Feeds

EU approves push to get the unknown security in ARM chips into use

Chipmaker must promise to let others join the TEE party

Internet Security Threat Report 2014

The European Commission has approved the creation of a new secure-element company backed by ARM, Gemalto and Giesecke & Devrient, just as long as ARM promises to keep its hardware open.

The new company will develop and sell products running software from G&D and Gemalto on the TrustZone element embedded in ARM chips, complete with management software, but the EU required promises from ARM that it wouldn't unfairly lock out competitive offerings.

"ARM will provide the necessary hardware information to competitors at the same conditions as to the joint venture to enable them to develop alternative TEE [Trusted Execution Environment] solutions. Moreover, ARM will not design its IP in a way that would degrade the performance of alternative TEE solutions."

That restriction lasts eight years, after which all bets are off.

ARM will own 40 of cent of the new venture, which builds on the growing need for better security on smartphones and other mobile devices, with Gemalto and G&D splitting the remaining 60 per cent between them. However, as the two software companies currently have different business models for their code (Gemalto licenses while G&D gives it away, making money on the servers) the model to be adopted by the new venture is a still work in progress.

TrustZone is built into ARM's chip designs, which are licensed out to processor manufacturers which have put the technology into around 90 per cent of mobile phones, though very few have the software to take advantage of it. Neither can that software easily be downloaded, as downloaded software can't be trusted, but the facility can easily be utilised in new handsets where the software can be securely preloaded.

Such apps run with the TrustZone, isolating them from the operating system and malware which could be lurking there. The process is not as secure as putting the secure element in the SIM, according to the SIM manufacturers at least, but it’s a good deal more secure than the phone's architecture.

But despite the ubiquity of TrustZone, and its ability to secure the OS, verify downloads, authenticate users and prevent man-in-the-middle attacks, almost no one is using it, which is what's promoting this new collaboration. The three companies will promote a single trusted execution environment making it much easier for banks, and other people interested in secure tokens, to create applications, and competing with the operator-owned secure element in the SIM.

NFC Times has more details, and points out that GlobalPlatform has been busy creating a standard API for communicating with an embedded secure element which could be important as phones with Intel chips inside use that company's Secure Element instead.

So soon we won't have to trust our mobile phone OS at all, we'll just have to trust the Secure Element supplier instead, which is (probably) good news for all concerned. ®

Providing a secure and efficient Helpdesk

More from The Register

next story
Will.i.am gets CUFFED as he announces his new wristjob, the PULS
It's got four KILOWATTS of something, apparently
Don't wait for that big iPad, order a NEXUS 9 instead, industry little bird says
Google said to debut next big slab, Android L ahead of Apple event
Netscape Navigator - the browser that started it all - turns 20
It was 20 years ago today, Marc Andreeesen taught the band to play
A drone of one's own: Reg buyers' guide for UAV fanciers
Hardware: Check. Software: Huh? Licence: Licence...?
Apple SILENCES Bose, YANKS headphones from stores
The, er, Beats go on after noise-cancelling spat
Jaguar Sportbrake: The chicken tikka masala of van-sized posh cars
Indian-owned Jag's latest offering curries favour with us
The Apple launch AS IT HAPPENED: Totally SERIOUS coverage, not for haters
Fandroids, Windows Phone fringe-oids – you wouldn't understand
Here's your chance to buy an ancient, working APPLE ONE
Warning: Likely to cost a lot even for a Mac
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Win a year’s supply of chocolate
There is no techie angle to this competition so we're not going to pretend there is, but everyone loves chocolate so who cares.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.