Jiewen Yao

At present, major companies are launching their own confidential computing solutions, which pose significant challenges to users. This book summarizes the common designs of various mainstream TEE hardware, and explains their commonalities to help understand the working principles of TEE hardware, facilitating users to define TEE usage scenarios through abstract commonalities. Confidential Computing: Principles and Technology comprehensively introduces the design principles and usage methods of TEE in terms of security models, lifecycle, attestation models, attack methods, and mitigation strategies, helping readers understand the security attributes and implementation points of confidential computing. At the same time, this book takes the TEE provided by the mainstream X86, ARM, and RISC-V architectures in the industry as examples to analyze the specific implementation methods and similarities and differences of hardware TEE, helping users deeply understand the advantages and disadvantages of different implementations, and hoping to provide some inspiration for future TEE software and hardware designers.

Use this book to build secure firmware. As operating systems and hypervisors have become successively more hardened, malware has moved further down the stack and into firmware. Firmware represents the boundary between hardware and software, and given its persistence, mutability, and opaqueness to today’s antivirus scanning technology, it represents an interesting target for attackers. As platforms are universally network-connected and can contain multiple devices with firmware, and a global supply chain feeds into platform firmware, assurance is critical for consumers, IT enterprises, and governments. This importance is highlighted by emergent requirements such as NIST SP800-193 for firmware resilience and NIST SP800-155 for firmware measurement. This book covers the secure implementation of various aspects of firmware, including standards-based firmware—such as support of the Trusted Computing Group (TCG), Desktop Management Task Force (DMTF), and UnifiedExtensible Firmware Interface (UEFI) specifications—and also provides code samples and use cases. Beyond the standards, alternate firmware implementations such as ARM Trusted Firmware and other device firmware implementations (such as platform roots of trust), are covered. What You Will Learn Get an overview of proactive security development for firmware, including firmware threat modelingUnderstand the details of architecture, including protection, detection, recovery, integrity measurement, and access controlBe familiar with best practices for secure firmware development, including trusted execution environments, cryptography, and language-based defensesKnow the techniques used for security validation and maintenanceWho This Book Is ForGiven the complexity of modern platform boot requirements and the threat landscape, this book is relevant for readers spanning from IT decision makers to developers building firmware