Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

On Practicality of Using ARM TrustZone Trusted Execution Environment for Securing Programmable Logic Controllers

Zhiang Li, Daisuke Mashima, Wen Shei Ong, Ertem Esiner, Zbigniew Kalbarczyk, Ee-Chien Chang

TL;DR

The aim is to evaluate the feasibility and practicality of the TEE-based PLCs through the proof-of-concept design and implementation using open-source software such as OP-TEE and OpenPLC, and assesses the performance and resource consumption in real-world ICS configurations.

Abstract

Programmable logic controllers (PLCs) are crucial devices for implementing automated control in various industrial control systems (ICS), such as smart power grids, water treatment systems, manufacturing, and transportation systems. Owing to their importance, PLCs are often the target of cyber attackers that are aiming at disrupting the operation of ICS, including the nation's critical infrastructure, by compromising the integrity of control logic execution. While a wide range of cybersecurity solutions for ICS have been proposed, they cannot counter strong adversaries with a foothold on the PLC devices, which could manipulate memory, I/O interface, or PLC logic itself. These days, many ICS devices in the market, including PLCs, run on ARM-based processors, and there is a promising security technology called ARM TrustZone, to offer a Trusted Execution Environment (TEE) on embedded devices. Envisioning that such a hardware-assisted security feature becomes available for ICS devices in the near future, this paper investigates the application of the ARM TrustZone TEE technology for enhancing the security of PLC. Our aim is to evaluate the feasibility and practicality of the TEE-based PLCs through the proof-of-concept design and implementation using open-source software such as OP-TEE and OpenPLC. Our evaluation assesses the performance and resource consumption in real-world ICS configurations, and based on the results, we discuss bottlenecks in the OP-TEE secure OS towards a large-scale ICS and desired changes for its application on ICS devices. Our implementation is made available to public for further study and research.

On Practicality of Using ARM TrustZone Trusted Execution Environment for Securing Programmable Logic Controllers

TL;DR

The aim is to evaluate the feasibility and practicality of the TEE-based PLCs through the proof-of-concept design and implementation using open-source software such as OP-TEE and OpenPLC, and assesses the performance and resource consumption in real-world ICS configurations.

Abstract

Programmable logic controllers (PLCs) are crucial devices for implementing automated control in various industrial control systems (ICS), such as smart power grids, water treatment systems, manufacturing, and transportation systems. Owing to their importance, PLCs are often the target of cyber attackers that are aiming at disrupting the operation of ICS, including the nation's critical infrastructure, by compromising the integrity of control logic execution. While a wide range of cybersecurity solutions for ICS have been proposed, they cannot counter strong adversaries with a foothold on the PLC devices, which could manipulate memory, I/O interface, or PLC logic itself. These days, many ICS devices in the market, including PLCs, run on ARM-based processors, and there is a promising security technology called ARM TrustZone, to offer a Trusted Execution Environment (TEE) on embedded devices. Envisioning that such a hardware-assisted security feature becomes available for ICS devices in the near future, this paper investigates the application of the ARM TrustZone TEE technology for enhancing the security of PLC. Our aim is to evaluate the feasibility and practicality of the TEE-based PLCs through the proof-of-concept design and implementation using open-source software such as OP-TEE and OpenPLC. Our evaluation assesses the performance and resource consumption in real-world ICS configurations, and based on the results, we discuss bottlenecks in the OP-TEE secure OS towards a large-scale ICS and desired changes for its application on ICS devices. Our implementation is made available to public for further study and research.
Paper Structure (28 sections, 10 figures, 3 tables)

This paper contains 28 sections, 10 figures, 3 tables.

Table of Contents

  1. Introduction
  2. Background
  3. Industrial Control Systems (ICS) Overview
  4. PLC Overview
  5. ARM TrustZone
  6. Threat Models and Security Goals
  7. System Model
  8. Attack Surface and Threat Models
  9. Security Goals
  10. TEE-PLC Design
  11. Preliminary Design
  12. Enhanced TEE-PLC Design
  13. Security Discussion on Enhanced TEE-PLC
  14. Prototype Implementation
  15. Scan-cycle TA
  16. ...and 13 more sections

Figures (10)

  • Figure 1: PLC Architecture & Scan Cycle
  • Figure 2: ARM TrustZone TEE Architecture
  • Figure 3: Data Flow & Threat Model against PLC Scan Cycle
  • Figure 4: Minimal TEE-PLC Architecture
  • Figure 5: Enhanced TEE-PLC Architecture
  • ...and 5 more figures