Securing Multiple Mobile Platforms

Transcription

1 Securing Multiple Mobile Platforms CPU-based Multi Factor Security 2010 Security Workshop ETSI 2010 Security Workshop Navin Govind Aventyn, Inc. Founder and CEO 1

2 Mobile Platform Security Gaps Software vulnerabilities, hardware insecurity and weak licensing models have displaced whole solution for securing mobile platforms Rapid trends in Cloud, SaaS, VM, Web 2.0+ platforms challenge security, IP protection, device level user security Downloaded data rights management need reliable enterprise level security infrastructure Multi-core processors are becoming the norm with dedicated L1 cache per core always present Applications, System Software, Portals, User and Device need to be secured using multi factor, scalable, low encryption/bit cost secure computing whole solution 2

3 Multi Factor Security The crux of the idea is to execute security related functions in a processor using known architectural constructs Security algorithms are software, user and device platform specific that prevent class break scenarios Security algorithms can be reconfigured dynamically for flexibility when device is in connected mode The solution is a lightweight driver with defined API(s) for securely executing code and retrieving secure data on existing hardware/software platforms One click encryption of system software, OS s, applications, device, data, portals with multi factor authentication using secure hash of customizable machine and user ID s 3

4 CPU-Based Secure Code Execution Judiciously utilizes micro-architectural behavior and security features of x86, ARM processor platforms without affecting platform performance Robust software encryption solution, secure code execution and runtime integrity verification Unique application, user, device ID Multi Factor Security authentication, fraud detection and tamper proof solution Platform specific algorithms limit class-break scenario to a single user, device and application Enforce secure software leasing rights for both locally hosted apps/data and web hosted apps/data 4

5 Multi Factor Secure Platform CLIP Encrypted Applications Secure Health Portal Tamper Resistant Robust HIPAA Manageability Encrypted Virtualization Layers Encrypt Patient EMR Data Unique Platform Identification and Authentication Secure Code Execution *Intel (Intel vpro/ VT/ TXT, VT/ TXT, AMD-V AMD-V, and ARM ARM TZ) TrustZone *Marks are properties of respective owners 5

6 SmartDevice Threat Model Protection Preventing malicious code in SmartDevice staging network attacks such as denial of service Preventing service frauds such as billing storms Unauthorized usage of services remotely when the device is in connected mode Theft of services Unauthorized remote use of devices Use camera, GPS, etc. Data theft over the network Personal data and identity theft 6

7 Multi Factor Secure (MFS) Computing Code and data are always in encrypted form on the storage media, main memory, buses or on the wire (for downloaded applications) Capability to provide execution and processing of above data Securely inside core with no visibility outside Tamper proof because of encryption and run-time integrity verification Crypto algorithms are platform specific avoids class-break scenario Marginal impact to power/performance 7

8 MFS SmartDevice Impact Use of ARM TZ in addition to Intel vpro/vt/txt Symbian, S60 as an ARM OS Business transactions, making a voice call, financial transaction, value added service in the device today are centered around SIM For many reasons Manage wide variety of devices with SIM as the common factor Service uniformity across carrier boundaries MFS technology provides the capability to base/center the services on the specific device platform for non-sim device 8

9 MFS End-user Scenarios SmartDevice is a personal device; even the corporate version MFS technology connects service providers to the platform provider complementing SIM Business transactions delivered platform specific along with operator based SIM Secure applications that are downloaded from App stores Encrypted to prevent malicious and unauthorized usage Usage Examples Scalable mobile banking services Device user can switch from carrier X to carrier Y and still continue to bank with the same financial institution Downloaded media and content delivered to authorized platforms Sensitive data cannot be viewed on another platform 9

10 One-Click Encryption and Authentication Secure Portals, Data, Content and Devices 10

11 Secure Computing Usage and Applications Health Information Encrypt Application, User ID Prevent ID theft and fraud Enables HITECH, HIPAA Internet Private IT Infrastructure Secured Applications Provisioning Flexible Licensing Hospital EMR PHI Encryption PCI Security for Services Secure Personal Health Devices Configure Medication & Alerts Multiple Platform Support X86 and ARM Specific Win, Linux and Mac OS Citrix, VMware Android, S60, Snapdragon Payors and Providers Secure Users and Data Scalable Platforms Increased Revenue Harden Health Applications Software Unique Identification and Authentication Secure User, Device Centric Data Rights Tamper Resistant Device and Data Prevent Unauthorized Access to Data Secure Multiple, Diverse Devices Simple, Flexible and Affordable 11

12 One-Click Encryption and Authentication Unique and robust software solution for secure code execution and run-time integrity verification Multi factor secure identification and authentication of users, devices for increased security and manageability Tamper proof software rights management, software activation, distribution and licensing solution Reduces virtualization layer threats by securing and hardening hypervisors and custom software containers Enforcing improved security policies for auditing, compliance, updates and patches 12

13 e-payment Security Integration 13

14 Payment Registration Flow Registration Server Client User Device E-Payment Management Server Client visits registration portal with personal device to create an account Manually enters details for user ID, password, mobile number, CC#, relevant identifiers Registration server queries device for unique machine specific ID s, generates a new driver and a lib file and upload files to the client device Sys file contains the machine specific algorithms Lib file contains the C API to access the functionality Registration server sends encrypted PIN, mobile number, customizable unique IDs etc., to e- payment management server 14

15 Payment Transaction Flow e-payment Management Server Web-based StoreFront Client User Device User visits provider for services and makes payment with registered user device with opt-in click for pay by e- Payment Client sends the encrypted PIN to StoreFront StoreFront sends the encrypted PIN, mobile number, merchant ID and the amount to be charged to e-payment server e-payment Server compares the sent PIN with encrypted PIN, unique ID and returns the appropriate result to StoreFront 15

16 Benefits Enable more patients to review their health bills and secure pay online or in the office with personal device and public terminals. Compelling one click encrypted payment option than using credit card. Easy integration with devices, EMR vendors and payers for encrypted 24/7 convenience of patient payment process. Deter ID theft and fraud prevention. 6-month ROI and long term savings with integrated security framework for accelerated patient payments. 16

17 Customizable Multi Factor Security for Content Protection 17

18 Conditional Access Today Content Generation/ Playout Scrambler/ Encryptor Transmission Key distribution through a back channel OR Descrambler/ Decryption Key generation using smart card Content Display 18

19 Content Protection Increasingly content is being viewed in non-broadcast mode Netflix movie downloads, sitcom episodes on istore, Hulu etc. Content watching is increasingly on personal devices Laptops, Netbooks, Smartphones Key distribution is still a challenge on general purpose platforms Users generally do not like the idea of attaching a hardware device to personal devices Platform providers do not want to be locked down to a specific hardware content protection device Users will tolerate a CA/DRM mechanism if the user experience is transparent Minimum hassles to the end users A transparent but robust content protection mechanism will be a winwin-win for content (widget) providers, service providers and end-uses 19

20 Benefits No class-break scenario Streamlined key distribution User PIN can still be used (ala debit card) Better user experience Utilize hardware based CA mechanisms when needed Platform vendors like it because no additional hardware is needed Incentive to protect content and IP 20