Namespace Tizen.Security.TEEC

The communication API for connecting Client Applications running in a rich operating environment with security related Trusted Applications running inside a Trusted Execution Environment (TEE).

Overview

A TEE provides an execution environment with security capabilities, which are either available to Trusted Applications running inside the TEE or exposed externally to Client Applications. The TEE Client API concentrates on the interface to enable efficient communications between a Client Application and a Trusted Application running inside the TEE. Higher level standards and protocol layers may be built on top of the foundation provided by the TEE Client API – for example, to cover common tasks, such as secure storage, cryptography, and run-time installation of new Trusted Applications. The separation between the rich environment and the TEE is guaranted.

The key design principles of the TEE Client API are:

  • Client-side memory allocations Where possible the design of the TEE Client API has placed the responsibility for memory allocation on the calling Client Application code. This gives the Client developer choice of memory allocation locations, enabling simple optimizations, such as stack-based allocation or enhanced flexibility using placements in static global memory or thread-local storage.

    This design choice is evident in the API by the use of pointers to structures rather than opaque handles to represent any manipulated objects.

  • Aim for zero-copy data transfer The features of the TEE Client API are chosen to maximize the possibility of zero-copy data transfer between the Client Application and the Trusted Application. However, short messages can also be passed by copy, which avoids the overhead of sharing memory.

  • Support memory sharing by pointers The TEE Client API will be used to implement higher-level APIs, such as cryptography or secure storage, where the caller will often provide memory buffers for input or output data using simple C pointers. The TEE Client API must allow efficient sharing of this type of memory, and as such does not rely on the Client Application being able to use bulk memory buffers allocated by the TEE Client API.

  • Specify only communication mechanisms This API focuses on defining the underlying communications channel. It does not define the format of the messages which pass over the channel, or the protocols used by specific Trusted Applications.

For security reasons, each device vendor usually uses their own TEE solution. If you intend your LibTeec application to be used on a real device, you must test your application on the TEE solution provided by the specific vendor. When developing and installing your trusted application, refer to the documentation provided by the vendor.

Example

The following example demonstrates how to invoke command on Trused Application.

Guid ta_uuid = new Guid("TA-guid-put-here");
Context ctx = new Context(null);
Session ses = ctx.OpenSession(ta_uuid);
Parameter[] p = { new Value(1,2,TEFValueType.In) };
ses.InvokeCommand(1, p);
ses.Close();
ctx.Dispose();

Classes

BaseParameter<TEnum>

This type defines a template for the parameter types.

Context

This type denotes a TEE Context, the main logical container linking a Client Application with a particular TEE.

LoginMethod

This type denotes the Session Login Method used in OpenSession.

Parameter

This type defines the payload of either an open session operation or an invoke command operation. It is also used for cancelation of operations, which may be desirable even if no payload is passed. Parameters are used to exchange data between CA and TA.

RegisteredMemoryReference

This type defines a memory reference that uses a pre-registered or pre-allocated shared memory block.

Session

This type denotes a TEE Session, the logical container linking a client application with a particular trusted application.

SharedMemory

This type denotes a shared memory block which has been either registered with the implementation or allocated by it.

TempMemoryReference

This type defines a temporary memory reference.

Value

This type defines a parameter that is not referencing the shared memory, but carries instead small raw data passed by a value.

Enums

SharedMemoryFlags

This type denotes the SharedMemory access direction.

TEFRegisteredMemoryType

This type denotes the SharedMemoryReference parameter.

TEFTempMemoryType

This type denotes the TempMemoryReference parameter describing a region of memory which needs to be temporarily registered for the duration of the operation.

TEFValueType

This type denotes the Value parameter.