Humanoid Security Platform — Secure World mTLS Handshake

Mutual TLS 1.3 Signing Delegated to OP-TEE PKCS#11 TA

Humanoid Security Platform — Secure World mTLS Handshake Mutual TLS 1.3 Signing Delegated to OP-TEE PKCS#11 TA ClientHello (Supported TLS 1.3) ServerHello, EncryptedExtensions, Cert CertificateRequest (Mutual TLS) Server Finished Request CertificateVerify Signature (Payload Hash) TEEC_InvokeCommand(C_Sign, TokenID, KeyHandle) Return Raw Signature (r, s) [Signed in Secure SRAM] Return Formatted CertificateVerify Send Client Certificate & CertificateVerify Client Finished mTLS Handshake Complete (Secure Bi-directional RPC) 1. Server Authentication 2. Client Signing in Secure World 3. Handshake Finish & Session Active Cloud Fleet Manager · TLS 1.3 Server · Sequence participant Cloud Fleet Manager TLS 1.3 Server Robot mTLS Client · Normal World EL0 · Sequence participant Robot mTLS Client Normal World EL0 OpenSSL 3.x Provider · pkcs11-provider.so · Sequence participant OpenSSL 3.x Provider pkcs11-provider.so OP-TEE PKCS#11 TA · Secure SRAM S-EL0 · Sequence participant OP-TEE PKCS#11 TA Secure SRAM S-EL0 Legend main request return security