Wave Systems Corp. (fka WAVXQ)

[Fullmoon]

Mobile Phone Security and Trusted Computing


http://www.trustedcomputinggroup.org/community/2010/11/mobile_phone_security_and_trusted_computing

According to a story recently in the Wall Street Journal, "Consumers are snapping up gadgets like high-powered cellphones and Apple Inc.'s tablet computer, and the cellphone industry is counting on them to drive its growth. Meanwhile, the list of holes computer researchers are finding in the devices and their software is growing."


While attacks on smartphones are not yet common, everyone in the industry anticipates they will be the target of the same malware, attacks and other creepy stuff that can cripple computers and steal users' data.



Anticipating this, in September 2006, TCG announced the industry's first open specification, for the Mobile Trusted Module (MTM) to enable mobile security to be embedded in a device's basic architecture.



The use cases and specification are still valid today, with valid and timely key concepts including secure boot, roots of trust, enforced integrity protection, multiple engines, multiple stakeholders, enforced integrity protection, remote (MRTM) & local (MLTM) ownership and flexible implementation.



The MTM specification offers an abstraction layer specification to the trusted components of a mobile platform, which defines the trusted components' properties in terms of an interface exposed by the trusted components towards the normal (untrusted) components of the platform.



Importantly for the developers and manufacturers of devices where flexibility and optimized security for all solutions and purposes is imperative, the MTM does not need to be implemented only in dedicated silicon hardware. The capabilities can be embedded in the overall architecture, whereby the security is hardware-assisted and the overall MTM itself does not have to be entirely in silicon.



There are a number of resources in addition to those linked above:

Nokia Research Center Mobile Trusted Module (MTM) - an introduction http://research.nokia.com/files/NRCTR2007015.pdf
Implementation of a TCG-Based Trusted Computing in Mobile Device http://www.springerlink.com/content/w481726348g70735/
Design and implementation of mobile trusted module for trusted mobile computing http://ieeexplore.ieee.org/xpls/abs_all.jsp?arnumber=5439136
A Trusted Mobile Phone Prototype http://ieeexplore.ieee.org/xpls/abs_all.jsp?arnumber=4446568