Feeds

OMTP publishes standard, but what is it really securing?

At least the Home Secretary is pleased

Providing a secure and efficient Helpdesk

The Open Mobile Terminal Platform group has finally published the security documents it outlined last year, and got the UK home secretary to say what a good thing that is.

The OMTP is just an operator talking shop really, no-one is under any obligation to implement the standards they propose, but the operators will look favorably on handsets that conform to the freely-available standards the OMTP publishes.

The security proposals are much as outlined back in October, but with more detail and a focus on ensuring the integrity of the operating system rather than securing applications, which will be left to the platform.

The basic concept is to have the OS image verified before loading, then providing the capability to confirm that integrity while running, so hacks can't be applied even after the OS is up and running. Obviously that's going to require a secure store in the hardware, with the ability to verify digital signatures and override the OS if necessary.

What this means is that the OS can't be interfered with in any way, so it will be impossible to write an application that intercepts keys being pressed (to collect passwords, for example) or one that grabs the screen display to collect confidential information.

All very laudable, and endorsed by Jacqui Smith: "I am pleased that the mobile industry continues to show its commitment to enhance the security of mobile phones," she said.

The problem is that one man's hack is another's utility. Being able to grab screens, from any application, is a very useful tool, particularly for journalists, and intercepting key presses can be used for everything from instant access to applications to redirecting callers to websites. It will be up to manufacturers to decide which parts of their OS are sacrosanct and which are open to developers, but they'll have to be very careful not to cast the net too wide.

These days operators and even manufacturers are increasingly involved in content distribution, and it's clear that this "Advanced Trusted Environment: OMTP TR1" will also prevent applications that intercept content that's been decoded for playback - making effective DRM much more feasible.

It will be interesting to see if mobile phones remain the relatively safe platforms they are, or descend into the constant war that personal computers are required to wage against the tide of malware and infection. The Advanced Trusted Environment is a vote for the former, but users might accept the latter as the price of flexibility in their phones. ®

Choosing a cloud hosting partner with confidence

More from The Register

next story
Same old iPad? NO. The new 'soft SIMs' are BIG NEWS
AppleSIM 'ware to allow quick switch of carriers
Brits: Google, can you scrape 60k pages from web, pleeease
Hey, c'mon Choc Factory, it's our 'right to be forgotten'
Of COURSE Stephen Elop's to blame for Nokia woes, says author
'Google did have some unique propositions for Nokia'
FCC, Google cast eye over millimetre wireless
The smaller the wave, the bigger 5G's chances of success
It's even GRIMMER up North after MEGA SKY BROADBAND OUTAGE
By 'eck! Eccles cake production thrown into jeopardy
Mobile coverage on trains really is pants
You thought it was just *insert your provider here*, but now we have numbers
Don't mess with Texas ('cos it's getting Google Fiber and you're not)
A bit late, but company says 1Gbps Austin network almost ready to compete with AT&T
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Win a year’s supply of chocolate
There is no techie angle to this competition so we're not going to pretend there is, but everyone loves chocolate so who cares.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.