Dynamically reconfigurable TEE primitives in RISC-V SoC

Trusted Execution Environments (TEEs) provide the ability for hardware enforced isolation, enabling the protection of sensitive code and data against a potential compromise of system software including the operating system. Modern TEE implementations offer a single set of primitives e.g., memory isolation, attestation, secure I/O, cryptographic accelerators, to define and enforce trust boundaries between trusted and untrusted system components. However, static security hardware is insufficient to address the need for adaptability required by constant evolving threats and diverse application needs. To address this, the present thesis provides a dynamically reconfigurable architecture for implementing TEE primitives on RISC-V System-on-Chip (SoC) platforms, using FPGA technology offering flexible security options that can adapt to changing demands. The proposed system is based on Tarassov’s RISC-V project. The architecture is aimed to perform as an integrity monitor, verifying application code by computing and checking the hash of the .text segment. A pre-existing SHA256 cryptographic core, altered for integration with a Direct Memory Access (DMA) controller located in the static region, is employed in the reconfigurable region for hashing operations. The DMA engine performs data transfers from system memory to the cryptographic core without the processor intervention. Additionally, a user-space interface was developed to configure both the DMA and the cryptographic core through memory-mapped registers. A helper tool was also implemented to retrieve the physical memory addresses of executing program segments. This work contributes to the methodology for developing flexible reconfigurable, hardware-assisted TEEs on open RISC-V platforms. We measured our integrity primitive and observed that the DMA effectively transfers data to the SHA256 core with transfer times that increased linearly from 6msto 16ms with data sizes of 4KB to 16KB, and the SHA256 hardware accelerator consistently performed at a stable latency of 1ms. The system responds consistently and as predicted, validating the implementation of our AXI DMA architecture for memory-mapped cryptographic acceleration.