抗板级物理攻击的持久存储方法研究

Research on Persistent Storage Method Against Board-Level Physical Attacks

为保护文件系统的安全性,提出一种抗板级物理攻击的持久存储方法。利用ARM TrustZone技术构建持久存储架构,实现内存保护机制和持久存储保护服务,提高文件系统的物理安全性。基于片上内存(OCM)在可信执行环境(TEE)中的内核层建立内存保护机制,保证TEE的可信应用能够抵抗板级物理攻击。基于TEE的内存保护机制实现保护文件系统中敏感数据的持久存储保护服务,确保文件系统的机密性和完整性。在物理开发板上实现持久存储架构的原型系统,使用基准测试工具对原型系统进行性能评估,并分析性能损耗的原因。测试结果表明,内存保护机制在保护TEE系统物理安全性时引入的时间开销会随着OCM的增大而减小,持久存储保护服务在保护数据量较小的敏感数据时产生的时间开销在用户可接受范围内。

In order to protect the security of the file system,this paper presents a persistent storage method against board-level physical attacks.Utilizing the ARM TrustZone technology,we build a persistent storage architecture that provides a memory protection mechanism and a persistent storage protection service and improves the physical security of the file system.Based on On-Chip Memory(OCM),a memory protection mechanism is built at the kernel level of the Trusted Execution Environment(TEE),and it ensures that trusted applications of TEE can resist board-level physical attacks.Based on the above memory protection mechanism of TEE,a persistent storage protection service is realized for protecting sensitive data in file systems,which can provide confidentiality and integrity protection to the file system.Finally,we implement a prototype system on a physical development board,use benchmark test tools to evaluate its performance,and analyze the cause for its overhead.The test results show that the overhead introduced by the memory protection mechanism in protecting the physical security of the TEE system decreases with the increase of the OCM,and the overhead of the persistent storage protection service when protecting a small amount of sensitive data is within the acceptable range of users.