kras99 - stock.adobe.com
Secure Enclave vs. TPM vs. HSM: What IT should know
The Secure Enclave offers hardware-isolated security for Apple devices. Learn how it compares with TPM and HSM technologies, as well as the best uses for these three approaches.
As goldmines of valuable personal and corporate data, mobile endpoints put organizations at high risk of data breaches, intellectual property theft and cyberthreats like phishing and spyware attacks.
Hardware-enabled encryption is one of the most effective ways to safeguard mobile devices -- and by extension, users and organizations -- from such unsavory incidents.
To establish strong protection in the current threat landscape, IT leaders should understand three key hardware-based approaches to mobile security: the Secure Enclave, Trusted Platform Modules (TPMs) and hardware security modules (HSMs).
Apple's Secure Enclave
First launched in September 2013 with the iPhone 5s, the Secure Enclave aimed to address iPhones' weak ability to reliably encrypt, store and secure data. This dedicated secure subsystem is now integrated into Apple's system-on-a-chip (SoC) for the latest versions of all Apple mobile devices. On these devices, it's isolated from the main CPU. This helps secure sensitive user data and ensure that the data remains inaccessible if a device is lost, stolen or compromised.
The Secure Enclave includes numerous security features:
- Dedicated processor. The processor provides the main computing power for the Secure Enclave and prevents side-channel attacks aimed at uncovering and extracting sensitive information from the iPhone.
- Memory Protection Engine. This component isolates the Secure Enclave-protected memory from the application processor, ensuring strong memory protection -- without affecting performance or increasing software complexity.
- Boot ROM. This component establishes the hardware root of trust for the Secure Enclave to securely generate cryptographic keys, cryptographically protect the Secure Enclave-protected memory and isolate sensitive data.
- Unique identifier cryptographic keys. Randomly generated and fused into the Apple SoC, a unique identifier (UID) is specific to each individual device. This helps protect device-specific secrets, including Optic ID, Face ID or Touch ID data.
- Public key accelerator. This component performs asymmetric cryptography operations based on Rivest-Shamir-Adleman (RSA) and elliptical curve cryptography (ECC) algorithms, which helps prevent side-channel and timing attacks on device information.
- Secure Storage Component. The Secure Enclave communicates with a Secure Storage Component using an encrypted and authenticated protocol. This enables it to securely access and store the entropy needed to unlock passcode-protected user data.
Together, these features provide an extra layer of security for Apple's mobile ecosystem.
Apple's Secure Enclave vs. general secure enclaves
The term "secure enclave" can cause some confusion. It's broadly used by several security vendors to indicate a way to create a secure, trusted, hardware-isolated execution environment -- also known as a subsystem -- on any device. In general, it's a broad security architecture concept, meant to separate and safeguard sensitive data, code, credentials and cryptographic keys from other system processes and thus prevent potentially risky cross-access.
Apple's Secure Enclave is one specific implementation of a secure enclave that is custom-built for Apple devices, software and services. Designed to execute only Apple's Secure Enclave Processor operating system firmware, it does not allow third-party code execution.
Some secure enclaves create isolated memory regions within the main CPU. By contrast, Apple's Secure Enclave is a dedicated and separate coprocessor built into the SoC to provide strong isolation, memory protection and secure booting. Other capabilities unique to Apple's Secure Enclave include the following:
- It has its own Advanced Encryption Standard engine to perform symmetric cryptography and prevent information leaks.
- It establishes a device-specific hardware root of trust to securely store cryptographic keys and unique identities.
- It includes a mechanism to securely store information separately from the flash memory used by the application processor and OS.
How a TPM boosts mobile security
The Secure Enclave is Apple's proprietary hardware-based security technology, and it's exclusively integrated into the SoC of Apple devices only. A TPM, on the other hand, provides hardware-based, security-related functions for devices from many other manufacturers.
Non-Apple mobile devices integrate TPM functionality within a trusted execution environment on the SoC to carry out cryptographic operations and protect sensitive device data. These operations might include:
- Generating and storing cryptographic keys and other sensitive security information.
- Limiting the use of cryptographic keys.
- Facilitating device authentication using a unique RSA key.
- Recording and storing security measurements of the boot process to ensure secure booting and maintain system integrity.
The Trusted Computing Group defines the specifications for different versions of the TPM. The latest version is TPM 2.0. This latest specification includes many additional security features that were not present in the previous version (TPM 1.2), such as the following:
- New interface. The interface supports a wider range of hash and asymmetric cryptographic algorithms, including ECC. It also offers limited support for many symmetric block ciphers.
- Unified authorization methods. A unified framework makes it possible to combine authorization capabilities. This enhances flexibility when objects are used and migrated.
- Dedicated BIOS support. A storage hierarchy controlled by the platform firmware enables all devices to benefit from the TPM's cryptographic capabilities, regardless of the OEM.
- Platform Configuration Register. This memory location in the TPM records the security measurements of a device and provides a digital fingerprint of its health and trustworthiness.
All these features make TPM 2.0 highly suitable for hardware-based encryption and secure boot validation for the non-iPhone devices into which TPM is embedded. Other use cases supported by TPM 2.0 include remote attestation, secure mobile payments and isolation of sensitive enterprise data.
How an HSM boosts mobile security
HSMs perform sensitive cryptographic operations while isolating those operations from general-purpose systems, OSes and software. This isolation prevents hackers from stealing sensitive security keys or gaining unauthorized access to devices or data. As a result, HSMs play an important role in mobile security, particularly for use cases involving mobile apps, authentication systems, financial transactions, blockchain operations and enterprise mobility platforms.
Common use cases for HSMs include the following:
- Verifying the identity of devices and users through the public key infrastructure (PKI).
- Securely issuing and validating digital signatures to verify the authenticity of software.
- Encrypting and securing the data within databases, even if a physical device is lost or stolen.
- Acting as a secure vault to safeguard cryptographic keys.
- Minimizing the risk of exposing sensitive data during a breach.
- Providing a hardware-anchored root of trust to ensure that only compliant devices can access corporate resources.
Most HSM devices include the following features to provide strong data protection:
- Secure key generation and storage. HSMs include a random number generator to create random, high-strength cryptographic keys. Their tamper-resistant hardware also ensures safe key storage and prevents unauthorized key extraction.
- Centralized, automated key management. Tasks like key rotation, backup and recovery are automated to ease key lifecycle management, regardless of the number of keys.
- Hardware-based, isolated cryptographic processing. All encryption, decryption, signing and key management operations are performed inside the secure device to prevent key exposure to the OS and apps.
- Device tampering detection. Hardened physical barriers and logical protections ensure that the HSM can detect attempts to physically probe, manipulate or tamper with the device.
Next-generation HSMs also include advanced features like automated certificate issuance and renewal, API-first designs and support for integration standards like REST. Plus, newer HSMs carry certifications to help organizations comply with strict regulatory frameworks like GDPR.
The bottom line: Secure Enclave vs. TPM vs. HSM
All three approaches provide hardware-based protection for cryptographic operations in mobile devices. But while they have similar capabilities, they differ significantly in scope.
Where to use the Secure Enclave for hardware security
The Secure Enclave can reliably handle local device tasks, such as encryption, secure booting, memory protection and secure non-volatile storage. However, its abilities are limited to Apple devices only. Also, it's not suitable for securing larger, more complex environments like data centers or massive key databases. It's not a good fit for large-scale cryptographic operations or cloud environments managing high-volume transactions, either. In all these scenarios, HSMs are a better choice.
Where to use TPMs for hardware security
TPMs are designed to boost security, strengthen boot trust and ease local key storage -- for a single device. Most TPMs are embedded within devices, making them well-suited for encrypting and decrypting sensitive data within those devices. That said, TPMs as external devices are also available.
TPMs store keys locally, can perform basic cryptographic operations and have limited key lifecycle management capabilities. If these capabilities are insufficient, IT teams and organizations should consider HSMs over TPMs or the Secure Enclave.
Where to use HSMs for hardware security
An HSM can either reside on a computer motherboard or operate as a standalone, external physical appliance, which can then be accessed through the corporate network. Major cloud providers also provide HSMs as cloud services. Examples include Google Cloud HSM, AWS CloudHSM and Microsoft Azure Cloud HSM.
Like Apple's Secure Enclave and OEM-independent TPMs, HSMs also manage secret keys and help protect mobile device data. However, HSMs also offer other more advanced capabilities, including hardware acceleration of cryptographic functions and advanced key lifecycle management.
Additionally, they provide enhanced security and higher-speed cryptographic operations. And most HSMs can integrate with enterprise apps, APIs and PKI systems. This makes them more suitable than TPMs and the Secure Enclave for use with cryptocurrency wallets and to maintain the integrity of digital certificates and electronic signatures.
Unlike the Secure Enclave and TPMs, HSMs are not tied to a single system or system family. Rather, they are accessible to any device that requires fast cryptographic operations, strong anti-tampering mechanisms and enhanced security for digital transactions.
Hardware-based encryption is a non-negotiable for enterprise security strategies. Whether an organization is managing an Apple-centric environment that uses the Secure Enclave, deploying Android or Windows devices with TPM capabilities or implementing HSMs for enterprise-wide cryptographic operations, IT must match the technology to its specific requirements and scale. Business leaders should consider the device ecosystem, compliance needs and transaction volumes to determine the right approach.
Rahul Awati is a PMP-certified project manager with IT infrastructure experience spanning storage, compute and enterprise networking.
