What is Arm® TrustZone®?
Security is becoming essential in modern embedded design. Discover how the PIC32CM-SG family uses Arm® TrustZone® to isolate sensitive functions, protect valuable data and support safer connected applications.
Arm® TrustZone® is a feature on select microcontrollers (MCUs), such as the PIC32CM-SG family of MCUs, to isolate secure hardware peripherals and memory from the rest of the system. The idea of this separation is that if an attacker manages to compromise a portion of the MCU through some type of vulnerability, the attack surface will be a lot smaller and harder to breach by isolating and blocking access to secure elements from the non-secure side. It should be noted, however, that TrustZone does not increase device security if separation is not implemented.
The way TrustZone works is by having two contexts—a secure context and a non-secure context. On startup, TrustZone enables MCUs boot in secure mode. Here, the MCU initializes the secure peripherals and other secure variables. Then, the MCU invokes the non-secure startup function call. This transitions the MCU into non-secure mode.
One way to think of architecting secure vs. non-secure code is by thinking “who/what needs to know?” Does the GUI rendering library need access to the password hash? Probably not. But it may have a valid use case for knowing the number of characters that the user has typed in. This is where a special type of function called Non-Secure Callable (NSC) comes in. NSC functions as the bridge between the non-secure and secure contexts by routing through a special region of memory. Direct access from non-secure to secure is not possible, but going through this bridge area defines allowable entry points into the secure domain.
In the example above, while the password is kept locked down, the current entered character count can be passed through the bridge area, allowing the non-secure side access to “need to know information” while minimizing the chance of compromising the secure information.
TrustZone also extends to the HW peripherals on the MCU. If a secure cryptographic co-processor is connected to SERCOM3, most parts of the application should not have access to this device. By isolating SERCOM3 on the secure side, the NSC bridges can validate any access requests and sanitize the inputs/outputs to this device.
The PIC32CM-SG also has other security features, such as TrustRAM, the Physically Unclonable Function (PUF) and a Hardware Security Module Lite (HSM-Lite). TrustRAM encrypts and scrambles data to protect sensitive secrets from attacks. However, the amount of TrustRAM is limited, so it should be reserved for only the most sensitive secrets, like cryptographical keys.
The PUF is a special hardware peripheral that can create a device-specific unique keys from the physical variations in manufacturing. This prevents anyone from being able to duplicate the same PUF.
While TrustZone seems intimidating, it’s quite intuitive with the concept of isolating data on a “need to know basis.” To get users started with TrustZone on the PIC32CM-SG family of MCUs, we recently wrote this simple example to set up “Hello World” on the PIC32CM-SG Curiosity Pro (EV53V42A), but more advanced TrustZone tutorials for the PIC32CM-SG are also available on MPLAB® Discover.