Secure Services
Introduction
The Reference Software Stack provides the implementation of Secure Services through the Primary Compute. These services are aligned to the following specifications:
PSA Crypto API: The API provides a portable programming interface to cryptographic operations, and key storage functionality on a wide range of hardware.
PSA Secure Storage API: The API provides key/value storage interfaces for use with device-protected storage. The Secure Storage API describes two interfaces for storage:
Internal Trusted Storage (ITS) API: An interface for storage provided by the Platform Root of Trust (PRoT).
Protected Storage (PS) API: An interface for external protected storage.
PSA Attestation API: The Attestation service securely collects device state information and generates a signed report of claims for remote verification. The API provides a portable programming interface to Initial Attestation operations.
Primary Compute Secure Services
On Primary Compute, the Crypto Service, Secure Storage Service and Attestation Service can be requested using SE Proxy SP.
The Primary Compute also provides the implementation of UEFI SMM Services via the SMM Gateway Secure Partition (SMM Gateway SP) to support UEFI System Management Mode (SMM).
These Secure Services are provided by the Trusted Services project, and implemented by leveraging the TrustZone technology in the Primary Compute and the hardware-isolated secure enclave in RSE.
The Reference Software Stack provides the implementation of Secure Services through Primary Compute.
Architecture
The following diagram shows the components and data flow that implement the Primary Compute Secure Services.
PSA APIs Tests
The PSA Protected Storage, PSA Internal Trusted Storage, PSA Initial Attestation and PSA Crypto APIs tests can be accessed from the Primary Compute Linux terminal by running a single command for each. The test suites take around a minute to execute, and a table of results is displayed upon completion.
See PSA APIs Tests in Primary Compute for more information.
libts
In Linux userspace, the Secure Services are provided in the form of
libts API. libts is a library that is provided by
Trusted Services for handling service discovery and
Remote Procedure Call (RPC) messaging. libts entirely decouples client
applications from details of where a service provider is deployed and how to
communicate with it.
The client application sends operation requests and receives responses by
calling the libts API. libts communicates with the
Secure Partition (SP) running in the Secure world.
The communication between libts and the Secure world SP is carried by the
Arm Firmware Framework for Arm A-profile (FF-A) call which is supported by Linux kernel and
Trusted Firmware-A.
SE-Proxy SP
The Secure Enclave Proxy Secure Partition (SE Proxy SP) is a proxy partition managed by OP-TEE. It provides access to services hosted by the RSE.
The SE-Proxy SP receives Secure Service operation requests from the Normal
world, translates the request parameters to IPC calls, and invokes the runtime
services provided by the RSE. The IPC is carried by Message Handling Unit
(MHUv3) communication between the Primary Compute and the RSE.
SMM Gateway SP
The System Management Mode Gateway Secure Partition (SMM Gateway SP) serves as a gateway for the variable storage required by the implementation of UEFI Boot and Runtime Services APIs. These UEFI variables are stored in the Protected Storage Service provided by the RSE.
The data flow to store UEFI variables is presented in the diagram at the beginning of the Architecture section. The U-Boot implementation of the UEFI subsystem uses the FF-A driver to communicate with the UEFI SMM Services in the SMM Gateway SP. The backend of the SMM services uses the Protected Storage proxy from the SE Proxy SP. From there on, the Protected Storage calls are forwarded to the secure enclave as explained above.