Embedded Trusted Execution Environments (TEEs) can provide strong security for software in the IoT or in critical control systems. Approaches to combine this security with real-time and availability guarantees are currently missing. In this paper we present Aion, a configurable security architecture that provides a notion of guaranteed real-time execution for dynamically loaded enclaves. We implement preemptive multitasking and restricted atomicity on top of strong software isolation and software attestation. Our approach allows the hardware to enforce confidentiality and integrity protections while a decoupled small software component can enforce availability and guarantee strict deadlines of a bounded number of protected applications, without introducing a notion of priorities amongst these applications. We implement a prototype on a light-weight TEE processor and provide a case study. Our implementation can guarantee that protected applications can handle interrupts and make progress with deterministic activation latencies, even in the presence of a strong adversary with arbitrary code execution capabilities.

Please email for a Zoom link

Fritz is a 3rd year PhD candidate at imec-DistriNet at KU Leuven, Belgium, in the group of Frank Piessens and Jan Tobias Mühlberg. His main focus is on improving the guarantees of TEEs and extending their applicability across the computing spectrum. Earlier work includes SGX cloud deployments and TEE vulnerabilities in the application binary layer. Most recently, he worked on real-time availability guarantees for embedded TEEs.