V UEFI Firmware, Arm implementations of UEFI received a timely boost. By extending its previous TPM support for x86 platforms, AMI gives system designers the alternative to easily use UEFI firmware in their Arm-based systems with the ability to better secure their systems and the information stored within them.
The added TPM support for Arm-based systems includes features specific to Arm, such as TPM driver support within Arm TrustZone technology and Linux OS support. The Arm TrustZone TPM can be accessed by the BIOS and OS via the Command Response Buffer interface using Secure Monitor Calls (SMC). TPM SMC communication libraries within Arm TrustZone are developed by AMI. Other generic features supported by TPM include cryptographic algorithms and measurement of SecureBoot variables.
The Chain of Trust is maintained via the TPM. The TPM is initialized at Arm Boot Stage 1, which begins the chain of trust. Between each stage, a measurement of the next stage is performed. When the AptioV bootloader is given control, the AMI TCG2 module measures the OS Bootloader.
Using UEFI as a secondary bootloader avoids the need for embedded-system designers to learn different security schemes for every silicon platform or microcontroller. TPM-enabled UEFI-based firmware solutions, such as the TCG2 module for Aptio V UEFI BIOS firmware from AMI helps establish a common standards-based way to implement secure and measured boot in next-generation Arm and other platforms.
Terry Otsubo is a technology geek at American Megatrends. He holds an MBA from Georgia State University where he learned that he would make a good accountant. When not marketing, web developing, or technical writing, he is distance running in the streets and suburbs of Atlanta.
