A Security Framework for Mobile Devices

By:

The security challenge - small highly connected devices, with
constrained resources, deployed in promiscuous usage scenarios.
In some cases all software runs as root. Traditional Unix security
goes out the window.

Developing a security system - first step, the use case: what
are we hoping to achieve? For telephony enabled devices such as
mobile phones and phone/PDA's SXV would provide a way to download
3rd party games and software compiled to native binary formats and
run them with a level of security acceptable to end-users, network
providers and carriers.

Current research: the Qtopia Secure Execution Environment
(SXV) combines a MAC kernel and service message authentication
on constrained devices. Policy files are simple and profile based,
packages must declare desired profiles before download.

Message authentication is by a combination of shared secret, HMAC
and Unix Domain Socket ancillary data. Privilege separation is
acheived by providing a document server for access to user files.

Stream: Other...

Paper: Security Framework for Mobile Devices, A

Sarah joined Trolltech in 2004. Although Trolltech is well known in
Open Source circles as the Norwegian creators of the Qt toolkit behind KDE,
Sarah is working in the Brisbane office on the Embedded product
Qtopia. Prior to Trolltech Sarah worked at a research centre at UQ.
Sarah wrote her first computer program in 1982 and has been fiddling
about with Linux since 1996. Sarah is involved in ACS, Humbug, Brisbane PerlMongers and SAGE-AU, has attended, helped organize and spoken at a number of Linux.conf.au's