Security in Symbian Operating SystemSecurity in Symbian Operating SystemMobile and Wireless DevicesMobile and Wireless Devices

Kunal Bansal

kbansal@cs.odu.edu

OverviewOverview Wireless PlatformsWireless Platforms Why Symbian Platform over WindowsWhy Symbian Platform over Windows Security Layer in ArchitectureSecurity Layer in Architecture Security ModulesSecurity Modules Integration With Other DevicesIntegration With Other Devices DrawbacksDrawbacks Future Developments in Symbian SecurityFuture Developments in Symbian Security SummarySummary Questions & CommentsQuestions & Comments

Wireless PlatformsWireless Platforms These are the Operating Systems for devices which are These are the Operating Systems for devices which are

mobile and include Windows Mobile OS and the Symbian mobile and include Windows Mobile OS and the Symbian OS.OS.

Enables the user to perform tasks from anywhere in the Enables the user to perform tasks from anywhere in the world in a secure and reliable environment.world in a secure and reliable environment.

Applications include office documents, controlling remote Applications include office documents, controlling remote objects and providing interconnectivity with other wireless objects and providing interconnectivity with other wireless devices using Bluetooth, WAP and Infrared.devices using Bluetooth, WAP and Infrared.

Available as a standard on virtually every 2.5-3G phone and Available as a standard on virtually every 2.5-3G phone and PDA.PDA.

Why Symbian Platform over WindowsWhy Symbian Platform over Windows

Was initially developed by leading cellular manufacturers Was initially developed by leading cellular manufacturers such as Nokia, Motorola and Ericsson to counter Microsoft such as Nokia, Motorola and Ericsson to counter Microsoft Windows monopoly over the PC and wireless market.Windows monopoly over the PC and wireless market.

Symbian platform is based on an open source code which Symbian platform is based on an open source code which allows independent software vendors to develop third party allows independent software vendors to develop third party applications, services and services.applications, services and services.

Cost is reduced dramatically since most of the software is Cost is reduced dramatically since most of the software is developed by various cell phone makers resulting in intense developed by various cell phone makers resulting in intense competition and reduced costs for the end user.competition and reduced costs for the end user.

Approximately 80% of the world’s 3G GSM phones operate Approximately 80% of the world’s 3G GSM phones operate on Symbian platforms 7.0 and above.on Symbian platforms 7.0 and above.

Security Layers in ArchitectureSecurity Layers in Architecture

Symbian OS v9.0 Platform Security and Security Services

Security Layers in Architecture Security Layers in Architecture (Cont)(Cont)

The security subsystem provides underlying support for The security subsystem provides underlying support for secure communications protocols such as SSL and secure communications protocols such as SSL and authentication of installable software using digital authentication of installable software using digital signatures.signatures.

Users are prompted the minute an unverifiedUsers are prompted the minute an unverified

installation is about to take place.installation is about to take place.

Security ModulesSecurity ModulesCRYPTOGRAPHIC MODULECRYPTOGRAPHIC MODULE

The cryptography module includes the following significant The cryptography module includes the following significant components: components:

Cryptography algorithms which allow data to be encrypted Cryptography algorithms which allow data to be encrypted and decrypted and support ciphering.and decrypted and support ciphering.

Pseudo-random number generator for generating Pseudo-random number generator for generating cryptographic keys. cryptographic keys.

Hash functions such as MD5, SHA1 and HMACHash functions such as MD5, SHA1 and HMAC

Security Modules (Cont)Security Modules (Cont)CERTIFICATE MANAGEMENT MODULECERTIFICATE MANAGEMENT MODULE

The certificate management module is used for The certificate management module is used for authentication of other entities such as third-party authentication of other entities such as third-party developers and web servers to the user of the phone and developers and web servers to the user of the phone and vice versa.vice versa.

Verification of trust of a certificate.Verification of trust of a certificate.

Storage and retrieval of certificates using the cryptographic Storage and retrieval of certificates using the cryptographic token framework.token framework.

Assignment of trust status to a certificate on an application-Assignment of trust status to a certificate on an application-by-application basis. by-application basis.

DrawbacksDrawbacks Initial cost of the instrument is high (in the range of $200 Initial cost of the instrument is high (in the range of $200

onwards) and this limits its spread and development.onwards) and this limits its spread and development.

Majority of the software installation done by the user thereby not Majority of the software installation done by the user thereby not making it friendly for the end user.making it friendly for the end user.

Since source is open code, its vulnerable to attacks by mobile Since source is open code, its vulnerable to attacks by mobile viruses such as ‘Cabir’ which was the world’s first mobile virus.viruses such as ‘Cabir’ which was the world’s first mobile virus.

BLUETOOTH ENABLED INFILTRATION AND INSTALLATION DETECTION AND DELETION

Future Developments in Symbian SecurityFuture Developments in Symbian Security

Recent collaboration with arch rival Microsoft in March 2005 Recent collaboration with arch rival Microsoft in March 2005 which will change the way in which end users communicate which will change the way in which end users communicate via email.via email.

This move alone will allow roughly 400m users of Symbian This move alone will allow roughly 400m users of Symbian phones to access Microsoft’s most secure client mail server phones to access Microsoft’s most secure client mail server in a Windows free environment.in a Windows free environment.

This could eventually lead to information sharing among This could eventually lead to information sharing among major vendors resulting in lowering of prices and eventually major vendors resulting in lowering of prices and eventually making the instrument widely available.making the instrument widely available.

SummarySummary Its birth took place to prevent the monopoly of MicrosoftIts birth took place to prevent the monopoly of Microsoft

from spreading to the wireless market too and most of us from spreading to the wireless market too and most of us have not even realized the true potential of Symbian.have not even realized the true potential of Symbian.

Symbian is a British based company which has the support Symbian is a British based company which has the support of almost all the existing manufactures. of almost all the existing manufactures.

Security itself will outgrow all Security itself will outgrow all

expectations to be a multi-billion expectations to be a multi-billion

dollar industry.dollar industry.

Slide shotsSlide shots

EXCEL SHEETS BUFFER RECORDS MINI POWEPOINT