Sandrine Bailleux | 545f4b6 | 2023-09-06 16:11:12 +0200 | [diff] [blame] | 1 | Threat Model for TF-A with Arm CCA support |
| 2 | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ |
| 3 | |
| 4 | Introduction |
| 5 | ************ |
| 6 | |
| 7 | This document provides a threat model of TF-A firmware for platforms with Arm |
| 8 | Realm Management Extension (RME) support which implement Arm Confidential |
| 9 | Compute Architecture (Arm CCA). |
| 10 | |
| 11 | Although it is a separate document, it references the :ref:`Generic Threat |
| 12 | Model` in a number of places, as some of the contents is commonly applicable to |
| 13 | TF-A with or without Arm CCA support. |
| 14 | |
| 15 | Target of Evaluation |
| 16 | ******************** |
| 17 | |
| 18 | In this threat model, the target of evaluation is the Trusted Firmware for |
| 19 | A-class Processors (TF-A) with RME support and Arm CCA support. This includes |
| 20 | the boot ROM (BL1), the trusted boot firmware (BL2) and the runtime EL3 firmware |
| 21 | (BL31). |
| 22 | |
| 23 | Assumptions |
| 24 | =========== |
| 25 | |
| 26 | We make the following assumptions: |
| 27 | |
| 28 | - :ref:`Realm Management Extension (RME)` is enabled on the platform. |
| 29 | |
| 30 | - Arm CCA Hardware Enforced Security (HES) is available on the platform, as |
| 31 | recommended by `Arm CCA security model`_: |
| 32 | |
| 33 | *[R0004] Arm strongly recommends that all implementations of CCA utilize* |
| 34 | *hardware enforced security (CCA HES).* |
| 35 | |
| 36 | - All TF-A images run from on-chip memory. Data used by these images also live |
| 37 | in on-chip memory. This means TF-A is not vulnerable to an attacker that can |
| 38 | probe or tamper with off-chip memory. |
| 39 | |
| 40 | These are requirements of the `Arm CCA security model`_: |
| 41 | |
| 42 | *[R0147] Monitor code executes entirely from on-chip memory.* |
| 43 | |
| 44 | *[R0149] Any monitor data that may affect the CCA security guarantee, other* |
| 45 | *than GPT, is either held in on-chip memory, or in external memory but with* |
| 46 | *additional integrity protection.* |
| 47 | |
| 48 | Note that this threat model hardens *[R0149]* requirement by forbidding to |
| 49 | hold data in external memory, even if it is integrity-protected - except for |
| 50 | GPT data. |
| 51 | |
| 52 | - TF-A BL1 image is immutable and thus implicitly trusted. It runs from |
| 53 | read-only memory or write-protected memory. This could be on-chip ROM, on-chip |
| 54 | OTP, locked on-chip flash, or write-protected on-chip RAM for example. |
| 55 | |
| 56 | This is a requirement of the `Arm CCA security model`_: |
| 57 | |
| 58 | *[R0158] Arm recommends that all initial boot code is immutable on a* |
| 59 | *secured system.* |
| 60 | |
| 61 | *[R0050] If all or part of initial boot code is instantiated in on-chip* |
| 62 | *memory then other trusted subsystems or application PE cannot modify that* |
| 63 | *code before it has been executed.* |
| 64 | |
| 65 | - Trusted boot and measured boot are enabled. This means an attacker can't boot |
| 66 | arbitrary images that are not approved by platform providers. |
| 67 | |
| 68 | These are requirements of the `Arm CCA security model`_: |
| 69 | |
| 70 | *[R0048] A secured system can only load authorized CCA firmware.* |
| 71 | |
| 72 | *[R0079] All Monitor firmware loaded by PE initial boot is measured and* |
| 73 | *verified as outlined in Verified boot.* |
| 74 | |
| 75 | - No experimental features are enabled. These are typically incomplete features, |
| 76 | which need more time to stabilize. Thus, we do not consider threats that may |
| 77 | come from them. It is not recommended to use these features in production |
| 78 | builds. |
| 79 | |
| 80 | Data Flow Diagram |
| 81 | ================= |
| 82 | |
| 83 | Figure 1 shows a high-level data flow diagram for TF-A. The diagram shows a |
| 84 | model of the different components of a TF-A-based system and their interactions |
| 85 | with TF-A. A description of each diagram element is given on Table 1. On the |
| 86 | diagram, the red broken lines indicate trust boundaries. Components outside of |
| 87 | the broken lines are considered untrusted by TF-A. |
| 88 | |
laurenw-arm | 5421208 | 2023-12-08 15:00:07 -0600 | [diff] [blame] | 89 | .. uml:: ../../resources/diagrams/plantuml/tfa_arm_cca_dfd.puml |
Sandrine Bailleux | 545f4b6 | 2023-09-06 16:11:12 +0200 | [diff] [blame] | 90 | :caption: Figure 1: Data Flow Diagram |
| 91 | |
| 92 | .. table:: Table 1: Data Flow Diagram Description |
| 93 | |
| 94 | +-----------------+--------------------------------------------------------+ |
| 95 | | Diagram Element | Description | |
| 96 | +=================+========================================================+ |
| 97 | | DF1 | | Refer to DF1 description in the | |
| 98 | | | :ref:`Generic Threat Model`. Additionally TF-A | |
| 99 | | | loads realm images. | |
| 100 | +-----------------+--------------------------------------------------------+ |
| 101 | | DF2-DF6 | | Refer to DF2-DF6 descriptions in the | |
| 102 | | | :ref:`Generic Threat Model`. | |
| 103 | +-----------------+--------------------------------------------------------+ |
| 104 | | DF7 | | Boot images interact with Arm CCA HES to record boot | |
| 105 | | | measurements and retrieve data used for AP images | |
| 106 | | | authentication. | |
| 107 | | | | |
| 108 | | | | The runtime firmware interacts with Arm CCA HES to | |
| 109 | | | obtain sensitive attestation data for the realm | |
| 110 | | | world. | |
| 111 | +-----------------+--------------------------------------------------------+ |
| 112 | | DF8 | | Realm world software (e.g. TF-RMM) interact with | |
| 113 | | | TF-A through SMC call interface and/or shared | |
| 114 | | | memory. | |
| 115 | +-----------------+--------------------------------------------------------+ |
| 116 | |
| 117 | Threat Analysis |
| 118 | *************** |
| 119 | |
| 120 | In this threat model, we use the same method to analyse threats as in the |
| 121 | :ref:`Generic Threat Model`. This section only points out differences where |
| 122 | applicable. |
| 123 | |
| 124 | - There is an additional threat agent: *RealmCode*. It takes the form of |
| 125 | malicious or faulty code running in the realm world, including R-EL2, R-EL1 |
| 126 | and R-EL0 levels. |
| 127 | |
| 128 | - At this time we only consider the ``Server`` target environment. New threats |
| 129 | identified in this threat model will only be given a risk rating for this |
| 130 | environment. Other environments may be added in a future revision |
| 131 | |
| 132 | Threat Assessment |
| 133 | ================= |
| 134 | |
| 135 | General Threats for All Firmware Images |
| 136 | --------------------------------------- |
| 137 | |
| 138 | The following table analyses the :ref:`General Threats` in the context of this |
| 139 | threat model. Only deltas are pointed out. |
| 140 | |
| 141 | +----+-------------+-------------------------------------------------------+ |
| 142 | | ID | Applicable? | Comments | |
| 143 | +====+=============+=======================================================+ |
| 144 | | 05 | Yes | | |
| 145 | +----+-------------+-------------------------------------------------------+ |
| 146 | | 06 | Yes | | |
| 147 | +----+-------------+-------------------------------------------------------+ |
| 148 | | 08 | Yes | Additional diagram element: DF8. | |
| 149 | | | | | |
| 150 | | | | Additional threat agent: RealmCode. | |
| 151 | +----+-------------+-------------------------------------------------------+ |
| 152 | | 11 | Yes | | Misconfiguration of the Memory Management Unit | |
| 153 | | | | (MMU) may allow a **normal/secure/realm** world | |
| 154 | | | | software to access sensitive data, execute arbitrary| |
| 155 | | | | code or access otherwise restricted HW interface. | |
| 156 | | | | | |
| 157 | | | | | **Note that on RME systems, MMU configuration also | |
| 158 | | | | includes Granule Protection Tables (GPT) setup.** | |
| 159 | | | | | |
| 160 | | | | | Additional diagram elements: DF4, DF7, DF8. | |
| 161 | | | | | |
| 162 | | | | | Additional threat agents: SecCode, RealmCode. | |
| 163 | +----+-------------+-------------------------------------------------------+ |
| 164 | | 13 | Yes | Additional diagram element: DF8. | |
| 165 | | | | | |
| 166 | | | | Additional threat agent: RealmCode. | |
| 167 | +----+-------------+-------------------------------------------------------+ |
| 168 | | 15 | Yes | Additional diagram element: DF8. | |
| 169 | | | | | |
| 170 | | | | Additional threat agent: RealmCode. | |
| 171 | +----+-------------+-------------------------------------------------------+ |
| 172 | |
| 173 | Threats to be Mitigated by the Boot Firmware |
| 174 | -------------------------------------------- |
| 175 | |
| 176 | The following table analyses the :ref:`Boot Firmware Threats` in the context of |
| 177 | this threat model. Only deltas are pointed out. |
| 178 | |
| 179 | +----+-------------+-------------------------------------------------------+ |
| 180 | | ID | Applicable? | Comments | |
| 181 | +====+=============+=======================================================+ |
| 182 | | 01 | Yes | Additional diagram element: DF8. | |
| 183 | | | | | |
| 184 | | | | Additional threat agent: RealmCode. | |
| 185 | +----+-------------+-------------------------------------------------------+ |
| 186 | | 02 | Yes | Additional diagram element: DF8. | |
| 187 | | | | | |
| 188 | | | | Additional threat agent: RealmCode. | |
| 189 | +----+-------------+-------------------------------------------------------+ |
| 190 | | 03 | Yes | | |
| 191 | +----+-------------+-------------------------------------------------------+ |
| 192 | | 04 | Yes | | |
| 193 | +----+-------------+-------------------------------------------------------+ |
| 194 | |
| 195 | Threats to be Mitigated by the Runtime EL3 Firmware |
| 196 | --------------------------------------------------- |
| 197 | |
| 198 | The following table analyses the :ref:`Runtime Firmware Threats` in the context |
| 199 | of this threat model. Only deltas are pointed out. |
| 200 | |
| 201 | +----+-------------+-------------------------------------------------------+ |
| 202 | | ID | Applicable? | Comments | |
| 203 | +====+=============+=======================================================+ |
| 204 | | 07 | Yes | Additional diagram element: DF8. | |
| 205 | | | | | |
| 206 | | | | Additional threat agent: RealmCode. | |
| 207 | +----+-------------+-------------------------------------------------------+ |
| 208 | | 09 | Yes | Additional diagram element: DF8. | |
| 209 | | | | | |
| 210 | | | | Additional threat agent: RealmCode. | |
| 211 | +----+-------------+-------------------------------------------------------+ |
| 212 | | 10 | Yes | Additional diagram element: DF8. | |
| 213 | | | | | |
| 214 | | | | Additional threat agent: RealmCode. | |
| 215 | +----+-------------+-------------------------------------------------------+ |
| 216 | | 12 | Yes | Additional diagram element: DF8. | |
| 217 | | | | | |
| 218 | | | | Additional threat agent: RealmCode. | |
| 219 | +----+-------------+-------------------------------------------------------+ |
| 220 | | 14 | Yes | | |
| 221 | +----+-------------+-------------------------------------------------------+ |
| 222 | |
laurenw-arm | 5421208 | 2023-12-08 15:00:07 -0600 | [diff] [blame] | 223 | *Copyright (c) 2023-2024, Arm Limited. All rights reserved.* |
Sandrine Bailleux | 545f4b6 | 2023-09-06 16:11:12 +0200 | [diff] [blame] | 224 | |
| 225 | .. _Arm CCA Security Model: https://developer.arm.com/documentation/DEN0096/A_a |