RISC-V Trusted Platform Module (TPM)
and Trusted Execution Environment (TEE)
Trong-Thuc Hoang and Cong-Kha Pham
University of Electro-Communications (UEC), Tokyo, Japan

Abstract. There are five pillars in cybersecurity: confidentiality, integrity, availability, authentication, and non-repudiation. It is very challenging to achieve all five requirements for a cryptosystem. In most cases, confidentiality, integrity, and authentication are the most important and most needed. Among those three, authentication has the highest priority because it lays the foundation for others to be built. For hardware devices, Trusted Platform Module (TPM) is the solution for authentication and integrity problems. The most important feature of TPM is the remote attestation. Using remote attestation, users and developers can identify a device and verify its integrity, thus proving that the device is clean. Based on TPM, other confidentiality, integrity, and availability applications can be developed. Trusted Execution Environment (TEE) is the next step after TPM. By definition, TEE is a hidden Operating System (OS) running in parallel with the primary OS, such as Linux or Windows, to guarantee the safety of some crucial programs. To put it simply, TPM is for a trusted hardware device, and TEE is for a trusted OS. TEE needs TPM to provide the Root-of-Trust (RoT). Based on the RoT, a Chain-of-Trust (CoT) is developed, thus creating TEE. In other words, RoT is the first authentication right after reset, providing a concrete foundation for TEE to be built. For security reasons, authenticating RoT should be done not only during the boot process but also by hardware, partially or entirely. However, conventional computer systems usually have proprietary issues, mainly related to processors or their Instruction Set Architectures (ISAs). Recently, with the emergence of RISC-V, an open-source ISA, now is the opportunity for hardware developers to gain the upper hand. With a highly customizable architecture and a solid open-source community, RISC-V is currently the best solution for customizing computer systems for security-related applications. This talk will provide an example design of a secure boot RISC-V computer system for TPM and TEE applications.