  In recent years, we have witnessed unprecedented growth in using
hardware-assisted Trusted Execution Environments (TEE) or enclaves to protect
sensitive code and data on commodity devices thanks to new hardware security
features, such as Intel SGX and Arm TrustZone. Even though the proprietary TEEs
bring many benefits, they have been criticized for lack of transparency,
vulnerabilities, and various restrictions. For example, existing TEEs only
provide a static and fixed hardware Trusted Computing Base (TCB), which cannot
be customized for different applications. Existing TEEs time-share a processor
core with the Rich Execution Environment (REE), making execution less efficient
and vulnerable to cache side-channel attacks. Moreover, TrustZone lacks
hardware support for multiple TEEs, remote attestation, and memory encryption.
  In this paper, we present BYOTee (Build Your Own Trusted Execution
Environments), which is an easy-to-use infrastructure for building multiple
equally secure enclaves by utilizing commodity Field Programmable Gate Arrays
(FPGA) devices. BYOTee creates enclaves with customized hardware TCBs, which
include softcore CPUs, block RAMs, and peripheral connections, in FPGA on
demand. Additionally, BYOTee provides mechanisms to attest the integrity of the
customized enclaves' hardware and software stacks, including bitstream,
firmware, and the Security-Sensitive Applications (SSA) along with their inputs
and outputs to remote verifiers. We implement a BYOTee system for the Xilinx
System-on-Chip (SoC) FPGA. The evaluations on the low-end Zynq-7000 system for
four SSAs and 12 benchmark applications demonstrate the usage, security,
effectiveness, and performance of the BYOTee framework.
