It’s TEEtime: Secure Interrupt Isolation for Normal-world Enclaves on Arm

Authors: Friederike Groschupp, Mark Kuhne, Moritz Schneider, Ivan Puddu, Shweta Shinde, and Srdjan Čapkun
IACR Transactions on Cryptographic Hardware and Embedded Systems
Outstanding Cybersecurity Contribution Award at 5th anniversary of Cyber-Defence Campus
PDF
Project

Abstract

Secure and direct peripheral access is an important building block for protecting sensitive applications on mobile and embedded devices: Otherwise, an untrusted OS or hypervisor can, for example, trivially intercept an app’s secrets when it renders them or restrict an app’s functionality by limiting the way it can interface with a peripheral. While Arm TrustZone supports secure peripheral access, its design choices limit the flexible deployment of apps in the secure world. Recent TEE designs address this by isolating applications outside the secure world, but at the cost of secure peripheral access. We propose TEEtime, a novel system that gives software running in normal-world isolated execution environments (domains) direct and secure peripheral access by relying on existing Arm TrustZone mechanisms and the secure monitor for enforcement. TEEtime introduces interrupt isolation as a novel key primitive; we design a fine-grained interrupt isolation framework for Armv8-A. We prototype TEEtime on Arm’s FVP simulator and on the Purism Librem 5 phone, showcasing a Signal messenger app running alongside an untrusted OS.

Research Area: Trusted Computing

People

Friederike Groschupp
Doctoral Student

BibTex

@article{groschupp2026teetime,
  author    = {Groschupp, Friederike and Kuhne, Mark and Schneider, Moritz and Puddu, Ivan and Shinde, Shweta and Capkun, Srdjan},
  title     = {{It's TEEtime: Secure Interrupt Isolation for Normal-world Enclaves on Arm}},
  booktitle = {IACR Transactions on Cryptographic Hardware and Embedded Systems},
  year      = 2026,
  month     = feb,
  publisher = {Ruhr-Universit{\"{a}}t Bochum},
  doi       = {10.46586/TCHES.V2026.I1.135-160},
  url       = {https://www.research-collection.ethz.ch/bitstream/handle/20.500.11850/795632/TCHES2026_1_06.pdf}
}

Research Collection: 20.500.11850/795632