DITING: A Static Analyzer for Identifying Bad Partitioning Issues in TEE Applications

• URL: http://arxiv.org/abs/2502.15281v2
• Date: Thu, 10 Jul 2025 01:57:15 GMT
• Title: DITING: A Static Analyzer for Identifying Bad Partitioning Issues in TEE Applications
• Abstract summary: Bad partitioning can lead to critical security problems of TEE applications.<n>We propose an approach to detect partitioning issues in TEE applications.<n>DITING achieves an F1 score of 0.90 in identifying bad partitioning issues.
• Score: 19.01661737501544
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Trusted Execution Environment (TEE) enhances the security of mobile applications and cloud services by isolating sensitive code in the secure world from the non-secure normal world. However, TEE applications are still confronted with vulnerabilities stemming from bad partitioning. Bad partitioning can lead to critical security problems of TEE, such as leaking sensitive data to the normal world or being adversely affected by malicious inputs from the normal world. To address this, we propose an approach to detect partitioning issues in TEE applications. First, we conducted a survey of TEE vulnerabilities caused by bad partitioning and found that the parameters exchanged between the secure and normal worlds often contain insecure usage with bad partitioning implementation. Second, we developed a tool named DITING that can analyze data-flows of these parameters and identify their violations of security rules we defined to find bad partitioning issues. Different from existing research that only focuses on malicious input to TEE, we assess the partitioning issues more comprehensively through input/output and shared memory. Finally, we created the first benchmark targeting bad partitioning, consisting of 110 test cases. Experiments demonstrate that DITING achieves an F1 score of 0.90 in identifying bad partitioning issues.

Related papers

• MATEE: Efficiently Bridging the Semantic Gap in TrustZone via Arm Pointer Authentication [5.630589990430752]
  Arm TrustZone partitions the system into the secure and normal (non-secure) worlds.<n>This results in the secure world having very limited visibility into the operating information of the normal world.<n>We propose a mate system for the TEE called MATEE to defend against Semantic Gap Vulnerabilities (SGVs)
  arXiv  Detail & Related papers  (2026-08-20T21:33:06Z)
• Automated Repair of TEE Partitioning Issues via DSL-Guided and LLM-Assisted Patching [14.771108131886566]
  We present TEERepair, a framework for automatically repairing bad partitioning issues in TEE applications.<n>Our approach tackles the above challenges by introducing domain-specific language (LLMs) to encode repair rules.<n>We then leverage large language models (LLMs) to synthesize context-aware patches, and further generate test clients to validate the repairs.
  arXiv  Detail & Related papers  (2026-05-21T07:27:28Z)
• TÄMU: Emulating Trusted Applications at the (GlobalPlatform)-API Layer [20.44030366449458]
  Mobile devices rely on Trusted Execution Environments (TEEs) to execute security-critical code and protect assets.<n>The closed-source nature and fragmentation of mobile TEEs severely hinder dynamic analysis of TAs.<n>This paper presents TMU, a rehosting platform enabling dynamic analysis of TAs.
  arXiv  Detail & Related papers  (2026-01-28T11:34:06Z)
• Why Does the LLM Stop Computing: An Empirical Study of User-Reported Failures in Open-Source LLMs [50.075587392477935]
  We conduct the first large-scale empirical study of 705 real-world failures from the open-source DeepSeek, Llama, and Qwen ecosystems.<n>Our analysis reveals a paradigm shift: white-box orchestration relocates the reliability bottleneck from model algorithmic defects to the systemic fragility of the deployment stack.
  arXiv  Detail & Related papers  (2026-01-20T06:42:56Z)
• Reputation-based partition scheme for IoT security [21.32565499244062]
  Crowdsensing is an emerging data aggregation paradigm, which plays a pivotal role in data-driven applications.<n>There are some key issues in the development of crowdsensing such as platform security and privacy protection.<n>An effective reputation-based partition scheme (RSPC) is proposed in this article.
  arXiv  Detail & Related papers  (2025-08-06T00:27:59Z)
• VWAttacker: A Systematic Security Testing Framework for Voice over WiFi User Equipments [10.566986981707501]
  VWAttacker is a framework for analyzing the security of Voice over WiFi (VoWiFi) User Equipment (UE) implementations.<n>It uses property-guided adversarial testing to uncover security issues in different UEs systematically.<n>It extracts 63 properties from 11 specifications, evaluates 1,116 testcases, and detects 13 issues in 21 UEs.
  arXiv  Detail & Related papers  (2025-08-02T19:37:57Z)
• Qualcomm Trusted Application Emulation for Fuzzing Testing [0.3277163122167433]
  This research centers on trusted applications (TAs) within the Qualcomm TEE.<n>Through reverse engineering techniques, we develop a partial emulation environment that accurately emulates their behavior.<n>We integrate fuzzing testing techniques into the emulator to systematically uncover potential vulnerabilities within Qualcomm TAs.
  arXiv  Detail & Related papers  (2025-07-11T06:10:15Z)
• Advancing Neural Network Verification through Hierarchical Safety Abstract Interpretation [52.626086874715284]
  We introduce a novel problem formulation called Abstract DNN-Verification, which verifies a hierarchical structure of unsafe outputs.<n>By leveraging abstract interpretation and reasoning about output reachable sets, our approach enables assessing multiple safety levels during the formal verification process.<n>Our contributions include a theoretical exploration of the relationship between our novel abstract safety formulation and existing approaches.
  arXiv  Detail & Related papers  (2025-05-08T13:29:46Z)
• Towards Secure Program Partitioning for Smart Contracts with LLM's In-Context Learning [20.539980206615105]
  Smart contracts are highly susceptible to manipulation attacks due to the leakage of sensitive information.<n>We present PartitionGPT, the first LLM-driven approach that combines static analysis with the in-context learning capabilities of large language models.<n>We evaluate PartitionGPT on nine real-world manipulation attacks that lead to a total loss of 25 million dollars.
  arXiv  Detail & Related papers  (2025-02-20T03:07:56Z)
• SoftPatch+: Fully Unsupervised Anomaly Classification and Segmentation [84.07909405887696]
  This paper is the first to consider fully unsupervised industrial anomaly detection (i.e., unsupervised AD with noisy data) We propose memory-based unsupervised AD methods, SoftPatch and SoftPatch+, which efficiently denoise the data at the patch level. Compared with existing methods, SoftPatch maintains a strong modeling ability of normal data and alleviates the overconfidence problem in coreset. Comprehensive experiments conducted in diverse noise scenarios demonstrate that both SoftPatch and SoftPatch+ outperform the state-of-the-art AD methods on the MVTecAD, ViSA, and BTAD benchmarks.
  arXiv  Detail & Related papers  (2024-12-30T11:16:49Z)
• TRUST: A Toolkit for TEE-Assisted Secure Outsourced Computation over Integers [30.72930396939045]
  We propose a toolkit for TEE-assisted (Trusted Execution Environment) SOC over integers, named TRUST.<n>In terms of system architecture, TRUST falls in a single TEE-equipped cloud server only through seamlessly integrating the computation of REE (Rich Execution Environment) and TEE.<n>We present textttSEAT, secure data trading based on TRUST.
  arXiv  Detail & Related papers  (2024-12-02T03:19:29Z)
• GNN-Based Code Annotation Logic for Establishing Security Boundaries in C Code [41.10157750103835]
  Securing sensitive operations in today's interconnected software landscape is crucial yet challenging. Modern platforms rely on Trusted Execution Environments (TEEs) to isolate security sensitive code from the main system. Code Logic (CAL) is a pioneering tool that automatically identifies security sensitive components for TEE isolation.
  arXiv  Detail & Related papers  (2024-11-18T13:40:03Z)
• A Comprehensive Study on Static Application Security Testing (SAST) Tools for Android [22.558610938860124]
  VulsTotal is a unified evaluation platform for defining and describing tools' supported vulnerability types. We select 11 free and open-sourced SAST tools from a pool of 97 existing options, adhering to clearly defined criteria. We then unify 67 general/common vulnerability types for Android SAST tools.
  arXiv  Detail & Related papers  (2024-10-28T05:10:22Z)
• Towards Secure and Private AI: A Framework for Decentralized Inference [14.526663289437584]
  Large multimodal foundational models present challenges in scalability, reliability, and potential misuse.<n>Decentralized systems offer a solution by distributing workload and mitigating central points of failure.<n>We address these challenges with a comprehensive framework designed for responsible AI development.
  arXiv  Detail & Related papers  (2024-07-28T05:09:17Z)
• Safe Inputs but Unsafe Output: Benchmarking Cross-modality Safety Alignment of Large Vision-Language Model [73.8765529028288]
  We introduce a novel safety alignment challenge called Safe Inputs but Unsafe Output (SIUO) to evaluate cross-modality safety alignment.<n>To empirically investigate this problem, we developed the SIUO, a cross-modality benchmark encompassing 9 critical safety domains, such as self-harm, illegal activities, and privacy violations.<n>Our findings reveal substantial safety vulnerabilities in both closed- and open-source LVLMs, underscoring the inadequacy of current models to reliably interpret and respond to complex, real-world scenarios.
  arXiv  Detail & Related papers  (2024-06-21T16:14:15Z)
• SoftPatch: Unsupervised Anomaly Detection with Noisy Data [67.38948127630644]
  This paper considers label-level noise in image sensory anomaly detection for the first time. We propose a memory-based unsupervised AD method, SoftPatch, which efficiently denoises the data at the patch level. Compared with existing methods, SoftPatch maintains a strong modeling ability of normal data and alleviates the overconfidence problem in coreset.
  arXiv  Detail & Related papers  (2024-03-21T08:49:34Z)
• ASSERT: Automated Safety Scenario Red Teaming for Evaluating the Robustness of Large Language Models [65.79770974145983]
  ASSERT, Automated Safety Scenario Red Teaming, consists of three methods -- semantically aligned augmentation, target bootstrapping, and adversarial knowledge injection. We partition our prompts into four safety domains for a fine-grained analysis of how the domain affects model performance. We find statistically significant performance differences of up to 11% in absolute classification accuracy among semantically related scenarios and error rates of up to 19% absolute error in zero-shot adversarial settings.
  arXiv  Detail & Related papers  (2023-10-14T17:10:28Z)
• ScionFL: Efficient and Robust Secure Quantized Aggregation [36.668162197302365]
  We introduce ScionFL, the first secure aggregation framework for federated learning. It operates efficiently on quantized inputs and simultaneously provides robustness against malicious clients. We show that with no overhead for clients and moderate overhead for the server, we obtain comparable accuracy for standard FL benchmarks.
  arXiv  Detail & Related papers  (2022-10-13T21:46:55Z)
• Log Barriers for Safe Black-box Optimization with Application to Safe Reinforcement Learning [72.97229770329214]
  We introduce a general approach for seeking high dimensional non-linear optimization problems in which maintaining safety during learning is crucial. Our approach called LBSGD is based on applying a logarithmic barrier approximation with a carefully chosen step size. We demonstrate the effectiveness of our approach on minimizing violation in policy tasks in safe reinforcement learning.
  arXiv  Detail & Related papers  (2022-07-21T11:14:47Z)
• Exploring Robustness of Unsupervised Domain Adaptation in Semantic Segmentation [74.05906222376608]
  We propose adversarial self-supervision UDA (or ASSUDA) that maximizes the agreement between clean images and their adversarial examples by a contrastive loss in the output space. This paper is rooted in two observations: (i) the robustness of UDA methods in semantic segmentation remains unexplored, which pose a security concern in this field; and (ii) although commonly used self-supervision (e.g., rotation and jigsaw) benefits image tasks such as classification and recognition, they fail to provide the critical supervision signals that could learn discriminative representation for segmentation tasks.
  arXiv  Detail & Related papers  (2021-05-23T01:50:44Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.