A gem5 based Platform for Micro-Architectural Security Analysis
Résumé
In this article we present a simulation platform based on gem5 for security analysis. On top of gem5’s architectural exploration and performance estimation capability, our platform permits attacks on ARM Trustzone, security evaluation of cypto libraries, and attacks from accelerators or 3rd party IPs present in the SoC. We discuss various components of our platform such as GDB, gem5, SystemC TLM 2.0 and the steps to boot an open source trusted execution environment called OPTEE. We present an in-vitro experimental attack in Syscall mode on the mbedTLS library and we show how this attack can be fine-tuned. We also present two in-vivo attacks on OPTEE on the RSA signing Trustlet and the Secure Storage Trustlet to demonstrate the capabilities and usage of our platform