Mobile Platform Security Architectures A perspective on their evolution
|
|
- Domenic Hudson
- 8 years ago
- Views:
Transcription
1 Mobile Platform Security Architectures A perspective on their evolution N. Asokan Kari Kostiainen 1 NA, KKo, JEE, Nokia Resarch Center
2 Introduction Recent interest in smartphone security 2 NA, KKo, JEE, Nokia Resarch Center Jan 2011?
3 Introduction Recent interest in smartphone security 3 Oct 2012
4 Securing smartphone application platforms: challenges Introduction Smartphones Open software platforms Third party software Internet connectivity Packet data, WiFi Personal data Location, contacts, communication log Risk of monetary loss Premium calls Feature phones Java ME PCs? Is smartphone platform security different? 4
5 Outline Outline A bit of background on requirements for securing mobile phones Basics on hardware security enablers Comparison of modern mobile (software) platform security architectures Discussion: open issues and summary 5
6 6 Background
7 Platform security requirements for mobile phones Mobile network operators; 1. Subsidy locks immutable ID 2. Copy protection device authentication, app. separation 3. Regulators; 1. RF type approval secure storage 2. Theft deterrence immutable ID 3. Background End users; 1. Reliability app. separation 2. Theft deterrence immutable ID 3. Privacy app. separation 4. Closed Open Different Expectations compared to the PC world 7
8 Early adoption of hardware and software security GSM 02.09, 1993 Background 3GPP TS , 2001 Different starting points: widespread use of hardware and software platform security ~2001 ~2002 ~2005 ~2008 8
9 9 Hardware security enablers
10 Hardware support for platform security Hardware security Public key hash Trust root Base identity E.g., serial number Crypto Library Boot sequence (ROM) TCB for platform software Start of boot code Basic elements in immutable storage 10
11 Secure bootstrapping Hardware security Code certificate Boot code hash Trust root Base identity Validate and execute Crypto Library Secure boot Boot sequence (ROM) TCB for platform software Ensure only authorized boot image can be loaded Launch platform boot code 11
12 Identity binding Hardware security Identity certificate Base identity Code certificate Boot code hash Assigned identity E.g., IMEI, link-layer addresses, Trust root Base identity Secure boot Crypto Library Boot sequence (ROM) TCB for platform software Validate and accept assigned ID Securely assign different identities to the device Launch platform boot code 12
13 Trusted execution environment (TEE) Hardware security Identity certificate Base identity Assigned identity Code certificate Boot code hash Code certificate Validate and execute TEE code hash Why? How? Isolated execution Trust root Base identity TEE Crypto Library Device key Basis for secure external storage Secure boot Boot sequence (ROM) TEE code TCB for platform software Launch platform boot code TEE API 13 Authorized execution of arbitrary code, isolated from the OS; access to device key
14 Secure state Hardware security Identity certificate Base identity Assigned identity Code certificate Boot code hash Code certificate TEE code hash Authenticated boot Trust root Crypto Library Base identity Configuration register(s) Device key TEE Secure boot Boot sequence (ROM) TEE code TCB for platform software Launch platform boot code TEE API 14
15 Secure boot vs Authenticated boot Hardware security OS Kernel checker pass/fail OS Kernel measurer Boot block checker pass/fail Boot block measurer Boot seq. checker pass/fail Boot seq. measurer state Trust root TCB TCB Root of Trust for measurement 15
16 Secure state Hardware security Identity certificate Base identity Assigned identity Code certificate Boot code hash Code certificate TEE code hash Authenticated boot, Securing TEE sessions Trust root Base identity Configuration register(s) TEE Why? How? Secure boot Crypto Library Boot sequence (ROM) Device key TEE code Non-vol. memory or counter TCB for platform software Launch platform boot code TEE API Rollback protection for persistent secure storage 16 Integrity-protected state within the TEE
17 Device authentication Identity certificate Code certificate Base identity Assigned identity Boot code hash Code certificate TEE code hash External trust root Device certificate Identity Public device key Hardware security Trust root Secure boot Crypto Library Base identity Boot sequence (ROM) TCB for platform software Configuration register(s) Device key TEE code TEE Device authentication, secure provisioning, attestation Non-vol. memory or counter 17 Launch platform boot code TEE API Prove device identity or properties to external verifier
18 Hardware platform security features: summary Hardware security Secure boot: Ensure only authorized boot image can be loaded Authenticated boot: Measure and remember what boot image was loaded Identity binding: Securely assign different identities to the device Secure storage: protect confidentiality/integrity of persistent data Isolated execution: Run authorized code isolated from the device OS Device authentication: Prove device identity to external verifier Remote attestation: Prove device configuration/properties to external verifier 18
19 Hardware security Architectural options for realizing TEEs External Memories External Memories External Memories RAM Crypto Accelerators On-SoC RAM Crypto Accelerators On-SoC RAM Crypto Accelerators On-SoC Processor core(s) Processor core(s) Processor core(s) ROM Peripherals ROM Peripherals ROM Peripherals OTP Fields OTP Fields On-chip Security Subsystem OTP Fields External Security Co-processor External Secure Element Embedded Secure Element Processor Secure Environment TEE component 19 Figures taken from GlobalPlatform Device Technology, TEE System Architecture, Version 1.0, December 2011
20 Hardware security architectures (mobile) ARM TrustZone and TI M-Shield Augments central processing unit: Secure processor mode Isolated execution with on-chip RAM: Very limited (<20kB) Secure storage: Typically with write-once E-fuses Usually no counters or non-volatile memory: Cost issue Hardware security Processor Secure Environment 20
21 Hardware security architectures (TCG) Hardware security Trusted Platform Module (TPM) Standalone processor on PCs Isolated execution for pre-defined algorithms Arbitrary isolated execution with DRTM ( late launch ) Platform Configuration Registers (PCRs) Monotonic counters External Secure Element Mobile Trusted Module (MTM) Mobile variant of TPM Defines interface Implementation alternatives: TrustZone, M-Shield, software 21
22 Uses of hardware security Hardware security Recap from features Secure/authenticated boot Identity binding/device authentication Secure storage Remote attestation Uses of hardware security (device manufacturer) Device initialization DRM Subsidy lock How can developers make use of hardware security? an example in the second part of this seminar 22
23 23 Software platform security
24 Open mobile platforms Software Platform security Java ME ~2001 For feature phones 3 billion devices! Not supported by most smartphone platforms Symbian ~2004 First smartphone OS App development in C++ (Qt) Android ~2007 Linux-based OS App development in Java MeeGo ~2010 Linux-based OS App development in C++ (Qt) MSSF (Intel Tizen) Windows Phone ~2010 App development in.net 24
25 Mobile platform security model Software Platform security Common techniques Application signing Permission-based access control architecture Application isolation Common operations 1. Permission request 2. Application signing 3. Application installation 4. Application loading 5. Run-time access control enforcement 25
26 Step 1: Developer publishes an application Software Platform security Developer submits the application to a centralized marketplace In some platforms the application can be directly pushed to the mobile device Centralized marketplace Developer Auxiliary marketplaces Developer requests permissions for his application Some platforms support auxiliary marketplaces Mobile device TCB 26
27 Step 2: Marketplace signs the application Software Platform security Developer In some platforms the developer signs the application Marketplace provider checks the application (and requested permissions) and signs it Centralized marketplace Auxiliary marketplaces Mobile device TCB 27
28 Step 3: Application installation Developer Software Platform security Installer may request the user to accept some of the requested permissions Mobile device receives an application installation package from a marketplace (or developer) Centralized marketplace Auxiliary marketplaces User Mobile device TCB Installer consults local policy database about requested permissions After these checks, the installer assigns these permissions to the application Application permission database Policy database Application Installer Installer stores application permissions Secure storage integrity Platform integrity Installer checks application signature and requested permissions 28 Permission and policy databases need integrity protection Application installer component needs integrity protection
29 Step 4: Application loading Software Platform security Developer Centralized marketplace Auxiliary marketplaces User Mobile device Application Loader attaches permissions to the started process TCB Application permission database Policy database Application loader Application Installer Secure storage integrity Platform integrity Loader reads permissions from the permission database 29 Also loader component needs integrity protection
30 Step 5: Application execution Software Platform security Developer Centralized marketplace Auxiliary marketplaces User OS/HW isolate applications from one another at runtime Mobile device Application Application Application TCB Reference monitor Application permission database Policy database Some applications need secrecy for their persistent storage Application loader Application Installer Some applications need device identification (e.g., DRM) Reference monitor controls access to system resources with permissions 30 Platform integrity Secure storage secrecy integrity Secure state Some applications need secure state (e.g., DRM) Device identification Random Some applications may also need source of randomness
31 Step 6: System updates Software Platform security Developer Platform provider Centralized marketplace Auxiliary marketplaces User Platform providers issues (signed) system updates Mobile device Application Application Application TCB System updater verifies received update using policy Reference database monitor Application permission database Policy database Application loader Application Installer System updater System updater rewrites parts of system software Platform integrity Secure storage secrecy integrity Secure state Device identification Random System updates may need device identification 31 System updates need secure state to prevent rollbacks to previous system version
32 Recap main techniques Software Platform security Developer 1. Permission request Platform provider Centralized marketplace Auxiliary marketplaces User 2. Application signing Mobile device 5. Application isolation Application Application Application OS 6. API to system functionality (e.g. secure storage) Reference monitor 4. Permission-based access control Application permission database Policy database Application loader Application Installer System updater 3. Permission assignment Platform integrity Secure storage secrecy integrity Secure state Device identification Random 32
33 Software Platform security Software platform security design choices Device boot How is platform integrity verified? Application development and installation How finely are access control policies defined? What is the basis for granting permissions? Application installation What is shown to the user? Application runtime How is the integrity of installed applications protected? How can applications protect the confidentiality and integrity of their data? Application updates How is a new version of an existing application verified? 33
34 OS bootstrapping Software Platform security Is hardware security used to secure OS bootstrapping? Symbian Java ME Android MSSF Windows Phone Secure boot Not applicable Typically no Authenticated boot: Normal mode vs Developer mode Secure boot 39
35 Permission granularity Software Platform security How finely is access control defined? Symbian Java ME Android MSSF Windows Phone Fixed set of capabilities (21) Fine-grained permissions (many) Fine-grained permissions (112) Linux access control Fine-grained resource-tokens Linux access control Fixed set of capabilities (16) Android and MSSF: Each application is installed under a separate Linux UID 40
36 Permission assignment (basis) Software Platform security What is the basis for granting permissions? Symbian Java ME Android MSSF Windows Phone 4 categories Trusted signature (also user prompts) Trusted signatures for protection domains 4 permission modes 4 protection levels Trusted signatures Local policy file Trusted signatures (user prompt for location) User System, Restricted, Manufacturer Blanket, Session, One-shot, No Normal (automatic) Dangerous (user-granted) Signature (developer-controlled) SystemOrSignature (Google-controlled) 41
37 Permission assignment (user prompting) Symbian Java ME Android Windows Phone Capability description 21 capabilities Function group description 15 groups Permission group description 11 groups Software Platform security User prompted only for location capability E.g.,Read user data, Use network, Access positioning, E.g., NetAccess PhoneCall Location, E.g., LOCATION, NETWORK, ACCOUNTS, 42 What is shown to the user? Skip to Application Updates Only LOCATION
38 Permission assignment (timing) Software Platform security When are permissions assigned to a principal? Symbian Java ME Android MSSF Windows Phone Install-time assignment Run-time prompts Install-time assignment Install-time assignment Run-time privilege shedding possible Install-time assignment Symbian and MSSF: Permissions of app loading a DLL is a subset of permissions of DLL 43
39 Access control policy Software Platform security How does a resource declare the policy for accessing it? How is it enforced? Symbian Java ME Android MSSF Windows Phone Declare in code Enforced by IPC framework or code [System resources] Enforced by VM Declare in manifest Enforced by VM Declare in manifest Enforced by Smack or via libcreds [System resources] Enforced by VM 44
40 Application identification Software Platform security How are applications identified at install and runtime? Symbian Java ME Android MSSF Windows Phone Install and runtime: Protected range SID and VID (managed) UID (unmanaged) Install: Signing key Midlet attributes Install: Signing key Runtime: Unix UID Package name (locally unique) Install: Software source (signing key) Package name Runtime: Software source Package name Application ID Install and runtime: Unique ID (assigned by marketplace) 45
41 Application integrity Software Platform security How is the integrity of installed applications protected? Symbian Java ME Android MSSF Windows Phone Dedicated directory Java sandboxing Java sandboxing Linux access control IMA, Smack Offline protection with EVM and TEE.NET sandboxing Integrity Measurement Architecture (IMA) store hash of file (in extended attribute security.ima) and verify on launch Extended Validation Module (EVM) store MAC of all extended attributes (in security.evm) and verify on access 46
42 Application update Software Platform security How is a new version of an existing application verified? Symbian Java ME Android MSSF Windows Phone Protected SID/VID: trusted signature Rest: no controls Signed midlets: same-origin policy Unsigned midlets: user prompt Same origin policy Same or higher origin policy Trusted signature 47
43 Application data protection Software Platform security How can applications protect the confidentiality and integrity of their data? Symbian Java ME Android MSSF Windows Phone Runtime: private directory Runtime: private record stores Runtime: dedicated UID file system Runtime: fine-grained data caging Runtime: private directory Off-line: private secure storage Off-line: private secure storage 48
44 49 Discussion
45 Recurring themes (hardware enablers) Discussion Hardware-support for platform security Cambridge CAP etc. (~1970 s) Extended to Processor Secure Environments Hardware-assisted secure storage Secure and authenticated boot Academic research projects (mid 1990 s) TCPA and TCG (late 1990 s) Extended (private secure storage for applications) Adapted (normal vs. developer mode in MSSF) 50
46 Recurring themes (software platforms) Discussion Permission-based platform security architectures VAX /VMS privileges for user (~1970 s) Adapted for applications Code signing (mid 1990 s) Used for application installation Application/process isolation 51
47 Open issues Discussion Permission granularity Coarse-grained permissions vs. principle of least privilege Fine-grained permissions vs. user/developer confusion [Felt et al, CCS 12] Permission assignment Is it sensible to let end users make policy assignment decisions? [Chia et al, WWW 12] [Felt et al, SOUPS 12] Centralized vetting for appropriateness Can central authority decide what is offensive? Can there be crowd-sourced alternatives? [Chia et al, Nordsec 10, Amini et al, CMU 12] Colluding applications How to detect/prevent applications from pooling their privileges? [Marforio et al, ETHZ 11] [Schlegel et al, NDSS 11] [Bugiel et al, NDSS 12] 52
48 Summary Discussion Mobile phone security Requirements: operators, regulators, user expectations Closed open Early adaptation of hardware security mechanisms Platform security architecture 1. Application signing 2. Permission based access control 3. Application isolation Many features borrowed or adapted Open issues remain This tutorial is based on an earlier survey paper [Kostiainen et al, CODASPY 2011]; expanded version in preparation. 53
A Perspective on the Evolution of Mobile Platform Security Architectures
A Perspective on the Evolution of Mobile Platform Security Architectures N. Asokan Nokia Research Center Joint work with Kari Kostiainen, Jan-Erik Ekberg, Elena Reshetova (Intel) Padova, July 2012 1 Introduction
More informationA Perspective on the Evolution of Mobile Platform Security Architectures
A Perspective on the Evolution of Mobile Platform Security Architectures Kari Kostiainen Nokia Research Center, Helsinki TIW, June 2011 Joint work with N. Asokan, Jan-Erik Ekberg and Elena Reshetova 1
More informationPatterns for Secure Boot and Secure Storage in Computer Systems
Patterns for Secure Boot and Secure Storage in Computer Systems Hans Löhr, Ahmad-Reza Sadeghi, Marcel Winandy Horst Görtz Institute for IT Security, Ruhr-University Bochum, Germany {hans.loehr,ahmad.sadeghi,marcel.winandy}@trust.rub.de
More informationA Virtualized Linux Integrity Subsystem for Trusted Cloud Computing
A Virtualized Linux Integrity Subsystem for Trusted Cloud Computing Stefan Berger Joint work with: Kenneth Goldman, Dimitrios Pendarakis, David Safford, Mimi Zohar IBM T.J. Watson Research Center 09/21/2011
More informationLecture 17: Mobile Computing Platforms: Android. Mythili Vutukuru CS 653 Spring 2014 March 24, Monday
Lecture 17: Mobile Computing Platforms: Android Mythili Vutukuru CS 653 Spring 2014 March 24, Monday Mobile applications vs. traditional applications Traditional model of computing: an OS (Linux / Windows),
More informationExample of Standard API
16 Example of Standard API System Call Implementation Typically, a number associated with each system call System call interface maintains a table indexed according to these numbers The system call interface
More informationLecture Embedded System Security A. R. Sadeghi, @TU Darmstadt, 2011 2012 Introduction Mobile Security
Smartphones and their applications have become an integral part of information society Security and privacy protection technology is an enabler for innovative business models Recent research on mobile
More informationBuilding Blocks Towards a Trustworthy NFV Infrastructure
Building Blocks Towards a Trustworthy NFV Infrastructure IRTF NFVRG Adrian L. Shaw Hewlett-Packard Laboratories / July 22 nd, 2015 1 Why security and trust? Big requirement for critical
More informationM-Shield mobile security technology
Technology for Innovators TM M-Shield mobile security technology making wireless secure Overview As 3G networks are successfully deployed worldwide, opportunities are arising to deliver to end-users a
More informationAnalysis of advanced issues in mobile security in android operating system
Available online atwww.scholarsresearchlibrary.com Archives of Applied Science Research, 2015, 7 (2):34-38 (http://scholarsresearchlibrary.com/archive.html) ISSN 0975-508X CODEN (USA) AASRC9 Analysis of
More informationMobile Operating Systems. Week I
Mobile Operating Systems Week I Overview Introduction Mobile Operating System Structure Mobile Operating System Platforms Java ME Platform Palm OS Symbian OS Linux OS Windows Mobile OS BlackBerry OS iphone
More informationMobile Simplified Security Framework
Mobile Simplified Security Framework Dmitry Kasatkin Nokia Corporation dmitry.kasatkin@nokia.com Abstract Linux kernel has already several security frameworks such SELinux, AppArmor, Tomoyo and Smack.
More informationTrustworthy Computing
Stefan Thom Senior Software Development Engineer and Security Architect for IEB, Microsoft Rob Spiger, Senior Security Strategist Trustworthy Computing Agenda Windows 8 TPM Scenarios Hardware Choices with
More informationChapter 14 Virtual Machines
Operating Systems: Internals and Design Principles Chapter 14 Virtual Machines Eighth Edition By William Stallings Virtual Machines (VM) Virtualization technology enables a single PC or server to simultaneously
More informationCycurHSM An Automotive-qualified Software Stack for Hardware Security Modules
CycurHSM An Automotive-qualified Software Stack for Hardware Security Modules Dr. Frederic Stumpf, ESCRYPT GmbH Embedded Security, Stuttgart, Germany 1 Introduction Electronic Control Units (ECU) are embedded
More informationUser. Role. Privilege. Environment. Checkpoint. System
8. Security Features Motivation Viruses, spam, trojan horses have become increasingly common in PC environment In mobile environment, new kinds of opportunities offered for malicious software Potentially
More informationSecurity Technology for Smartphones
Security Technology for Smartphones Yasuhiko Abe Hitoshi Ikeda Masafumi Emura Service functions are implemented on smartphones by storing on them personal information, network-operator information, corporate
More informationSoftware Execution Protection in the Cloud
Software Execution Protection in the Cloud Miguel Correia 1st European Workshop on Dependable Cloud Computing Sibiu, Romania, May 8 th 2012 Motivation clouds fail 2 1 Motivation accidental arbitrary faults
More informationEmbedded Trusted Computing on ARM-based systems
1 / 26 Embedded Trusted Computing on ARM-based systems Martin Schramm, M.Eng. 10.04.2014 Agenda 2 of 26 martin.schramm@th-deg.de Embedded computing platforms have become omnipresent intend to alleviate
More informationios Security Decoded Dave Test Classroom and Lab Computing Penn State ITS Feedback - http://j.mp/psumac33
ios Security Decoded Dave Test Classroom and Lab Computing Penn State ITS Feedback - http://j.mp/psumac33 Why care about ios Security? 800M 800 million ios devices activated 130 million in last year 98%
More informationAcronym Term Description
This glossary contains definitions of terms created by TCG, or terms that have a particular meaning in trusted computing, or terms that cause particular confusion in trusted computing. Acronym Term Description
More informationBUSINESS PROTECTION. PERSONAL PRIVACY. ONE DEVICE.
BUSINESS PROTECTION. PERSONAL PRIVACY. ONE DEVICE. Enhanced Security for Your Network and Business Intelligence. Work Hard. Rest Easy. Today, employees are always on, which for you means always vulnerable.
More informationLecture Embedded System Security Dynamic Root of Trust and Trusted Execution
1 Lecture Embedded System Security Dynamic Root of Trust and Execution Prof. Dr.-Ing. Ahmad-Reza Sadeghi System Security Lab Technische Universität Darmstadt (CASED) Germany Summer Term 2014 Dynamic Root
More informationAndroid Architecture For Beginners
Leon Romanovsky leon@leon.nu www.leon.nu April 22, 2013 Introduction Linux-based operating system with market share - 69.70% in smartphones, 42% in tablets, available on smart TVs and mini PC. History
More informationOracle Solaris Security: Mitigate Risk by Isolating Users, Applications, and Data
Oracle Solaris Security: Mitigate Risk by Isolating Users, Applications, and Data Will Fiveash presenter, Darren Moffat author Staff Engineer Solaris Kerberos Development Safe Harbor Statement The following
More informationLecture Overview. INF3510 Information Security Spring 2015. Lecture 4 Computer Security. Meaningless transport defences when endpoints are insecure
Lecture Overview INF3510 Information Security Spring 2015 Fundamental computer security concepts CPU and OS kernel security mechanisms Virtualization Memory Protection Trusted computing and TPM Lecture
More informationOMAP platform security features
SWPT008 - July 2003 White Paper OMAP platform security features By Harini Sundaresan Applications Engineer, OMAP Security Texas Instruments, Wireless Terminal Business Unit This white paper introduces
More informationSecure Containers. Jan 2015 www.imgtec.com. Imagination Technologies HGI Dec, 2014 p1
Secure Containers Jan 2015 www.imgtec.com Imagination Technologies HGI Dec, 2014 p1 What are we protecting? Sensitive assets belonging to the user and the service provider Network Monitor unauthorized
More informationUsing the TPM to Solve Today s Most Urgent Cybersecurity Problems
Using the to Solve Today s Most Urgent Cybersecurity Problems May 20, 2014 10:00AM PDT 2 Stacy Cannady, Technical Marketing Trustworthy Computing, Cisco Stacy Cannady, CISSP, is technical marketing - Trustworthy
More informationSECURE IMPLEMENTATIONS OF CONTENT PROTECTION (DRM) SCHEMES ON CONSUMER ELECTRONIC DEVICES
SECURE IMPLEMENTATIONS OF CONTENT PROTECTION (DRM) SCHEMES ON CONSUMER ELECTRONIC DEVICES Contents Introduction... 3 DRM Threat Model... 3 DRM Flow... 4 DRM Assets... 5 Threat Model... 5 Protection of
More informationResearch and Design of Universal and Open Software Development Platform for Digital Home
Research and Design of Universal and Open Software Development Platform for Digital Home CaiFeng Cao School of Computer Wuyi University, Jiangmen 529020, China cfcao@126.com Abstract. With the development
More informationNetwork Licensing. White Paper 0-15Apr014ks(WP02_Network) Network Licensing with the CRYPTO-BOX. White Paper
WP2 Subject: with the CRYPTO-BOX Version: Smarx OS PPK 5.90 and higher 0-15Apr014ks(WP02_Network).odt Last Update: 28 April 2014 Target Operating Systems: Windows 8/7/Vista (32 & 64 bit), XP, Linux, OS
More informationDesktop Virtualization. The back-end
Desktop Virtualization The back-end Will desktop virtualization really fit every user? Cost? Scalability? User Experience? Beyond VDI with FlexCast Mobile users Guest workers Office workers Remote workers
More informationSecurity challenges for internet technologies on mobile devices
Security challenges for internet technologies on mobile devices - Geir Olsen [geiro@microsoft.com], Senior Program Manager for Security Windows Mobile, Microsoft Corp. - Anil Dhawan [anild@microsoft.com],
More informationIndex. BIOS rootkit, 119 Broad network access, 107
Index A Administrative components, 81, 83 Anti-malware, 125 ANY policy, 47 Asset tag, 114 Asymmetric encryption, 24 Attestation commercial market, 85 facts, 79 Intel TXT conceptual architecture, 85 models,
More informationQUIRE: : Lightweight Provenance for Smart Phone Operating Systems
QUIRE: : Lightweight Provenance for Smart Phone Operating Systems Dan S. Wallach Rice University Joint work with Mike Dietz, Yuliy Pisetsky, Shashi Shekhar, and Anhei Shu Android's security is awesome
More informationBlackBerry Enterprise Service 10. Secure Work Space for ios and Android Version: 10.1.1. Security Note
BlackBerry Enterprise Service 10 Secure Work Space for ios and Android Version: 10.1.1 Security Note Published: 2013-06-21 SWD-20130621110651069 Contents 1 About this guide...4 2 What is BlackBerry Enterprise
More informationHardware Security Modules for Protecting Embedded Systems
Hardware Security Modules for Protecting Embedded Systems Marko Wolf, ESCRYPT GmbH Embedded Security, Munich, Germany André Weimerskirch, ESCRYPT Inc. Embedded Security, Ann Arbor, USA 1 Introduction &
More informationLecture 2 PLATFORM SECURITY IN ANDROID OS
Lecture 2 PLATFORM SECURITY IN ANDROID OS You will be learning: Android as a software platform Internals and surrounding ecosystem Security techniques in Android: Application signing Application isolation
More informationProtecting Data with Short- Lived Encryption Keys and Hardware Root of Trust. Dan Griffin DefCon 2013
Protecting Data with Short- Lived Encryption Keys and Hardware Root of Trust Dan Griffin DefCon 2013 Time-Bound Keys Announcements New tool: TimedKey.exe New whitepaper: Trusted Tamperproof Time on Mobile
More informationSecurity Technical. Overview. BlackBerry Enterprise Service 10. BlackBerry Device Service Solution Version: 10.2
BlackBerry Enterprise Service 10 BlackBerry Device Service Solution Version: 10.2 Security Technical Overview Published: 2014-09-10 SWD-20140908123239883 Contents 1 About BlackBerry Device Service solution
More informationCSE543 - Introduction to Computer and Network Security. Module: Reference Monitor
CSE543 - Introduction to Computer and Network Security Module: Reference Monitor Professor Trent Jaeger 1 Living with Vulnerabilities So, software is potentially vulnerable In a variety of ways So, how
More informationAdobe Flash Player and Adobe AIR security
Adobe Flash Player and Adobe AIR security Both Adobe Flash Platform runtimes Flash Player and AIR include built-in security and privacy features to provide strong protection for your data and privacy,
More informationSierraware Overview. Simply Secure
Sierraware Overview Simply Secure Sierraware Software Suite SierraTEE/Micro Kernel TrustZone/GlobalPlatform TEE SierraVisor: Bare Metal Hypervisor Hypervisor for ARM Para-virtualization, TrustZone Virtualization,
More informationA M D DA S 1. 0 For the Manageability, Virtualization and Security of Embedded Solutions
A M D DA S 1. 0 For the Manageability, Virtualization and Security of Embedded Solutions AMD DAS (DASH, AMD Virtualization (AMD-V ) Technology, and Security) 1.0 is a term used to describe the various
More informationvtpm: Virtualizing the Trusted Platform Module
vtpm: Virtualizing the Trusted Platform Module Stefan Berger Ramón Cáceres Kenneth A. Goldman Ronald Perez Reiner Sailer Leendert van Doorn {stefanb, caceres, kgoldman, ronpz, sailer, leendert}@us.ibm.com
More informationBusiness Protection. Personal Privacy. One Device. Enhanced Security for Your Network and Business Intelligence.
Business Protection. Personal Privacy. One Device. Enhanced Security for Your Network and Business Intelligence. Work Hard. Rest Easy. Today, employees are always on, which for you means always vulnerable.
More informationIn-Depth Look at Capabilities: Samsung KNOX and Android for Work
In-Depth Look at Capabilities: Samsung KNOX and Android for Work Silent Install Using the Samsung KNOX Workspace Mobile Device Management (MDM) APIs, IT admins can install and enable applications automatically.
More informationEnd User Devices Security Guidance: Apple OS X 10.10
GOV.UK Guidance End User Devices Security Guidance: Apple OS X 10.10 Published Contents 1. Changes since previous guidance 2. Usage scenario 3. Summary of platform security 4. How the platform can best
More informationTechnologies to Improve. Ernie Brickell
Technologies to Improve Platform Security Ernie Brickell Intel Corporation 9/29/2011 1 Security is Intel s Third Value Pillar Intel is positioning itself to lead in three areas: energy-efficient efficient
More informationWhat s New in Juniper s SSL VPN Version 6.0
What s New in Juniper s SSL VPN Version 6.0 This application note describes the new features available in Version 6.0 of the Secure Access SSL VPN products. This document assumes familiarity with the Juniper
More informationSA Series SSL VPN Virtual Appliances
SA Series SSL VPN Virtual Appliances Data Sheet Published Date July 2015 Product Overview The world s mobile worker population passed the 1 billion mark in 2010 and will grow to more than 1.3 billion by
More informationSecure Data Management in Trusted Computing
1 Secure Data Management in Trusted Computing Ulrich Kühn Deutsche Telekom Laboratories, TU Berlin Klaus Kursawe (KU Leuven) Stefan Lucks (U Mannheim) Ahmad-Reza Sadeghi (RU Bochum) Christian Stüble (RU
More informationSpecial FEATURE. By Heinrich Munz
Special FEATURE By Heinrich Munz Heinrich Munz of KUKA Roboter discusses in this article how to bring Microsoft Windows CE and WindowsXP together on the same PC. He discusses system and application requirements,
More informationIntroducing etoken. What is etoken?
Introducing etoken Nirit Bear September 2002 What is etoken? Small & portable reader-less Smartcard Standard USB connectivity Logical and physical protection Tamper evident (vs. tamper proof) Water resistant
More informationHow To Write Security Enhanced Linux On Embedded Systems (Es) On A Microsoft Linux 2.2.2 (Amd64) (Amd32) (A Microsoft Microsoft 2.3.2) (For Microsoft) (Or
Security Enhanced Linux on Embedded Systems: a Hardware-accelerated Implementation Leandro Fiorin, Alberto Ferrante Konstantinos Padarnitsas, Francesco Regazzoni University of Lugano Lugano, Switzerland
More informationChapter 2 System Structures
Chapter 2 System Structures Operating-System Structures Goals: Provide a way to understand an operating systems Services Interface System Components The type of system desired is the basis for choices
More informationHow To Write A Windows Operating System (Windows) (For Linux) (Windows 2) (Programming) (Operating System) (Permanent) (Powerbook) (Unix) (Amd64) (Win2) (X
(Advanced Topics in) Operating Systems Winter Term 2009 / 2010 Jun.-Prof. Dr.-Ing. André Brinkmann brinkman@upb.de Universität Paderborn PC 1 Overview Overview of chapter 3: Case Studies 3.1 Windows Architecture.....3
More informationUni-directional Trusted Path: Transaction Confirmation on Just One Device
Uni-directional Trusted Path: Transaction Confirmation on Just One Device Atanas Filyanov 1, Jonathan M. McCune 2, Ahmad-Reza Sadeghi 3, Marcel Winandy 1 1 Ruhr-University Bochum, Germany 2 Carnegie Mellon
More informationSymbian phone Security
ITSX Overview Symbian OS. Risks and Features. Taking it apart. Conclusions. Symbian History Psion owner of EPOC OS, originally from 1989, released EPOC32 in 1996 EPOC32 was designed with OO in C++ 1998:
More informationCSE597a - Cell Phone OS Security. Cellphone Hardware. William Enck Prof. Patrick McDaniel
CSE597a - Cell Phone OS Security Cellphone Hardware William Enck Prof. Patrick McDaniel CSE597a - Cellular Phone Operating Systems Security - Spring 2009 - Instructors McDaniel and Enck 1 2 Embedded Systems
More informationKernel Types System Calls. Operating Systems. Autumn 2013 CS4023
Operating Systems Autumn 2013 Outline 1 2 Types of 2.4, SGG The OS Kernel The kernel is the central component of an OS It has complete control over everything that occurs in the system Kernel overview
More informationProtecting the Filesystem Integrity of a Fedora 15 Virtual Machine from Offline Attacks using IMA/EVM Linux Security Summit 8 September 2011
Protecting the Filesystem Integrity of a Fedora 15 Virtual Machine from Offline Attacks using IMA/EVM Linux Security Summit 8 September 2011 Peter Kruus Peter.Kruus@jhuapl.edu Agenda Need for integrity
More informationVerfahren zur Absicherung von Apps. Dr. Ullrich Martini IHK, 4-12-2014
Verfahren zur Absicherung von Apps Dr. Ullrich Martini IHK, 4-12-2014 Agenda Introducing G&D Problem Statement Available Security Technologies Smartcard Embedded Secure Element Virtualization Trusted Execution
More informationTechnical Brief Distributed Trusted Computing
Technical Brief Distributed Trusted Computing Josh Wood Look inside to learn about Distributed Trusted Computing in Tectonic Enterprise, an industry-first set of technologies that cryptographically verify,
More informationTrustworthy Execution on Mobile Devices: What security properties can my mobile platform give me?
Trustworthy Execution on Mobile Devices: What security properties can my mobile platform give me? Amit Vasudevan, Emmanuel Owusu, Zongwei Zhou, James Newsome, and Jonathan M. McCune CyLab/Carnegie Mellon
More informationTrusted Platforms for Homeland Security
Trusted Platforms for Homeland Security By Kevin Schutz, Product Manager Secure Products Summary Ongoing threats from hackers, viruses, and worms continue to make security a top priority for IT and business
More informationMobile Protection. Driving Productivity Without Compromising Protection. Brian Duckering. Mobile Trend Marketing
Driving Productivity Without Compromising Protection Brian Duckering Mobile Trend Marketing Mobile Device Explosion Paves Way for BYOD 39% 69% 340% 2,170% 2010 177M corp PCs 2015 246M corp PCs 2010 173
More informationSecurity Guide. BlackBerry Enterprise Service 12. for ios, Android, and Windows Phone. Version 12.0
Security Guide BlackBerry Enterprise Service 12 for ios, Android, and Windows Phone Version 12.0 Published: 2015-02-06 SWD-20150206130210406 Contents About this guide... 6 What is BES12?... 7 Key features
More informationProperty Based TPM Virtualization
Property Based Virtualization Marcel Winandy Joint work with: Ahmad Reza Sadeghi, Christian Stüble Horst Görtz Institute for IT Security Chair for System Security Ruhr University Bochum, Germany Sirrix
More informationSierraVMI Sizing Guide
SierraVMI Sizing Guide July 2015 SierraVMI Sizing Guide This document provides guidelines for choosing the optimal server hardware to host the SierraVMI gateway and the Android application server. The
More informationGuidance End User Devices Security Guidance: Apple OS X 10.9
GOV.UK Guidance End User Devices Security Guidance: Apple OS X 10.9 Published 23 January 2014 Contents 1. Changes since previous guidance 2. Usage Scenario 3. Summary of Platform Security 4. How the Platform
More informationCloud Terminal: Secure Access to Sensitive Applications from Untrusted Systems
Cloud Terminal: Secure Access to Sensitive Applications from Untrusted Systems Lorenzo Martignoni, Pongsin Poosankam, y Matei Zaharia, Jun Han, y Stephen McCamant, Dawn Song, Vern Paxson, Adrian Perrig,
More informationHow to Secure Infrastructure Clouds with Trusted Computing Technologies
How to Secure Infrastructure Clouds with Trusted Computing Technologies Nicolae Paladi Swedish Institute of Computer Science 2 Contents 1. Infrastructure-as-a-Service 2. Security challenges of IaaS 3.
More informationSoftware-based TPM Emulator for Linux
Software-based TPM Emulator for Linux Semester Thesis Mario Strasser Department of Computer Science Swiss Federal Institute of Technology Zurich Summer Semester 2004 Mario Strasser: Software-based TPM
More informationM-Shield Mobile Security Technology: making wireless secure
WHITE PAPER Jerome Azema Distinquished Member of Technical Staff WTBU Chief Technology Office - Security Texas Instruments Gilles Fayad Worldwide Strategic Marketing Manager, Mobile Platform Security and
More informationComprehensive Security for Internet-of-Things Devices With ARM TrustZone
Comprehensive Security for Internet-of-Things Devices With ARM TrustZone Howard Williams mentor.com/embedded Internet-of-Things Trends The world is more connected IoT devices are smarter and more complex
More informationDigital Rights Management Demonstrator
Digital Rights Management Demonstrator Requirements, Analysis, and Design Authors: Andre Osterhues, Marko Wolf Institute: Ruhr-University Bochum Date: March 2, 2007 Abstract: This document describes a
More informationAndroid Security. Device Management and Security. by Stephan Linzner & Benjamin Reimold
Android Security Device Management and Security by Stephan Linzner & Benjamin Reimold Introducing Stephan Linzner Benjamin Reimold Consultant, Software Engineer Mobile Developer Founder of Stuttgart GTUG
More informationSecure Boot on i.mx25, i.mx35, and i.mx51 using HABv3
Freescale Semiconductor Application Note Document Number: AN4547 Rev. 0, 10/2012 Secure Boot on i.mx25, i.mx35, and i.mx51 using HABv3 by Freescale Semiconductor, Inc. This application note explains how
More informationCedric Rajendran VMware, Inc. Security Hardening vsphere 5.5
Cedric Rajendran VMware, Inc. Security Hardening vsphere 5.5 Agenda Security Hardening vsphere 5.5 ESXi Architectural Review ESXi Software Packaging The ESXi Firewall ESXi Local User Security Host Logs
More informationCIS 551 / TCOM 401 Computer and Network Security
CIS 551 / TCOM 401 Computer and Network Security Spring 2007 Lecture 3 1/18/07 CIS/TCOM 551 1 Announcements Email project groups to Jeff (vaughan2 AT seas.upenn.edu) by Jan. 25 Start your projects early!
More informationMobile Cloud Computing
Mobile Cloud Computing Dr Samia Bouzefrane Laboratoire CEDRIC CNAM, 292 rue Saint Martin http://cedric.cnam.fr/~bouzefra samia.bouzefrane@cnam.fr 1 Agenda Mobile Cloud computing Mobile trusted computing
More informationAndroid Fundamentals 1
Android Fundamentals 1 What is Android? Android is a lightweight OS aimed at mobile devices. It is essentially a software stack built on top of the Linux kernel. Libraries have been provided to make tasks
More informationSecure web transactions system
Secure web transactions system TRUSTED WEB SECURITY MODEL Recently, as the generally accepted model in Internet application development, three-tier or multi-tier applications are used. Moreover, new trends
More informationCHANCES AND RISKS FOR SECURITY IN MULTICORE PROCESSORS
CHANCES AND RISKS FOR SECURITY IN MULTICORE PROCESSORS Prof. Dr.-Ing. Georg Sigl Institute for Security in Information Technology Technical University Munich sigl@tum.de Fraunhofer Research Institution
More informationH MICRO CASE STUDY. Device API + IPC mechanism. Electrical and Functional characterization of HMicro s ECG patch
H MICRO CASE STUDY HMicro HMicro is a wireless healthcare chip company to enable industry s first fully disposable wireless patches with high reliability, high data integrity, low cost, small form factor
More informationThe Impact of Cryptography on Platform Security
The Impact of Cryptography on Platform Security Ernie Brickell Intel Corporation 2/28/2012 1 Security is Intel s Third Value Pillar Intel is positioning itself to lead in three areas: energy-efficient
More informationTutorial on Smartphone Security
Tutorial on Smartphone Security Wenliang (Kevin) Du Professor wedu@syr.edu Smartphone Usage Smartphone Applications Overview» Built-in Protections (ios and Android)» Jailbreaking and Rooting» Security
More informationRepublic Polytechnic School of Information and Communications Technology C226 Operating System Concepts. Module Curriculum
Republic Polytechnic School of Information and Communications Technology C6 Operating System Concepts Module Curriculum Module Description: This module examines the fundamental components of single computer
More informationEmbedded Java & Secure Element for high security in IoT systems
Embedded Java & Secure Element for high security in IoT systems JavaOne - September 2014 Anne-Laure SIXOU - ST Thierry BOUSQUET - ST Frédéric VAUTE - Oracle Speakers 2 Anne-Laure SIXOU Smartgrid Product
More informationChapter 3 Operating-System Structures
Contents 1. Introduction 2. Computer-System Structures 3. Operating-System Structures 4. Processes 5. Threads 6. CPU Scheduling 7. Process Synchronization 8. Deadlocks 9. Memory Management 10. Virtual
More informationEmbedded Linux development training 4 days session
Embedded Linux development training 4 days session Title Overview Duration Trainer Language Audience Prerequisites Embedded Linux development training Understanding the Linux kernel Building the Linux
More informationWindows Phone 7 Internals and Exploitability
Windows Phone 7 Internals and Exploitability (abridged white paper) Tsukasa Oi Research Engineer 目 次 1. Abstract... 3 2. Introduction: Windows Phone 7 and Analysis... 3 3. Security Analysis Windows Phone
More informationData Sheet. NCP Secure Enterprise Management. Next Generation Network Access Technology
Centrally Managed VPN Fully Automatic Operation of a Remote Access VPN via a Single Console Enables easy rollout and operation of secure remote access infrastructures Central creation of client configuration
More informationSystem Structures. Services Interface Structure
System Structures Services Interface Structure Operating system services (1) Operating system services (2) Functions that are helpful to the user User interface Command line interpreter Batch interface
More informationReminders. Lab opens from today. Many students want to use the extra I/O pins on
Reminders Lab opens from today Wednesday 4:00-5:30pm, Friday 1:00-2:30pm Location: MK228 Each student checks out one sensor mote for your Lab 1 The TA will be there to help your lab work Many students
More informationSecurity for Mac Computers in the Enterprise
Security for Mac Computers in the Enterprise October, 2012 Mountain Lion 10.8 Contents Introduction 3 Service and App Protection 4 Gatekeeper 4 Digital Signatures and Developer IDs 4 App Sandboxing 5 Mandatory
More informationImproving Online Security with Strong, Personalized User Authentication
Improving Online Security with Strong, Personalized User Authentication July 2014 Secure and simplify your digital life. Table of Contents Online Security -- Safe or Easy, But Not Both?... 3 The Traitware
More informationTCG PC Client Specific Implementation Specification for Conventional BIOS
TCG PC Client Specific Implementation Specification for Conventional BIOS Specification Version 1.21 Errata Revision 1.00 February 24 th, 2012 For TPM Family 1.2; Level 2 Contact: admin@trustedcomputinggroup.org
More information