论文标题
通过ARM Trustzone欺骗保护文件活动
Protecting File Activities via Deception for ARM TrustZone
论文作者
论文摘要
Trustzone Tee通常调用外部文件系统。虽然可以加密档案，但显示的文件活动可能会泄漏秘密。为了将文件活动从文件系统及其操作系统隐藏起来，我们提出了Enigma，这是一种基于欺骗的辩护，将Sybil文件活动注射为实际文件活动的封面。 Enigma贡献了三种新设计。 （1）为了使欺骗可信，TEE通过在保护中重播来自TEE代码的文件调用来生成Sybil调用。 （2）为了使SYBIL活动廉价，Tee要求OS同时运行K文件系统图像。掩盖磁盘，Tee仅通过存储元数据来备份其他图像，仅带有实际磁盘的一个图像。 （3）为了保护文件系统图像身份，T恤会经常散装图像，以防止操作系统长时间观察任何图像。 Enigma与未修改的文件系统一起运送了用来使用的文件系统。在具有EXT4和F2FS的低成本ARM SOC上，我们的系统可以同时运行多达50个文件系统图像，而每个图像则具有1％的磁盘开销。与在平坦空间中隐藏地址的常见混淆相比，Enigma隐藏了具有更丰富语义的文件活动。它的成本按一个数量级较低，同时获得了相同水平的概率安全保证。
A TrustZone TEE often invokes an external filesystem. While filedata can be encrypted, the revealed file activities can leak secrets. To hide the file activities from the filesystem and its OS, we propose Enigma, a deception-based defense injecting sybil file activities as the cover of the actual file activities. Enigma contributes three new designs. (1) To make the deception credible, the TEE generates sybil calls by replaying file calls from the TEE code under protection. (2) To make sybil activities cheap, the TEE requests the OS to run K filesystem images simultaneously. Concealing the disk, the TEE backs only one image with the actual disk while backing other images by only storing their metadata. (3) To protect filesystem image identities, the TEE shuffles the images frequently, preventing the OS from observing any image for long. Enigma works with unmodified filesystems shipped withLinux. On a low-cost Arm SoC with EXT4 and F2FS, our system can concurrently run as many as 50 filesystem images with 1% of disk overhead per additional image. Compared to common obfuscation for hiding addresses in a flat space, Enigma hides file activities with richer semantics. Its cost is lower by one order of magnitude while achieving the same level of probabilistic security guarantees.
