Trusted Execution Environment (TEE) is an effective mechanism to protect sensitive data against adversaries in automotive systems. However, its clear isolation of secured world from the normal world also restricts data sharing between the trusted and normal applications, which is desired in many modern vehicles. We propose Mimer Trust, a solution based on Mimer SQL and Trustonic TEE, to achieve fine-grained access control and efficient data sharing between the two worlds. Our solution builds up a relational storage for the secure data in TEE, which are originally stored as simple binary objects. We provide a high-level API to manipulate the secure data, and introduce SQL extensions to allow normal applications to access the TEE data with ordinary SQL statements and rich data types. Since all data access is made through the database server, privileges can be granted specifically to normal applications, which achieves fine-grained access control over the secure data. We also employ encryption of data as well as of data communication to protect the information. We explain our solution in details, and show how it is integrated in embedded system development. We demonstrate our solution on real devices, and conclude that Mimer Trust can improve the efficiency of data sharing between the secure and the normal worlds, enrich embedded application scenarios, and reduce development costs in the automotive systems.

We describe an architecture for secure, independent, interworking services (Oasis). Each service is made responsible for the classification of its clients into named roles, using a formal logic to specify precise conditions for entering each role. A client becomes authenticated by presenting credentials to a service that enable the service to prove that the client conforms to its policy for entry to a particular role. During authentication a data structure is created that embodies the proof. An authenticated client is issued a role membership certificate (RMC) for its subsequent use with that service. An RMC is an encryption-protected capability which includes the role name, the identity of the principal to which it was issued and a reference to the issuing service. A proof rule of one service may refer to an authenticated user of another; that is, an RMC issued by one service may be required as a credential during authentication by another. A dynamic proof tree may thus be built which exhibits amongst other things the trust relationships between the services which the client has entered. The paper shows how a service may define a set of proof rules (Horn clauses) that specify who may use it and in what way. Delegation of rights may be expressed naturally within these rules. It goes on to present the design details of the system. The system is inherently decentralised and has a tuneable reaction to network or server failure which allows services to make appropriate decisions when authorization or revocation information is unavailable. A prototype system has been implemented and tested.

There is a developing need for applications and distributed services to cooperate or interoperate. The article describes an architectural approach to security. The key idea is that a process is the universal client entity; a process may act on behalf of an identified individual as in traditional security schemes. More generally, a process may adopt an application specific name or role, and this is used as the basis for authentication in Oasis. A service may then be written in terms of service specific categories of clients, decoupled from the mechanisms used to specify and enforce access control policy. This approach allows great flexibility when integrating a number of services, and reduces the mismatch of policies that is common in heterogeneous systems. In addition, Oasis services may be integrated with alternative authentication and access control schemes, providing a truly open architecture. A flexible security definition is meaningless if not backed by a robust and efficient implementation. Oasis has been fully implemented, and is inherently distributed and scalable. We describe the general approach, then concentrate on revocation, where security designs are most often criticised. Oasis is unique in supporting the rapid and selective revocation of privileges which can cascade between services and organisations.