[Paper Review] uTango: an open-source TEE for the Internet of Things.

Daniel Oliveira, Tiago Gomes+1 more|arXiv (Cornell University)|Feb 6, 2021

Security and Verification in Computing43 references4 citations

TL;DR

uTango is the first multi-world Trusted Execution Environment (TEE) for IoT devices, leveraging TrustZone-M hardware to create multiple isolated, equally secure execution environments within the normal world. It addresses architectural flaws in existing TEEs by reusing TrustZone primitives to enhance security and extensibility, demonstrated on Arm Musca-B1 with open-sourcing planned to foster broader adoption.

ABSTRACT

Security is one of the main challenges of the Internet of Things (IoT). IoT devices are mainly powered by low-cost microcontrollers (MCUs) that typically lack basic hardware security mechanisms to separate security-critical applications from less critical components. Recently, Arm has started to release Cortex-M MCUs enhanced with TrustZone technology (i.e., TrustZone-M), a system-wide security solution aiming at providing robust protection for IoT devices. Trusted Execution Environments (TEEs) relying on TrustZone hardware have been perceived as safe havens for securing mobile devices. However, for the past few years, considerable effort has gone into unveiling hundreds of vulnerabilities and proposing a collection of relevant defense techniques to address several issues. While new TEE solutions built on TrustZone-M start flourishing, the lessons gathered from the research community appear to be falling short, as these new systems are trapping into the d\'ej\`a vu pitfalls of the past. In this paper, we present uTango, the first multi-world TEE for modern IoT devices. uTango proposes a novel architecture aiming at tackling the major architectural deficiencies currently affecting TrustZone(-M)-assisted TEEs. In particular, we leverage the very same TrustZone hardware primitives used by dual-world implementations to create multiple, equally-secure execution environments within the normal world. We demonstrate the benefits of uTango by conducting an extensive evaluation on a real TrustZone-M hardware platform, i.e., Arm Musca-B1. uTango will be open-sourced and freely available on GitHub in hopes of engaging academia and industry on securing the foreseeable trillion IoT devices.

Motivation & Objective

• Address the lack of robust hardware security mechanisms in low-cost IoT microcontrollers (MCUs).
• Overcome architectural deficiencies in existing TrustZone-M-assisted TEEs that repeat past vulnerabilities.
• Enable multiple, equally secure execution environments within the normal world using TrustZone hardware primitives.
• Provide a scalable and extensible TEE solution tailored for the trillion-device IoT ecosystem.
• Foster collaboration between academia and industry through open-sourcing uTango on GitHub.

Proposed method

• Design a novel TEE architecture that extends TrustZone-M capabilities beyond dual-world isolation to support multiple secure worlds.
• Utilize existing TrustZone hardware primitives—such as secure memory regions and exception handling—without requiring new hardware features.
• Partition the normal world into multiple isolated execution environments, each with equivalent security guarantees.
• Implement a secure world manager to mediate access between normal-world secure worlds and system resources.
• Ensure backward compatibility with existing TrustZone-M software stacks and existing MCU firmware ecosystems.
• Evaluate the design on a real Arm Musca-B1 platform to validate security and performance trade-offs.

Experimental results

Research questions

• RQ1 Can multiple isolated, equally secure execution environments be created within the normal world using only TrustZone-M hardware primitives?
• RQ2 How does the proposed multi-world TEE architecture mitigate known architectural weaknesses of existing dual-world TEEs?
• RQ3 What is the performance overhead of uTango compared to traditional dual-world TEEs on real IoT hardware?
• RQ4 To what extent can uTango be integrated into existing MCU firmware stacks without requiring hardware extensions?
• RQ5 How does uTango’s design improve long-term maintainability and extensibility for future IoT security needs?

Key findings

• uTango successfully creates multiple isolated execution environments within the normal world using only TrustZone-M hardware primitives.
• The architecture avoids the security and complexity pitfalls of traditional dual-world TEEs by eliminating a single, privileged secure world.
• Evaluation on the Arm Musca-B1 platform confirms that uTango maintains strong isolation guarantees with acceptable performance overhead.
• The design enables backward compatibility with existing TrustZone-M software, easing integration into current IoT ecosystems.
• uTango’s open-sourcing is expected to accelerate research and industrial adoption for securing the next generation of IoT devices.
• The multi-world model enhances extensibility and reduces the attack surface compared to monolithic secure worlds.