Arts & Sciences Events
This calendar presented by
Arts & Sciences
[PAST EVENT] How to enhance smartphone security using TrustZone?
September 25, 2015
3pm - 4pm
Abstract:
Smartphones have been widely used to process sensitive data and perform important transactions. ARM introduces TrustZone as a hardware security extension to protect secure code from insecure code by separating them into two isolated execution domains. In this talk, we introduce two of our studies on how to use TrustZone technology to enhance smartphone security. First, we propose a novel isolation framework named TrustICE to create isolated computing environments (ICEs) in the normal domain. TrustICE securely isolates the secure code in an ICE from an untrusted Rich OS in the normal domain. The trusted computing base (TCB) of TrustICE remains small and unchanged regardless of the amount of secure code being protected. Second, we develop TrustOTP, a secure onetime password solution that can achieve both the flexibility of software tokens and the security of hardware tokens by TrustZone. TrustOTP can not only protect the confidentiality of the OTPs against a malicious mobile OS, but also guarantee reliable OTP generation and trusted OTP display when the mobile OS is compromised or even crashes.
Short bio:
Kun Sun is an assistant professor at William & Mary. He received his Ph.D. in Computer Science from North Carolina State University in 2006. His research focuses on systems and network security. Dr. Sun has more than 10 years working experience in both industry and academia. Before joining W&M, he was a Research Professor in George Mason University. Before that, he was a Senior Research Scientist in Intelligent Automation Inc. at Rockville Maryland. He was a Member of the Technical Staff at Bell Labs, Lucent Technology in 2000. Majorly sponsored by ONR and ARO, his current research focuses on trustworthy computing environment, moving target defense, smart phone security, cloud security, and wireless security.
Smartphones have been widely used to process sensitive data and perform important transactions. ARM introduces TrustZone as a hardware security extension to protect secure code from insecure code by separating them into two isolated execution domains. In this talk, we introduce two of our studies on how to use TrustZone technology to enhance smartphone security. First, we propose a novel isolation framework named TrustICE to create isolated computing environments (ICEs) in the normal domain. TrustICE securely isolates the secure code in an ICE from an untrusted Rich OS in the normal domain. The trusted computing base (TCB) of TrustICE remains small and unchanged regardless of the amount of secure code being protected. Second, we develop TrustOTP, a secure onetime password solution that can achieve both the flexibility of software tokens and the security of hardware tokens by TrustZone. TrustOTP can not only protect the confidentiality of the OTPs against a malicious mobile OS, but also guarantee reliable OTP generation and trusted OTP display when the mobile OS is compromised or even crashes.
Short bio:
Kun Sun is an assistant professor at William & Mary. He received his Ph.D. in Computer Science from North Carolina State University in 2006. His research focuses on systems and network security. Dr. Sun has more than 10 years working experience in both industry and academia. Before joining W&M, he was a Research Professor in George Mason University. Before that, he was a Senior Research Scientist in Intelligent Automation Inc. at Rockville Maryland. He was a Member of the Technical Staff at Bell Labs, Lucent Technology in 2000. Majorly sponsored by ONR and ARO, his current research focuses on trustworthy computing environment, moving target defense, smart phone security, cloud security, and wireless security.