Question:How to implement access restriction for a TA to PTA.

[vahidd1]

Hi,

I have my CA <-> TA <-> PTA communication. In this scenario other CA can also communicate with PTA if the UUID and supported commands know to CA.

I want to restrict the access from CA to PTA directly. Only my TA needs to communicate with PTA and if any other TA wants to talk to PTA, PTA should reject commands (called via TEE_InvokeTACommand).

Currently I am using tee_ta_get_calling_session(); & is_user_ta_ctx() calls to identify the source of caller.
If call is coming from CA, I am right away reject access.

However in PTA I am comparing the UUID of caller TA to decide if its my TA. And accept the command and process it. But if its not my TA I’m rejecting the command.

I wanted to check is there any other cleaner way to implement it. So that I don’t need to hard code the TA’s UUID for comparison.

Thanks

[vahidd1]

Any inputs on above query.

[jbech-linaro]

Hi @sddev-coder ,

Maybe not exactly what you are asking about, but you'll find a discussion around related questions in #3092 and OP-TEE/manifest#137. Then also @dashemsec have just sent a proof of concept just a couple of days ago, see #3407. If this is inline with your questions, then feel free to chime on on those threads.

[github-actions]

This issue has been marked as a stale issue because it has been open (more than) 30 days with no activity. Remove the stale label or add a comment saying that you would like to have the label removed otherwise this issue will automatically be closed in 5 days. Note, that you can always re-open a closed issue at any time.