[Notes] Fortress: Securing IoT Peripherals with Trusted Execution Environments

Fortress: Securing IoT Peripherals with Trusted Execution Environments (Peterson Yuhala, Jämes Ménétrey, Pascal Felber, Marcelo Pasin, Valerio Schiavoni)

The motivation in Fortress is to extend the trust boundary from TrustZone to peripherals. MMIO/DMA regions are assigned to the secure world, and the driver is partitioned so that code touching sensitive data executes in OP-TEE’s secure kernel. Data then flows through a PTA to a user-space TA for filtering or encryption before being released to the untrusted OS or cloud. This can help protect sensor data from a compromised OS or hypervisor. Direct MMIO has little overhead; the expensive part is crossing protection boundaries with buffers—up to orders of magnitude slower in their evaluation. The broader lesson is that confidential execution alone may be insufficient when plaintext inputs traverse privileged, untrusted software before reaching the TEE.