ARM announced a new version of its ARMv8 architecture, after releasing ARMv8-A for mobile devices and ARMv8-R for real-time applications. The new architecture is called ARMv8-M and will target the microcontroller market.
Thanks to the new ARMv8-M architecture, all future microcontrollers built on it will have access to TrustZone, which is the "secure world" that keeps important data isolated from the main operating system and apps.
The TrustZone solution includes trusted software that's well-audited, trusted hardware with secure access for validation, hardware assist for cryptography, secure system, secure storage for things like private keys or fingerprint templates, and a true random number generator.
The technology has mainly been found in Cortex-A mobile processors thus far, but it seems ARM has recognized that such security solutions should be available throughout its entire range of processor designs. The demand for increased security has become larger in the past few years in most chip markets, whether it's mobile, PC, IoT or the microcontroller market.
TrustZone can be used to enhance security for biometric authentication, mobile payments, content protection, and enterprise solutions (such as Samsung's Knox).
The TrustZone extensions for ARMv8-M will simplify the security assessment of embedded devices and will also enable containerization of software, which should make that software more modular and more secure.
Unlike ARMv8-A (mobile), where the communication channel goes from the secure app, to the secure OS, to the secure monitor, and finally to the non-secure OS and apps, the communication between secure apps and non-secure apps on ARMv8-M is more direct for efficiency purposes (although this could weaken the security guarantees compared to the more complex solution in ARMv8-A).
ARM also announced the AMBA 5 AHB5 bus protocol, which extends security to the whole SoC. The CPU, flash, SRAM and peripherals can all be connected securely.
ARM has begun to approach security in a more holistic way, by focusing on three main areas:
Lifecycle security, which is given by an mbed Device ServerCommunications security, given by the mbed TLS library, which provides encryption and authentication, assisted by the CryptoCell component in TrustZoneDevice security, which can provide secure identity, software identity, isolation and tamper detection. These can be enforced by TrustZone, CryptoCell, mbed OS, and ARM's SecureCore processor for tamper resistance.
Much like ARMv8-R for real-time applications, ARMv8-M comes with support for protected memory. The architecture is also optimized for microcontroller applications, which is why it supports only the Thumb instruction set to keep code sizes small.
ARMv8-M will have two subprofiles: Baseline and Mainline. Baseline can be used for the lowest-cost and smallest implementations, whereas Mainline is for more general purpose microcontrollers, is more scalable, and supports DSP and floating-point extensions.
______________________________________________________________________
Lucian Armasu joined Tom’s Hardware in early 2014. He writes news stories on mobile, chipsets, security, privacy, and anything else that might be of interest to him from the technology world. Outside of Tom’s Hardware, he dreams of becoming an entrepreneur.
You can follow him at @lucian_armasu. Follow us on Facebook, Google+, RSS, Twitter and YouTube.
