# Webkey OS

### Software Design

<figure><img src="https://2390781907-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxnN6Cwxl5ZEBL4idTAzK%2Fuploads%2FqsiZ8Vu2h6sgMGTwqtRP%2Fimage.png?alt=media&#x26;token=3df50d9b-2693-4281-b3db-349ea74ca946" alt=""><figcaption></figcaption></figure>

The following categories of operations are provided:&#x20;

Generate keys&#x20;

Import and export asymmetric keys (without key wrapping)&#x20;

Import raw symmetric keys (without key wrapping)&#x20;

Asymmetric encryption and decryption using appropriate padding modes&#x20;

Asymmetric signing and verification using digests and appropriate padding modes&#x20;

Symmetric encryption and decryption in appropriate modes (including AEAD modes)&#x20;

Generate and verify symmetric message authentication codes

Four elements of TEE&#x20;

TEE implements the following common functions:&#x20;

verifiable launch and remote attestation: trusted launch and remote attestation&#x20;

runtime isolation/memory curtaining:&#x20;

runtime isolation trusted l/O: end-to-end encryption, privileged devices, etc.&#x20;

secure storage/sealing: persistent data encryption and decryption&#x20;

TEE hardware should be able to provide the following functions:

1. When loading software, measure the software and provide a hardware-signed proof report (QUOTE/REPORT) to the remote verifier (verifier) ​​to prove the validity of the TEE hardware and the integrity of the software.
2. Protect data runtime security through isolation and encryption (in-use)
3. Enable trusted communication between software in TEE and external devices (in-transit)
4. Provide hardware-derived keys based on software measurement values ​​so that software can encrypt and persist data (at-rest)

### TEE Architecture and Components

TEE NSdrv: Kernel driver Responsible for the communication between the normal world application and the secure world Integrated into Linux as a kernel module in the form of source code

TEE Daemon: System resident service Handles file system, TA file loading and other requests Integrated into the system image in the form of a binary executable file, located in the /vendor partition

TEE Client lib: TEE client application dynamic library Common application links that call TEE functions, located in the /vendor partition

TKCored SPD: • Integrated into ATF in the form of source code

TEE kernel T6: TEE kernel • Provided in binary form • Packaged with the Bootloader as an image, or occupy a separate partition.

TA: Security application, integrated into the system image as a binary file

<figure><img src="broken-reference" alt=""><figcaption></figcaption></figure>
