Plug'n'Trust: Fine-Grained USB Device Isolation for ARM TrustZone

Abstract

On millions of devices, the ARM TrustZone Trusted Execution Environment (TEE) protects the device’s most valuable secrets like cryptographic keys, even when the operating system is compromised. However, the default TrustZone model provides only coarse-grained control over USB peripherals, i.e., the TEE can either take control over the entire bus, along with all connected devices, or relinquish it entirely. This poses a significant challenge for enabling secure I/O from individual USB devices. For example, it is not possible to use a keyboard as a secure peripheral in the TEE while connecting a USB flash drive to the operating system outside the TEE. To address this limitation, we introduce TusbEE. TusbEE deploys a minimal trusted USB driver within the TEE for direct interaction with the standard xHCI USB host controller. The driver enables fine-grained control over the bus, securely partitioning traffic to isolate TEE-assigned USB devices from the remaining non-secure peripherals. Our proof-of-concept implementation on real hardware demonstrates that TusbEE achieves practical USB device isolation with a performance overhead of at most 22.7% for USB 3.0 devices. Despite this overhead, TusbEE is well-suited for security-critical use cases like secure keyboard input or biometrics, which do not rely on high throughput.

Mehr zum Titel