Search papers, labs, and topics across Lattice.
This paper identifies a conflict between RTOS timekeeping via SysTicks and the atomicity requirements of trusted computing services in microcontroller TEEs. To resolve this, they introduce a secure-driven time synchronization mechanism where the Secure World measures elapsed time during atomic operations and compensates the Non-Secure RTOS by updating its time-keeping data structures. This approach maintains a consistent notion of time across Secure and Non-Secure worlds without RTOS modifications or significant overhead.
Guaranteeing atomicity in secure enclaves doesn't have to break real-time OS timekeeping – a secure-driven synchronization mechanism can unobtrusively keep everything in sync.
Trusted Execution Environments (TEEs) on low-power microcontrollers (e.g., ARM TrustZone-M) enable isolation of Secure and Non-Secure software but still require both worlds to share resources, including interrupt controllers. In this model, real-time applications and real-time operating systems (RTOS-s) are executed in the Non-Secure sub-system, whereas the Secure sub-system is typically reserved for a small set of pre-defined security (e.g., cryptographic) operations referred to as trusted computing services. However, many RTOS-s rely on periodic interrupts (SysTicks) to advance their own notion of time (time-keeping), and the delivery of this interrupt is essential for preserving real-time behavior. On the other hand, the security of many trusted computing services requires atomicity vis-a-vis the Non-Secure sub-system (where the RTOS resides), precluding SysTick handling. This paper first characterizes this conflict and then introduces a Secure-driven time synchronization mechanism in which the Secure World measures elapsed time and compensates the Non-Secure RTOS by unobtrusively updating the RTOS time-keeping data structures with the appropriate number of missed ticks before re-enabling interrupts and resuming the execution of the Non-Secure system. This approach restores a consistent, monotonic notion of time across worlds and enables secure coexistence of trusted computing services and RTOS-s on microcontrollers. Importantly, the proposed approach requires no modifications to the underlying RTOS and yields no significant run-time overhead.
