Building Your Own Trusted Execution Environments Using FPGA

Despite of their benefits, existing Trusted Execution Environments (TEE) or enclaves have been criticized for lack of transparency, vulnerabilities, and various restrictions. A significant limitation is that they only provide a static and fixed hardware Trusted Computing Base (TCB) that cannot be customized for different applications. The design violates the principle of least privilege by including unnecessary peripherals in the hardware TCB and buggy peripheral drivers in the software TCB. Additionally, Existing TEEs time-share a processor core with the Rich Execution Environment (REE), making execution less efficient and vulnerable to cache side-channel attacks. Although many previous projects have focused on addressing software issues in TEEs on SGX, TrustZone, or RISC-V, some TEE issues are inherent in the hardware system’s design, making them impossible to resolve with software alone. In this paper, we present BYOTee (Build Your Own Trusted Execution Environments), which is an easy-to-use hardware and software co-design infrastructure for building enclaves using Field Programmable Gate Arrays (FPGA). BYOTee creates enclaves with customized hardware TCBs and establishes a dynamic root of trust that allows untampered execution of Security-Sensitive Applications (SSA) from preexisting software on the hardcore system. Additionally, BYOTee provides mechanisms to attest the integrity of enclaves’ hardware and software stacks. We implement a BYOTee system for the Xilinx System-on-Chip (SoC) FPGA. The evaluations on the low-end Zynq-7000 system for four SSAs and 12 benchmark applications demonstrate the usage, security, effectiveness, and performance of the BYOTee framework.