Dicembre 1, 2019

Samsung Trusted Boot and TrustZone Integrity Management explained

Joel Snyder

When you boot up any device, that jump from a powered-down processor to a device running trusted software requires hardware support. The old Basic Input/Output System (BIOS) of over 30 years ago didn’t provide any protections — it could barely get an operating system loaded. Since then, system vendors have been trying to build more security into the boot process. Industry-standard approaches such as Unified Extensible Firmware Interface (UEFI) have set the groundwork and created best practices.

Today, smartphones need that same protection. The Android community has specified some starting points, but device vendors, such as Samsung, have built on those to bring smartphone security to “enterprise-ready” levels.

The end goal is to make sure the smartphone is running trusted software. Two components helping ensure that are secure booting with Samsung Trusted Boot and kernel integrity checking through TrustZone-based Integrity Management Architecture (TIMA).


Boot-Time Protections

Secure boot is a common Android mechanism that is used to keep Android devices from booting unapproved software. Android devices, like most computers, have a very small ROM-based primary bootloader that is used to do basic hardware initialization, find a file system with more boot software, and then load and jump into that secondary boot software.

That secondary bootloader may load the Android operating system, or jump to another bootloader, depending on the selected hardware and software. By convention, the last bootloader before the operating system is usually called aboot.

An Android phone that has secure boot technology uses digital certificates to ensure that the software loaded before the operating system is trusted. This means that it is digitally signed — and cryptographically secured against tampering — by the device vendor. Thus, the primary bootloader doesn’t just find and run the secondary bootloader file; instead, it reads the secondary bootloader and verifies a digital signature to ensure it is untampered. If the verification fails, then the boot process stops.

Signature verification and tamper checking is a standard public key infrastructure (PKI) operation: The file being verified is hashed and the hash is signed with a public/private key pair. For Samsung devices, this public/private key pair is Samsung-controlled and goes through a chain of certificates to the Samsung Secure Boot Certificate, which is loaded as part of the hardware root of trust in the platform.

This means that a Samsung phone, for example, can’t run a Motorola secondary bootloader, because the file has not been signed by Samsung.

Each bootloader in the chain, all the way up to the operating system, is responsible for verifying that the software has been digitally signed and is tamper-free. Some device vendors allow the secure boot feature to be disabled, either for developers (who might need to load unsigned experimental software) or because they want to encourage hobbyists to run their own software and operating systems.

Secure boot ensures that the chain of bootloaders hasn’t been tampered with and is signed by a trusted authority — usually the device vendor. Samsung Knox adds an enhancement called Trusted Boot, which goes a step further by taking snapshots during the boot process and storing the results in the TrustZone Trusted Execution Environment (TEE).

The goal of Trusted Boot is to ensure that older, trusted bootloaders that might have security vulnerabilities in them can’t be used, as part of the Rollback Prevention process. As the system is booting, TrustZone Trustlets check the snapshots. If they determine that an older bootloader was used, certain security-critical operations can be blocked. The security enhancements provided by Trusted Boot helped Samsung Knox 3.2 earn “strong” ratings across 27 of 30 categories in Gartner’s May 2019 report, “Mobile OSs and Device Security: A Comparison of Platforms.”


Protecting Android

While these are necessary measures, the secure boot and Trusted Boot process stop once Android is running. Checking the integrity of Android itself is handled by a built-in Android feature called device mapper verity (dm-verity) that provides integrity checking at a very low level. Samsung’s version of dm-verity includes some enhancements that make it easier for carriers to patch Android on devices using firmware over-the-air updates.

Samsung smartphones go beyond the basic Android checks with a series of Samsung proprietary security features that add integrity checking to Android, known as TIMA.

Samsung’s TIMA runs inside the TrustZone TEE, which provides a wide variety of security services, including attestation, a trusted user interface, KeyStore, Client Certificate Management and two components that are part of the TIMA real-time protections: real-time kernel protection (RKP) and periodic kernel measurement (PKM).

Security professionals like to combine both active and passive security checks to catch malicious behaviors. PKM is a passive check: It is software that runs in the TrustZone TEE regardless if anything is trying to touch the Android kernel. PKM periodically checks the kernel to detect if code or data have been modified by malicious software. PKM also checks the integrity of key data structures used by SE for Android to detect attempts to disable those security checks.

RKP is an active security check designed to block tampering with the kernel. With RKP, critical kernel events are intercepted and inspected in the TrustZone TEE. Events that impact the kernel can be blocked or logged to indicate suspected tampering. Tamper alerts are available to mobile device management (MDM) and enterprise mobility management (EMM) software, which means that checking those logs is a key task for security-minded IT managers.

TIMA combines active and passive protections and runs within the protected world of the TrustZone TEE. RKP tries to block tampering; if something gets through or around RKP, then PKM can pick it up. In either case, when a security problem is detected, IT managers can see an alert in their MDM/EMM software and proactively take action.

With both passive and active integrity checks via TIMA and the TrustZone TEE, and Samsung’s Trusted Boot technologies, Android devices have a strong, hardware-assisted security setup to create easy-to-deploy and protected hardware for today’s enterprise.

See how Samsung’s Knox platform keeps your business secure from the chip up, or learn to secure tablets and optimize them to your specific business needs using Knox Configure.

[Icon] chiudi

Comincia a utilizzare Samsung Knox

[Icona] valigia
Sei un rivenditore, un provider di soluzioni o un provider di servizi?

Diventa un partner Knox e fai crescere la tua azienda oggi.

[Icon] info

Seleziona un prodotto Knox per iniziare:

Soluzione completa
Knox Suite
Rebranding e personalizzazione
Knox Configure
Protezione da frodi e furti
Knox Guard
Piano di protezione dei dispositivi
Samsung Care+ for Business
Altri prodotti e servizi

Inizia a utilizzare

[Image] Knox Suite

Una soluzione completa in bundle, appositamente concepita per la mobilità aziendale.

  • Ottieni una prova gratuira di 90 giorni per un massimo di 30 dispositivi.
  • Un set di strumenti completo per proteggere, distribuire, gestire e analizzare i dispositivi della tua azienda.
  • Prova le straordinarie funzionalità di Knox Suite

Knox Suite comprende:

Knox Mobile Enrollment Gratuito
Knox Manage
Knox Asset Intelligence
Knox Platform for Enterprise Gratuito
Supporto remoto Knox
Knox Capture
Knox Authentication Manager

Inizia a utilizzare

[Image] Logo Knox Configure

Consenti il rebranding e la personalizzazione dei tuoi dispositivi Samsung.

  • Ottieni una prova gratuira di 90 giorni per un massimo di 30 dispositivi.
  • Configura da remoto i dispositivi Samsung in blocco e personalizzali in base alle tue esigenze specifiche per un uso immediato.
  • Configura i tuoi dispositivi per la singola distribuzione o aggiornali tutte le volte che vuoi.

Inizia a utilizzare

[Icon] Logo Knox Guard

Protezione da frodi e furti per i dispositivi Samsung.

  • Ottieni una prova gratuira di 90 giorni per un massimo di 30 dispositivi.
  • Riduci i rischi finanziari e proteggi gli asset controllando in remoto i dispositivi Samsung.
  • Prova tutte le funzionalità di Knox Guard, inclusi controllo della SIM e blocco del dispositivo.

Inizia a utilizzare

[Image] Logo Samsung Care Plus For Business

Piano di protezione per i dispositivi Samsung.

  • Limita le interruzioni delle attività con riparazioni e sostituzioni rapide dei dispositivi. Contatta l'ufficio vendite Samsung per iniziare.
  • Visualizza tutte le informazioni sulla copertura del tuo dispositivo e sul reclamo in un unico luogo.
  • Hai già acquistato Samsung Care+ for Business? Crea un account e attiva il piano nella console Samsung Care+ for Business.

Altri prodotti e servizi

[Image] Logo di altri prodotti

Soluzioni moderne per soddisfare le tue esigenze specifiche.

  • Ricevi supporto tecnico efficiente da parte di un account manager dedicato con Enterprise Tech Support.
  • Crea dispositivi su misura per la tua azienda utilizzando Samsung Software Customization Service.