Feeds

EU approves push to get the unknown security in ARM chips into use

Chipmaker must promise to let others join the TEE party

Mobile application security vulnerability report

The European Commission has approved the creation of a new secure-element company backed by ARM, Gemalto and Giesecke & Devrient, just as long as ARM promises to keep its hardware open.

The new company will develop and sell products running software from G&D and Gemalto on the TrustZone element embedded in ARM chips, complete with management software, but the EU required promises from ARM that it wouldn't unfairly lock out competitive offerings.

"ARM will provide the necessary hardware information to competitors at the same conditions as to the joint venture to enable them to develop alternative TEE [Trusted Execution Environment] solutions. Moreover, ARM will not design its IP in a way that would degrade the performance of alternative TEE solutions."

That restriction lasts eight years, after which all bets are off.

ARM will own 40 of cent of the new venture, which builds on the growing need for better security on smartphones and other mobile devices, with Gemalto and G&D splitting the remaining 60 per cent between them. However, as the two software companies currently have different business models for their code (Gemalto licenses while G&D gives it away, making money on the servers) the model to be adopted by the new venture is a still work in progress.

TrustZone is built into ARM's chip designs, which are licensed out to processor manufacturers which have put the technology into around 90 per cent of mobile phones, though very few have the software to take advantage of it. Neither can that software easily be downloaded, as downloaded software can't be trusted, but the facility can easily be utilised in new handsets where the software can be securely preloaded.

Such apps run with the TrustZone, isolating them from the operating system and malware which could be lurking there. The process is not as secure as putting the secure element in the SIM, according to the SIM manufacturers at least, but it’s a good deal more secure than the phone's architecture.

But despite the ubiquity of TrustZone, and its ability to secure the OS, verify downloads, authenticate users and prevent man-in-the-middle attacks, almost no one is using it, which is what's promoting this new collaboration. The three companies will promote a single trusted execution environment making it much easier for banks, and other people interested in secure tokens, to create applications, and competing with the operator-owned secure element in the SIM.

NFC Times has more details, and points out that GlobalPlatform has been busy creating a standard API for communicating with an embedded secure element which could be important as phones with Intel chips inside use that company's Secure Element instead.

So soon we won't have to trust our mobile phone OS at all, we'll just have to trust the Secure Element supplier instead, which is (probably) good news for all concerned. ®

Boost IT visibility and business value

More from The Register

next story
iPad? More like iFAD: We reveal why Apple fell into IBM's arms
But never fear fanbois, you're still lapping up iPhones, Macs
For Lenovo US, 8-inch Windows tablets are DEAD – long live 8-inch Windows tablets
Reports it's killing off smaller slabs are greatly exaggerated
Cheer up, Nokia fans. It can start making mobes again in 18 months
The real winner of the Nokia sale is *drumroll* ... Nokia
Microsoft unsheathes cheap Android-killer: Behold, the Lumia 530
Say it with us: I'm King of the Landfill-ill-ill-ill
Seventh-gen SPARC silicon will accelerate Oracle databases
Uncle Larry's mutually-optimised stack to become clearer in August
EU dons gloves, pokes Google's deals with Android mobe makers
El Reg cops a squint at investigatory letters
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Reducing security risks from open source software
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.