Berlin Institute of Technology FG Security in Telecommunications

Transcription

1 Berlin Institute of Technology FG Security in Telecommunications Weiss L4Android: A Generic Operating System Framework for Secure Smartphones Workshop on Security and Privacy in Smartphones and Mobile Devices Matthias Lange, S. Liebergeld, A. Lackorzynski, A. Warg, M. Peter, October 17th, 2011 [email protected]

2 This talk is not about mobile virtualization. 2

3 Motivation Near field communication Secure text and voice communication BYOD policies 3

4 Motivation Near field communication Secure text and voice communication BYOD policies The NSA Wants Its Own Smartphone (Uberreview [1], 9/27/2011) 3

5 Motivation Near field communication Secure text and voice communication BYOD policies The NSA Wants Its Own Smartphone (Uberreview [1], 9/27/2011) AT&T toggle taps Enterproid for Android device management (eweek [5], 10/12/2011) 3

6 Emerging threats Existing OS not a secure foundation 4

7 Emerging threats Existing OS not a secure foundation QR code infects Android phones with Trojan malware (Android community [4], 9/30/2011) 4

8 Emerging threats Existing OS not a secure foundation QR code infects Android phones with Trojan malware (Android community [4], 9/30/2011) Android vulnerability renders antivirus products ineffective (The Inquirer [3], 10/4/2011) 4

9 Emerging threats Existing OS not a secure foundation QR code infects Android phones with Trojan malware (Android community [4], 9/30/2011) Android vulnerability renders antivirus products ineffective (The Inquirer [3], 10/4/2011) HTC Android Handsets spew private data to ANY app (The Register [2], 10/3/2011) 4

10 Outline Framework architecture Results 5

11 Berlin Institute of Technology FG Security in Telecommunications Weiss Framework Architecture

12 Instead of this... Applications Browser VPN Secure Voice Phone Home Contacts Calendar Application Framework Notification Manager Activity Manager Window Manager Resource Manager Package Manager Telephony Manager Location Manager Media Manager Surface Manager Crypto Manager User Linux Kernel Kernel Display Driver Camera Driver Flash Driver NFC Driver Power Mgmt Audio Driver... Keypad Driver Wifi Driver Smartcard 7

13 ... we want that Applications Browser VPN Secure Voice Phone Home Contacts Calendar Application Framework Notification Manager Activity Manager Window Manager Resource Manager Package Manager Telephony Manager Location Manager Media Manager Surface Manager Crypto Manager Platform support Display Driver Camera Driver Flash Driver NFC Driver Power Mgmt Audio Driver... Keypad Driver Wifi Driver Smartcard User Kernel Kernel 8

14 Building blocks Microkernel Runtime environment Virtual machines 9

15 Architecture 10

16 Architecture VM (private) VM (business) Android userlevel software stack (unmodified) Virtual Smartcard Virtual Smartcard Crypto Android userlevel software stack (unmodified) L4Android Kernel Smartcard Multiplexer L4Android Kernel Platform support & device drivers Display Touch Sensors Smartcard Storage I2C SPI GPIO Timer Clocks Runtime Environment Memory Mgr IO Mgr Roottask Microkernel Loader User Kernel 10

17 Berlin Institute of Technology FG Security in Telecommunications Weiss Results

18 Results Framework does not require hardware modifcations or extensions Microkernel and runtime environment running on x86 and ARM L4Android on x86 and ARM generic HW interface for both architectures Prototypes running on Freescale imx.51 (ARM) Aava Moorestown Smartphone (x86) Samsung Galaxy S2 (ARM) Odroid-A tablet (ARM) 12

19 Check l4android.org 13

20 Berlin Institute of Technology FG Security in Telecommunications Questions? Thank you!

21 [1] [2] htc_android_security/ [3] /android-vulnerability-renders-antivirusproducts-ineffective [4] [5] ATT-Toggle-Taps-Enterproid-for-Android-Device- Management / 15