Securing Mobile Systems GPS and Camera Functions Using TrustZone Framework

Mobile phone devices constantly face new vulnerabilities for attackers to exploit. Many vulnerabilities allow attackers to gain full control over the operating system and thus putting security critical operations at risk. Mobile payment systems are gaining more traction and security countermeasures cannot rely on operating systems for protection. ARM TrustZone provides hardware-based security which is often used to protect key operations. In this work, we extended TrustZone functionality to offer robust security measures for specific I/O peripherals, namely, camera and location, to any application on demand. The work mainly ensures integrity of data retrieved by the peripherals. Applications that can utilize this functionality include merchant-presented QR payment systems, location attestation for payments and other applications. The work is designed to offer seamless integration for application developers, and transparency to end users. We demonstrated functionality on custom and modified existing applications. The added overhead is within expected margins. The work provides a feasible design for industrial implementations, where the vendors installed services do not need coordination with potential application developers, and that offers flexibility for both vendors and developers.