基于TrustZone的智能手机安全技术研究与实现

发布时间：2019-05-16 16:54

【摘要】：智能终端在生活和工作的不同场景中扮演着非常重要的角色,越来越多的用户个人隐私存储其中。保障数据安全的问题变得尤为突出,用户往往通过设定相应的密码来验证身份来防止数据泄漏的意外发生。不过为提高密码的安全强度,用户就不得不记忆复杂的密码和执行频繁的密码输入等诸多行为,因此大大影响了用户的体验。不过伴随生物识别技术的快速应用推广,其方便快捷的特性得到了广泛的认可。譬如,指纹识别技术正在快速的应用于智能终端领域,替代传统的密码验证方式,采用识别比对用户的指纹信息来安全快速的实现身份验证行为。因此,如何确保指纹识别的安全性,保证识别过程安全可靠的问题也日益凸显出来。目前出现的一个可信执行环境(Trusted Execution Environment,TEE)的概念,旨在为可信应用程序提供安全执行环境。其中该安全执行环境的概念可以从三种机制中实现,包括Intel的TXT及AMD的SVM均可提供安全执行环境;ARM Trust Zone安全技术,直接在CPU上提供非安全区域和安全区域的隔离机制;Hypervisor/VMM虚拟化机制,提供安全应用与非安全应用之间的隔离。嵌入式平台中广泛使用的ARM处理器提供了Trust Zone的安全扩展机制,将SOC软硬资源划分为操作关键资源的可信执行环境和操作其它资源的普通执行环境(Rich Execution Environment,REE),旨在从处理器硬件架构的基础上搭建安全框架,从而确保设备抵御众多的潜在威胁。本文旨在解决智能终端领域所存在的诸多安全问题,结合ARM Trust Zone安全扩展技术,并根据生物特性的指纹识别思想,提出了一种基于Trust Zone的指纹识别安全框架,为指纹识别应用提供可信执行环境,防止潜在恶意程序的攻击确保指纹识别过程的安全可靠,同时为了确保指纹信息的安全性,提供受Trust Zone保护的用于指纹数据及特征安全加密的密钥,以保证其不被窃取。此外,设计实现了指纹数据的安全传输通道及其通讯协议,确保指纹传输过程的安全性。最后方案设计并且实现了一个原型系统,借助于实验的方式验证该方案的有效性,其实验结果也证明了本文所提技术和方法的可行性。
[Abstract]:Intelligent terminals play a very important role in different scenes of life and work, and more users store them in their personal privacy. The problem of ensuring data security has become particularly prominent. Users often use the corresponding password to verify the identity to prevent the accidental occurrence of data leakage. However, in order to improve the security intensity of passwords, users have to remember complex passwords and execute frequent password inputs, which greatly affects the user experience. However, with the rapid application and popularization of biometric technology, its convenient and fast characteristics have been widely recognized. For example, fingerprint identification technology is rapidly applied to the field of intelligent terminals, replacing the traditional password verification method, using identification comparison to the user's fingerprint information to achieve secure and fast authentication behavior. Therefore, the problem of how to ensure the security of fingerprint recognition and ensure the safety and reliability of the recognition process is becoming more and more prominent. The concept of a trusted execution environment (Trusted Execution Environment,TEE) is designed to provide a secure execution environment for trusted applications. The concept of secure execution environment can be implemented from three mechanisms, including TXT of Intel and SVM of AMD, which can provide secure execution environment; ARM Trust Zone security technology, and provide isolation mechanism of non-secure area and secure area directly on CPU. Hypervisor/VMM virtualization mechanism, which provides isolation between secure and insecure applications. ARM processor, which is widely used in embedded platform, provides a security extension mechanism of Trust Zone, which divides SOC soft and hard resources into trusted execution environment for operating key resources and common execution environment for operating other resources (Rich Execution Environment,REE). The purpose of this paper is to build a security framework based on processor hardware architecture to ensure that devices resist many potential threats. The purpose of this paper is to solve many security problems in the field of intelligent terminal. Combined with ARM Trust Zone security extension technology, and according to the idea of fingerprint recognition based on biological characteristics, a fingerprint recognition security framework based on Trust Zone is proposed. It provides a trusted execution environment for fingerprint identification applications, prevents attacks by potential malicious programs to ensure the security of fingerprint identification process, and at the same time, in order to ensure the security of fingerprint information, Provide Trust Zone protected keys for fingerprint data and feature security encryption to ensure that they are not stolen. In addition, the secure transmission channel and communication protocol of fingerprint data are designed and implemented to ensure the security of fingerprint transmission process. Finally, a prototype system is designed and implemented, and the effectiveness of the scheme is verified by experiments. The experimental results also prove the feasibility of the proposed technology and method.
【学位授予单位】：电子科技大学
【学位级别】：硕士
【学位授予年份】：2016
【分类号】：TN929.53

【相似文献】