Lines Matching refs:of
10 .. _Target of Evaluation:
13 Target of Evaluation
16 In this threat model, the target of evaluation is the Trusted
19 shown on Figure 1. Everything else on Figure 1 is outside of the scope of
39 The :ref:`Threat Model for TF-A with Arm CCA support` covers these types of
52 shows a model of the different components of a TF-A-based system and
53 their interactions with TF-A. A description of each diagram element
55 trust boundaries. Components outside of the broken lines
78 | | to registers and memory of TF-A. |
102 In this section we identify and provide assessment of potential threats to TF-A
108 that represents the impact and likelihood of that threat. We also discuss
123 | | of Trust Public Key) or see (e.g. secure logs, |
139 in scope of this threat model.
165 considered out-of-scope.
168 chip, notably those like Power Analysis Attacks, are out-of-scope. Power
169 analysis side-channel attacks represent a category of security threats that
181 or more of these types: ``Spoofing``, ``Tampering``, ``Repudiation``,
182 ``Information disclosure``, ``Denial of service`` or
183 ``Elevation of privilege``.
189 from *informational* to *critical* is given based on the likelihood of the
190 threat occurring if a mitigation is not in place, and the impact of the
192 rating in terms of score, impact and likelihood.
202 | | | | Knowledge of the threat |
209 | | line of business if | exploit by an attacker |
213 | | line of business if | or expert attacker could|
240 aggregate risk score of eight (8); that is, four (4) for high likelihood
261 The likelihood and impact of a threat depends on the
264 they are more common in Internet of Things(IoT) environments.
266 ``Internet of Things(IoT)``, ``Mobile`` and ``Server``.
272 each diagram element of the data flow diagram.
277 rely on the platform code to implement some bits of it. This threat model aims
287 As our :ref:`Target of Evaluation` is made of several, distinct firmware images,
288 some threats are confined in specific images, while others apply to each of
302 | | | During the development stages of software it is |
303 | | common to print all sorts of information on the |
306 | | information of the CPU state, current registers |
361 | | use the appropriate level of verbosity so as |
392 | | Elevation of privilege |
408 | | | Configuration of debug and trace capabilities is |
416 | | lack of boundary checking when accessing resources |
419 | | flow of the program, or leak sensitive |
425 | | | Some of the errors include integer overflow, |
428 | | Improper use of asserts instead of proper input |
429 | | validations might also result in these kinds of |
442 | | Elevation of Privilege |
464 | | programming errors in debug builds. Other types of |
470 | | of relying on asserts in release builds. |
473 | | TF-A uses a combination of manual code reviews |
488 | Threat | | **Misconfiguration of the Memory Management Unit |
494 | | | A misconfiguration of the MMU could |
509 | Threat Type | Information Disclosure, Elevation of Privilege |
520 | | principle of least privilege ought to be |
534 | | low-level details of MMU configuration. It |
537 | | risk of misconfiguration. |
581 | Threat | | **Improper handling of input data received over |
585 | | | The consequences of the attack depend on the |
586 | | the exact usage of input data received over UART. |
587 | | Examples are injection of arbitrary data, |
589 | | execution path, denial of service (if using |
601 | Threat Type | Tampering, Information Disclosure, Denial of |
602 | | service, Elevation of privilege. |
631 | | of implemented methods in the system to infer |
634 | | | A timing side-channel attack is a type of attack |
637 | | form of attack focuses on analyzing the time- |
639 | | the execution of cryptographic algorithms or |
642 | | insights into the internal workings of a system |
667 | Mitigations | | Ensure that the execution time of critical |
668 | | operations is constant and independent of |
674 | | operations to make the timing behavior of program|
720 | Threat Type | Tampering, Elevation of Privilege |
794 | Threat | | **An attacker can use Time-of-Check-Time-of-Use |
798 | | | Time-of-Check-Time-of-Use (TOCTOU) threats occur |
801 | | in the middle of the off-chip images, they could |
815 | Threat Type | Elevation of Privilege |
830 | | | The list of images to load and their location is |
847 | | | TF-A relies on a chain of trust that starts with the|
849 | | the root of all validation processes. If an attacker|
850 | | can break this chain of trust, they could execute |
853 | | attacking the normal execution flow of the |
867 | Threat Type | Tampering, Elevation of Privilege |
894 .. topic:: Measured Boot Threats (or lack of)
901 - The configuration data of the above components
904 well as the criticality of this data can vary. In most cases, these attributes
907 - Image measurement: the digest value of a component produced by a hash
909 - Signer-id: the digest value of the image verification publiy key. The
910 verification public key is part of the image metadata.
919 The current Measured Boot design consists of two main parts. A frontend, which
922 of these are implemented by the |TF-A| projects, while others are part of
926 the Event Log which is located on the secure on-chip memory of the AP. The
927 address of the Event Log buffer is handed off between boot stages and new
928 measurements are appended to the Event Log. A limitation of the current
930 measurements into a |PCR| of a Discrete |TPM|, where measurements would
932 - Discrete |TPM|: Implemented in |TF-A| as a proof of concept, the Discrete
935 |TPM|, which provides a hardware-backed root of trust. The measurements in
936 the Event Log can now be hashed and compared to the value of the |PCR| to
937 determine if tampering of the Event Log has taken place.
944 against unauthorized access by malicious actors through the use of one-time
945 context handles and the identification of the client's target locality
946 (location of the client).
952 When considering the implementation of Measured Boot using a TCG-compliant
954 Platforms have many different ways of integrating a discrete TPM, and these
961 it is the responsibility of the platform owners to address this based on their
962 specific threat model. Mitigation of this can be achieved through dedicated
973 capabilities of their platform and choose an appropriate Measured Boot
985 | Threat | | **An attacker can perform a denial-of-service |
1004 | Threat Type | Denial of Service |
1045 | Threat Type | Information disclosure, Denial of Service |
1075 | | use this kind of attack to leak sensitive |
1114 | Threat | | **Incorrect configuration of Performance Monitor |
1158 | | | Configuration of debug signals is platform |
1167 Threats to be Mitigated by an External Agent Outside of TF-A
1194 | | Elevation of privilege |