Implement Android Tamper-Resistant Secure Storage and Secure it in Virtualization
summary
Implements a full software stack for tamper‑resistant Android storage using RPMB: RPMB key generation, hardware root binding, factory provisioning, and kernel/TA interfaces; encrypts data in Trusty and stores metadata in RPMB while bulk data goes to normal partitions to overcome the typical ~2 MB RPMB size. Virtualizes storage inside ACRN by creating per‑VM root subkeys and a one‑vm, two‑world model, with a virtual RPMB module that issues distinct keys per VM. Prototype integrates with Trusty and ACRN and works, but replay protection for virtual guests requires dedicated physical RPMB or multiple partitions (UFS supports up to 4).
AI-written summary · about
chapters (13)
- 0:00Intro
- 1:50Agenda Problem Statement
- 7:07Technical Details / Characteristics
- 9:42How it works (Example: authenticated write access)
- 14:20VT-TEE/Trusty in Android (Two-VM)
- 16:15Android Secure Storage (SS)
- 18:22SS/TP : Tamper-Proof Secure storage
- 20:17SS/TD: Tamper-Detection Secure storage
- 22:07ACR Hypervisor Architecture
- 29:05Secure Storage Virtualization - Confidentiality
- 29:36ACRN Hypervisor SEED/SSEK Derivation
- 31:45Conclusion
- 33:23Future Considerations
related talks
34mAuthenticated and Encrypted Storage on Embedded Linux
51mTrusted Firmware M : Secure Storage
49mBreaking Hardware-Enforced Security With Hypervisors
19mSupporting Trusted Virtual Machines with Hardware-based Secure Remote Memory
42mD1T2 - Rooting Android 8 with a Kernel Space Mirroring Attack
15mVirtualization - convenience or a threat?
39mIntegrity Protection and Access Control - Who Do You Trust?
25mA DRM solution using TZMP