An Enclave-based TEE for SE-in-SoC in RISC-V Industry

Abstract

This work introduces an Enclave-based Trusted Execution Environment (TEE) designed to secure integrated Secure Elements (SE) within RISC-V Systems-on-Chip (SoC). Addressing the rising complexity and security flaws of traditional SE-in-SoC designs, the solution utilizes hardware and software co-design principles. It employs RISC-V's inherent security primitives to construct isolated enclaves, ensuring trusted execution, secure communication, and protection against side-channel attacks.

Report

Structured Report: An Enclave-based TEE for SE-in-SoC in RISC-V Industry

Key Highlights

• Core Problem Addressed: High design complexity, increased PCB cost, and persistent security risks (like malware installation and user impersonation) associated with traditional Secure Element (SE) implementations in Systems-on-Chip.
• Solution Framework: Implementation of a hardware-backed security technique, specifically an Enclave-based Trusted Execution Environment (TEE).
• Target Platform: SE-in-SoC architectures utilizing RISC-V industry platforms.
• Security Enforcement: Security relies on hardware and software co-design to achieve trusted execution and secure communication channels among various applications.
• Critical Protection Goal: Explicitly ensuring the RISC-V core is resilient to side-channel attacks and guaranteeing that the SE is exclusively controlled by a trusted enclave.

Technical Details

• Architecture Type: Enclave-based TEE.
• Isolation Mechanism: Construction of various isolated enclaves used for both application partitioning and the manipulation of the Secure Element (SE).
• Hardware Primitives: The design leverages "inherently-secure primitives provided by RISC-V" to establish the foundation of the TEE.
• SE Control: The design enforces strict policy where the SE can only be accessed and controlled by a dedicated, trusted enclave, preventing unauthorized system access or manipulation.
• Scope: The system provides isolation, secure communication, and specific defenses against physical and logical attacks (side-channel attacks, malware).

Implications

• Cost and Complexity Reduction: By integrating the SE functionality through a TEE within the SoC, this approach potentially reduces the physical complexity and PCB building cost associated with external or less integrated SE solutions.
• RISC-V Security Maturation: This solution significantly enhances the security profile of RISC-V processors, positioning the architecture as a more viable and secure option for critical embedded and IoT applications that require strong cryptographic and physical protection.
• Mitigation of Advanced Threats: Explicitly addressing side-channel attacks and malware installation provides a higher degree of assurance compared to existing SE implementations, driving trust in RISC-V-based security solutions.
• Industry Adoption: Providing a standardized, hardware-backed TEE framework accelerates the adoption of RISC-V in security-sensitive industries that traditionally rely on proprietary secure architectures.