Three-Body Problem: An Empirical Study on Smartphone-based TEEs, TEE-based Apps, and their Interactions

Trusted Execution Environments (TEE) serve as a fundamental trust infrastructure of smartphones. By placing critical code and data inside TEE, smartphone apps ensure their confidentiality and integrity, even with a compromised outside system. However, there is a lack of studies on the usage of TEEs on smartphones. To that end, we conduct a comprehensive empirical study, demystifying smartphone-based TEEs, TEE-based apps, and their interactions. Specifically, our study answers threefold questions: (1) how are TEEs designed for smartphones, (2) what do the TEE-based apps look like, and (3) how do these apps use TEE? To answer these questions, our research investigates 17 TEE systems and more than 10,000 real-world Android apps across over 50 regular and malicious app categories. To automate the investigation, a tool that detects if an app uses TEE (i.e., TEE-based apps) has been provided. Our findings can provide practical guidance for app testers to generate valid TEE test cases, for TEE vendors to optimize their TEE solutions, and for security researchers and developers to enhance their protection mechanisms.