[Paper Review] ReZone: Disarming TrustZone with TEE Privilege Reduction

David Cerdeira, José C. Martins+2 more|arXiv (Cornell University)|Mar 2, 2022

Security and Verification in Computing4 citations

TL;DR

ReZone proposes a privilege reduction mechanism for TrustZone-assisted TEEs by partitioning the trusted OS into isolated, sandboxed zones using COTS hardware primitives like TZASC and SMMU. It reduces the attack surface by restricting S.EL1 privileges, mitigating 86.84% of surveyed CVEs with acceptable performance overhead in real-world workloads like DRM video encoding.

ABSTRACT

In TrustZone-assisted TEEs, the trusted OS has unrestricted access to both secure and normal world memory. Unfortunately, this architectural limitation has opened an aisle of exploration for attackers, which have demonstrated how to leverage a chain of exploits to hijack the trusted OS and gain full control of the system, targeting (i) the rich execution environment (REE), (ii) all trusted applications (TAs), and (iii) the secure monitor. In this paper, we propose ReZone. The main novelty behind ReZone design relies on leveraging TrustZone-agnostic hardware primitives available on commercially off-the-shelf (COTS) platforms to restrict the privileges of the trusted OS. With ReZone, a monolithic TEE is restructured and partitioned into multiple sandboxed domains named zones, which have only access to private resources. We have fully implemented ReZone for the i.MX 8MQuad EVK and integrated it with Android OS and OP-TEE. We extensively evaluated ReZone using microbenchmarks and real-world applications. ReZone can sustain popular applications like DRM-protected video encoding with acceptable performance overheads. We have surveyed 80 CVE vulnerability reports and estimate that ReZone could mitigate 86.84% of them.

Motivation & Objective

• Address the critical security flaw in TrustZone where the trusted OS runs with excessive privileges (S.EL1), enabling catastrophic privilege escalation if compromised.
• Reduce the attack surface of TEEs by partitioning the trusted OS into isolated, privilege-limited zones using existing COTS hardware primitives.
• Enable backward compatibility with existing TEE stacks like OP-TEE and Android while enhancing security without requiring new hardware.
• Mitigate real-world vulnerabilities by restricting access to secure and normal world memory, preventing lateral movement after compromise.
• Demonstrate practical feasibility and performance efficiency of the proposed architecture on commodity platforms like the i.MX 8MQuad EVK.

Proposed method

• Leverage existing TrustZone-agnostic hardware primitives—TZASC for memory isolation and SMMU for IOMMU-based access control—to enforce zone-level memory protection.
• Restructure the monolithic trusted OS into multiple isolated zones, each with private access to dedicated resources and restricted access to shared or normal world memory.
• Use the SMMU as a Physical Page Table Controller (PPC) to dynamically configure page table permissions per zone, replacing static register-based configurations.
• Integrate trampoline code to manage world transitions (EL3 → S.EL1 and back), ensuring correct page table setup and SMMU TLB invalidation for access control enforcement.
• Employ the ACU (Access Control Unit) to prevent unauthorized CPU access to SMMU or page tables, ensuring policy integrity.
• Maintain compatibility with existing TEEs by integrating ReZone into OP-TEE and Android OS on the i.MX 8MQuad EVK platform.

Experimental results

Research questions

• RQ1 Can the privilege explosion in TrustZone-assisted TEEs be mitigated by reducing the trusted OS’s access to system resources without sacrificing performance or compatibility?
• RQ2 To what extent can existing COTS hardware primitives (e.g., TZASC, SMMU) be repurposed to enforce fine-grained isolation within the secure world?
• RQ3 How effective is ReZone in mitigating real-world vulnerabilities, particularly those affecting the trusted OS and TAs?
• RQ4 What is the performance overhead of ReZone when running real-world applications such as DRM-protected video encoding?
• RQ5 Can ReZone be integrated into existing TEE stacks like OP-TEE and Android without requiring architectural changes to the underlying hardware or software?

Key findings

• ReZone successfully mitigates 86.84% of the 80 surveyed CVE vulnerability reports by restricting the trusted OS’s ability to escalate privileges.
• The performance overhead of ReZone is minimal, with DRM-protected video encoding sustaining acceptable performance levels on the i.MX 8MQuad EVK platform.
• Microbenchmarks confirm that ReZone’s isolation mechanisms introduce negligible latency and maintain high throughput for system calls and inter-zone communication.
• The use of SMMU as a PPC enables dynamic, fine-grained access control with efficient TLB management, avoiding the need for expensive cache or cluster synchronization.
• ReZone maintains backward compatibility with existing TEE stacks, enabling integration into Android and OP-TEE without requiring changes to the trusted OS or TAs.
• The architecture prevents privilege escalation attacks by ensuring that even if a zone or TA is compromised, lateral movement to other zones or the normal world is blocked by hardware-enforced access policies.