• 中国计算机学会会刊
  • 中国科技核心期刊
  • 中文核心期刊

计算机工程与科学 ›› 2022, Vol. 44 ›› Issue (03): 417-426.

• 计算机网络与信息安全 • 上一篇    下一篇

嵌入式系统安全防护方案比较与应用案例分析

陈祥国,尚凡,宋君强   

  1. (国防科技大学气象海洋学院,湖南 长沙 410073)
  • 收稿日期:2020-12-18 修回日期:2021-03-16 接受日期:2022-03-25 出版日期:2022-03-25 发布日期:2022-03-24
  • 基金资助:

Comparison among embedded system security protection schemes and their application case analysis

CHEN Xiang-guo,SHANG Fan,SONG Jun-qiang   

  1. (College of Meteorology and Oceanology,National University of Defense Technology,Changsha 410073,China)
  • Received:2020-12-18 Revised:2021-03-16 Accepted:2022-03-25 Online:2022-03-25 Published:2022-03-24

摘要: 伴随着物联网技术的发展,嵌入式系统安全防护问题已经成为当前亟需考虑并尝试解决的系统性难题。在比较多种嵌入式系统安全防护手段的基础上,深入剖析了基于硬件虚拟化技术的ARM TrustZone安全防护方案的系统组成、工作原理及设计实现要点。详细描述了TrustZone-A和TrustZone-M 2种技术的区别,并给出了2种技术的适用场景。给出了基于TrustZone技术的可信启动流程实现原理,讨论了基于TrustZone-A监控模式代码的异常程序检测实现的可行性。最后,结合典型应用场景,设计了基于TrustZone-M技术的安全防护方案及安全通信协议实现实例。

关键词: 嵌入式系统, 安全防护, 虚拟化技术, TrustZone

Abstract: Due to the development of Internet of Things technology, the security protection of embedded systems has become a systemic problem that needs to be considered and tried to be solved urgently. A variety of embedded computer system security protection methods are compared, and ARM TrustZone security protection scheme is analyzed. The main differences between the two technologies (TrustZone-A and TrustZone-M) are analyzed, and the applicable scenarios and implementation characteristics of the two solutions are given. The implementation principle of the trusted startup process based on TrustZone technology is described, and the feasibility of the implementation of abnormal program detection based on the TrustZone-A monitoring mode code is discussed. Finally, combined with typical application scenarios, a security protection scheme based on TrustZone-M technology and an implementation example of a security communication protocol are designed and proposed.

Key words: embedded system, security protection, virtualization technology, TrustZone