1!

TPM

FINGERPRINTSECURE

USB

FACE

BIOMETRIC

PIN

TOKEN

RBA

PASSIVE

ACTIVE

SILENT

TPM

FINGERPRINT

VOICE

SECURE

ELEMENT

NFC

USB

FACE

BIOMETRIC

PIN TOKEN

RBA

ACTIVE

SILENT

TPM

FINGERPRINT

VOICEELEMENT

NFC

USB

FACE

BIOMETRIC

TOKEN

RBA

PASSIVE

ACTIVE

SILENT TPM

VOICE

SECURE

ELEMENT

NFC

USB

FACE

PIN

TOKEN

RBA

PASSIVEACTIVE

SILENT

TPM

FINGERPRINT

VOICE

NFC

USB

FACE

BIOMETRIC

TOKEN

RBA

PASSIVE

ACTIVE

SILENT

TPM

FINGERPRINT

VOICE

SECURENFC

USB

FACE

PIN

PASSIVE

ACTIVE

TPM

FINGERPRINT

VOICE

ELEMENT

NFC

USB

FACE

BIOMETRIC

TOKEN

RBA

ACTIVE

SILENT

TPM

FINGERPRINT

VOICE

SECURENFC

FACE

PIN

RBA

PASSIVE

ACTIVE

SILENT

TPM

FINGERPRINT

VOICE

SECURE

ELEMENT

NFC

USB

FACE

PINACTIVE

SILENT

TPM

ELEMENT

NFC

USB

FACE

BIOMETRIC

PIN

PASSIVE

SILENT

TPM

FINGERPRINT

VOICE

SECURE

ELEMENT

NFC

USB

FACE

PIN

TOKEN

PASSIVE

ACTIVE

FINGERPRINT

VOICE

SECURE

ELEMENT

USB

BIOMETRIC

PIN

TOKEN

RBA PASSIVE

ACTIVE

VOICE

SECURE

NFC

FACE

TOKEN

PASSIVEACTIVE

TPM

ELEMENT

NFC

USB

FACE

PIN

TOKEN

RBA

TPM

FINGERPRINT

SECURE

NFC

USB

FACE

PIN

TOKEN

RBA

PASSIVE

ACTIVE

SILENT

TPM

FINGERPRINT

VOICE

NFC

FACE

BIOMETRIC

PIN

PASSIVE

SILENT

ELEMENT

NFC

USB

TOKEN

RBA

PASSIVE

TPM

VOICE

SECURE

ELEMENT

NFC

FACE

BIOMETRIC

PIN

ACTIVE

TPM

FINGERPRINT

SECURE

USB

TOKEN

ACTIVE SILENT

TPM

FINGERPRINT

VOICENFC

USB

FACE

PIN

TOKEN

RBA

PASSIVE

ACTIVE

SILENT

TPM

SECURE

ELEMENT

USB

FACE

PIN

TOKEN

RBA

SILENT

TPMELEMENT

NFC

USB

FACE

PIN

TOKEN

RBA

PASSIVE

SILENT

TPM

ELEMENT

NFC

USB

PIN

TOKEN

RBA

ACTIVE

FINGERPRINT

ELEMENT

USB

TPM

VOICE

ELEMENT

USB

PIN

RBA

PASSIVE

ACTIVE

TPM

VOICE

SECURE

ELEMENT

USB

FACE

ACTIVE

FINGERPRINT

VOICE

PIN

RBA

PASSIVE

ACTIVE

TPM

FINGERPRINT

ELEMENT

FACE

TOKEN

RBA

ACTIVE

TPM

ELEMENT

NFC

USB

FACE

BIOMETRIC

RBA

ACTIVE

SILENT

TPM

FINGERPRINT

SECURE

ELEMENT

USB

FACE

PIN

TOKEN

PASSIVE

SILENT

VOICE

USB

FACE

BIOMETRIC

RBA

ACTIVE

SECURE

NFC

USB

BIOMETRIC

PIN

SILENT

TPM

VOICE

NFC

USB

FACE

PIN

USB

FACE

BIOMETRIC

PIN

RBA

ACTIVE

FINGERPRINT

NFC

TOKEN

RBA

VOICE

ELEMENT

USB

FACE

PIN

RBA

SILENT

VOICE

SECURE

FACE

PIN

RBA

PASSIVE

ACTIVE

SILENT

TPM

FINGERPRINT

VOICE

RBA

ACTIVE

TPM

FACE

TOKEN

RBA

ACTIVE SILENT

VOICE

ELEMENT

USB

FACE

PIN

RBA

ACTIVE

SILENT

PIN

TOKEN

RBA

VOICE

SECURE

NFC

USB

TOKEN

PASSIVE

ACTIVE

TPM

FACE

BIOMETRIC

TOKEN

ACTIVE

TPM

FACE

NFC

USB

FACE

BIOMETRIC

TOKEN

PASSIVE

PIN

ACTIVE

TPM

VOICE

ELEMENT

NFC

TPM

VOICE

NFC

USB

FACE

TOKEN

RBA

TPM USB

FACE

BIOMETRIC

RBA

PASSIVE

SILENT

USB

BIOMETRIC

TPM

SECURE

NFC

PIN

RBA

PASSIVE

SILENT

VOICE

SILENT

VOICE

ELEMENT

USB

PIN

TOKEN

RBA

PASSIVE

NFC

FACE

BIOMETRIC

TOKEN

RBA

SILENT

TPM

SECURE

SILENT

VOICE

USB

RBA

USB

FACE

RBA

VOICE

RBA

SILENT

SECURE

USB

PIN

RBA

SILENT

TPM

ELEMENT

USB

FACE

VOICE

NFC

USB

TOKEN

RBA

SECURE

FACE

TPM

FACE

PIN

FINGERPRINT

NFC

RBA

SILENT

USB

FACE

PIN

ACTIVE

SILENT

PIN

RBA

NFC

USB

BIOMETRIC

TPM

VOICE

USB

FACE

PASSIVE

ELEMENT

TOKEN

TPM

VOICE

SILENT

NFC

USB

PIN

RBA

SILENT

TPM

VOICE

NFC

USB

FACE

PASSIVE

TPM

VOICE

TPM

NFC

PIN

TOKEN

ACTIVE

SECURE

USB

RBA

PASSIVE

NFC

USB

FACE

RBA

TPM

TOKEN

PASSIVE

SECURE

USB

FACE

ACTIVE

TPM

FACE

PIN

RBA

VOICE

USB

PASSIVE

TOKEN

RBA

NFC

USB

SILENT

USB

RBA

FACE

PIN

ACTIVE

NFC

USB

USB

PIN

RBA

NFC

SILENT

TPM

VOICE

FACE

PIN

TPM

NFC

USB

TPM

RBA

PASSIVE

NFC

USB

PIN

TPM

PIN

PASSIVE

PIN

USB

TPM

NFC

USB

FACE

FACE

RBA

SILENT

FINGERPRINT

USB

NFC

USB

ACTIVE

VOICE

USB

TPM

PIN

RBA

FACE

TPM

TPM

USB

PIN

TPM

NFC

FACE

TOKEN

RBA

USB

PASSIVE

VOICE

NFC

PIN

USB

FACE

USB

RBA

TPM

PIN

NFC

FACE

RBA

ACTIVE

TPM

USB

USB

TPM

PIN

FACE

NFC

USB

PIN

RBA

FACE

USB

USB

RBA

NFC

NFC

TPM

NFC

RBA

USB

PIN

NFC

USB

PIN

USB

ELEMENT

PIN

PIN

TPM

USB

USB

TPM

VOICE

NFC

RBA

USB

RBA

RBA

PIN

USB

USB

USB

USB

NFC

USB

NFC

USB

TPM

FACE

USB

PIN

USB

USB

PIN

NFC

VOICE

NFC

USB

USB

USB

USB

FACE

TPM

USB

TPM

USB

USB

TPM

USB

FACE

NFC

RBA

USB

USB

USB

FACE

USB

USB

RBA

PIN

VOICE

USB

PIN

USB

USB

RBA

USB

TPM

RBA

RBA

PIN

NFC

NFC

USB

TPM

USB

TPM

USB

USB

USB

USB

NFC

TPM

NFC

FACE

USB

FACE

USB

USB

TPM

USB

USB

USB

USB

USB

FACE

USB

USB

USB

USBRBA

USB

USB

USB

USB

USB

USB

USB

RBA

USB

USB

USB

NFC

USB

USB

USB

USB

USB

USB

USB

USB

USB

USB

USB

USB

USB

USB

USB

USB

BUILDING BLOCKS!FOR MOBILE SECURITY!AND AUTHENTICATION!

ELEMENTS OF INTEGRITY & SECURITY !

Device Integrity!(Is the hardware the right hardware?) !

Network Integrity!(Am I talking to the right network resource,

can I trust that resource) !

OS & App Integrity!(Did someone tamper with my OS, is there

malware, am I talking to the right app?) !

User Integrity!(Is the user the right user?) !

Data & Transaction Integrity !

2!

SECURITY IS ONLY AS STRONG AS THE WEAKEST LINK!

3!

Integrity Hardware! OS! App! Network! User!

Patch when you find a gap! Security Whack-A-Mole!

A UNIQUE OPPORTUNITY !

4!

Hardware Integrity!

OS Integrity!

App Integrity!

Network Integrity!

User Integrity!

Re-Architect Computing Using Hardware-Based Trust !

Chain of Trust!

Trusted Platform!

THE MOBILE EPOCH !

5!

INTEGRITY MECHANISMS – I !

•  TPMs!•  Backwards compatibility requirements !

•  SEs!•  Limited due to operator controls!

•  TEEs!•  Third time is a charm?!

•  Secure boot !- Verification of image!

•  Virtualization!- Hardware assisted isolation!

•  Anti-virus !•  Device Theft Response!- Standard on mobile devices !

6!

TEE! SE! TPM!

Hardware OS

INTEGRITY MECHANISMS – II !

7!

App User

•  App verification!- Rise Of The App Store!

•  App Isolation!- App containers !- Restricted IPC !

•  Protecting Data & Content!- On-device data encryption !- DRM !

•  Identity Proofing!- Know your customer!

•  Strong Authentication!- Explicit & implicit!-  First mile & Second mile!

FOUNDATION OF A TRUSTED PLATFORM !

8!

Partition! Partition!

Partition Manager!

Hardware!

System Protection!

PII Handling!

!Evidence/

Measurement!!

Reporting/Attestation!

!Platform

Management!!

Policy Engine!

Hardware!Protected Storage!

Randomness!

Detection & Inspection!

Sequencing!

Architecture!Performance!

Within Partition!!Protected

Execution!

Outside!!

External !Access!

Between Partitions!!Isolation!

Trusted Channel!

ISOLATION ARCHITECTURE ARM TRUSTZONE !

9!

Secure OS Boot!

FP Sensor!

Touchscreen!

Storage !

1.7 B ARM Cortex

SoCs Shipped!

18 Month Phone Refresh

Rate!

PROTECTED EXECUTION TRUSTONIC TEE !

10!

App!

TEE!

Normal!

App!TEE Enabled!

Rich OS!

Trustlet!

500M TEEs Shipped!

TRUSTED PLATFORMS IN PRACTICE!

11!

iOS Samsung Knox

Trustzone-based Integrity Management Architecture!(TIMA)!

Security Enhancements for Android!

BUILDING BLOCKS AVAILABLE BUT CAPABILITIES ARE NOT EXERCISED!

• Access Limitations !- TPM !-  SE!-  TEE!

•  Integration pain!- Need usable abstractions,

standardization, ecosystems, partnerships!

!•  Inter-party verification of

components!- Need operational relationships!

12!

BUILDING THE PLUMBING!

13!

Hardware Integrity

User Integrity

OS & App Integrity

Network Integrity

ROUGH CONSENSUS + WORKING CODE !

14!

50-60M Units!Expected to ship!

Galaxy S5 World’s First FIDO Ready Smartphone

Any Device.!Any Application.!Any Authenticator. !

15!

TPM

FINGERPRINTSECURE

USB

FACE

BIOMETRIC

PIN

TOKEN

RBA

PASSIVE

ACTIVE

SILENT

TPM

FINGERPRINT

VOICE

SECURE

ELEMENT

NFC

USB

FACE

BIOMETRIC

PIN TOKEN

RBA

ACTIVE

SILENT

TPM

FINGERPRINT

VOICEELEMENT

NFC

USB

FACE

BIOMETRIC

TOKEN

RBA

PASSIVE

ACTIVE

SILENT TPM

VOICE

SECURE

ELEMENT

NFC

USB

FACE

PIN

TOKEN

RBA

PASSIVEACTIVE

SILENT

TPM

FINGERPRINT

VOICE

NFC

USB

FACE

BIOMETRIC

TOKEN

RBA

PASSIVE

ACTIVE

SILENT

TPM

FINGERPRINT

VOICE

SECURENFC

USB

FACE

PIN

PASSIVE

ACTIVE

TPM

FINGERPRINT

VOICE

ELEMENT

NFC

USB

FACE

BIOMETRIC

TOKEN

RBA

ACTIVE

SILENT

TPM

FINGERPRINT

VOICE

SECURENFC

FACE

PIN

RBA

PASSIVE

ACTIVE

SILENT

TPM

FINGERPRINT

VOICE

SECURE

ELEMENT

NFC

USB

FACE

PINACTIVE

SILENT

TPM

ELEMENT

NFC

USB

FACE

BIOMETRIC

PIN

PASSIVE

SILENT

TPM

FINGERPRINT

VOICE

SECURE

ELEMENT

NFC

USB

FACE

PIN

TOKEN

PASSIVE

ACTIVE

FINGERPRINT

VOICE

SECURE

ELEMENT

USB

BIOMETRIC

PIN

TOKEN

RBA PASSIVE

ACTIVE

VOICE

SECURE

NFC

FACE

TOKEN

PASSIVEACTIVE

TPM

ELEMENT

NFC

USB

FACE

PIN

TOKEN

RBA

TPM

FINGERPRINT

SECURE

NFC

USB

FACE

PIN

TOKEN

RBA

PASSIVE

ACTIVE

SILENT

TPM

FINGERPRINT

VOICE

NFC

FACE

BIOMETRIC

PIN

PASSIVE

SILENT

ELEMENT

NFC

USB

TOKEN

RBA

PASSIVE

TPM

VOICE

SECURE

ELEMENT

NFC

FACE

BIOMETRIC

PIN

ACTIVE

TPM

FINGERPRINT

SECURE

USB

TOKEN

ACTIVE SILENT

TPM

FINGERPRINT

VOICENFC

USB

FACE

PIN

TOKEN

RBA

PASSIVE

ACTIVE

SILENT

TPM

SECURE

ELEMENT

USB

FACE

PIN

TOKEN

RBA

SILENT

TPMELEMENT

NFC

USB

FACE

PIN

TOKEN

RBA

PASSIVE

SILENT

TPM

ELEMENT

NFC

USB

PIN

TOKEN

RBA

ACTIVE

FINGERPRINT

ELEMENT

USB

TPM

VOICE

ELEMENT

USB

PIN

RBA

PASSIVE

ACTIVE

TPM

VOICE

SECURE

ELEMENT

USB

FACE

ACTIVE

FINGERPRINT

VOICE

PIN

RBA

PASSIVE

ACTIVE

TPM

FINGERPRINT

ELEMENT

FACE

TOKEN

RBA

ACTIVE

TPM

ELEMENT

NFC

USB

FACE

BIOMETRIC

RBA

ACTIVE

SILENT

TPM

FINGERPRINT

SECURE

ELEMENT

USB

FACE

PIN

TOKEN

PASSIVE

SILENT

VOICE

USB

FACE

BIOMETRIC

RBA

ACTIVE

SECURE

NFC

USB

BIOMETRIC

PIN

SILENT

TPM

VOICE

NFC

USB

FACE

PIN

USB

FACE

BIOMETRIC

PIN

RBA

ACTIVE

FINGERPRINT

NFC

TOKEN

RBA

VOICE

ELEMENT

USB

FACE

PIN

RBA

SILENT

VOICE

SECURE

FACE

PIN

RBA

PASSIVE

ACTIVE

SILENT

TPM

FINGERPRINT

VOICE

RBA

ACTIVE

TPM

FACE

TOKEN

RBA

ACTIVE SILENT

VOICE

ELEMENT

USB

FACE

PIN

RBA

ACTIVE

SILENT

PIN

TOKEN

RBA

VOICE

SECURE

NFC

USB

TOKEN

PASSIVE

ACTIVE

TPM

FACE

BIOMETRIC

TOKEN

ACTIVE

TPM

FACE

NFC

USB

FACE

BIOMETRIC

TOKEN

PASSIVE

PIN

ACTIVE

TPM

VOICE

ELEMENT

NFC

TPM

VOICE

NFC

USB

FACE

TOKEN

RBA

TPM USB

FACE

BIOMETRIC

RBA

PASSIVE

SILENT

USB

BIOMETRIC

TPM

SECURE

NFC

PIN

RBA

PASSIVE

SILENT

VOICE

SILENT

VOICE

ELEMENT

USB

PIN

TOKEN

RBA

PASSIVE

NFC

FACE

BIOMETRIC

TOKEN

RBA

SILENT

TPM

SECURE

SILENT

VOICE

USB

RBA

USB

FACE

RBA

VOICE

RBA

SILENT

SECURE

USB

PIN

RBA

SILENT

TPM

ELEMENT

USB

FACE

VOICE

NFC

USB

TOKEN

RBA

SECURE

FACE

TPM

FACE

PIN

FINGERPRINT

NFC

RBA

SILENT

USB

FACE

PIN

ACTIVE

SILENT

PIN

RBA

NFC

USB

BIOMETRIC

TPM

VOICE

USB

FACE

PASSIVE

ELEMENT

TOKEN

TPM

VOICE

SILENT

NFC

USB

PIN

RBA

SILENT

TPM

VOICE

NFC

USB

FACE

PASSIVE

TPM

VOICE

TPM

NFC

PIN

TOKEN

ACTIVE

SECURE

USB

RBA

PASSIVE

NFC

USB

FACE

RBA

TPM

TOKEN

PASSIVE

SECURE

USB

FACE

ACTIVE

TPM

FACE

PIN

RBA

VOICE

USB

PASSIVE

TOKEN

RBA

NFC

USB

SILENT

USB

RBA

FACE

PIN

ACTIVE

NFC

USB

USB

PIN

RBA

NFC

SILENT

TPM

VOICE

FACE

PIN

TPM

NFC

USB

TPM

RBA

PASSIVE

NFC

USB

PIN

TPM

PIN

PASSIVE

PIN

USB

TPM

NFC

USB

FACE

FACE

RBA

SILENT

FINGERPRINT

USB

NFC

USB

ACTIVE

VOICE

USB

TPM

PIN

RBA

FACE

TPM

TPM

USB

PIN

TPM

NFC

FACE

TOKEN

RBA

USB

PASSIVE

VOICE

NFC

PIN

USB

FACE

USB

RBA

TPM

PIN

NFC

FACE

RBA

ACTIVE

TPM

USB

USB

TPM

PIN

FACE

NFC

USB

PIN

RBA

FACE

USB

USB

RBA

NFC

NFC

TPM

NFC

RBA

USB

PIN

NFC

USB

PIN

USB

ELEMENT

PIN

PIN

TPM

USB

USB

TPM

VOICE

NFC

RBA

USB

RBA

RBA

PIN

USB

USB

USB

USB

NFC

USB

NFC

USB

TPM

FACE

USB

PIN

USB

USB

PIN

NFC

VOICE

NFC

USB

USB

USB

USB

FACE

TPM

USB

TPM

USB

USB

TPM

USB

FACE

NFC

RBA

USB

USB

USB

FACE

USB

USB

RBA

PIN

VOICE

USB

PIN

USB

USB

RBA

USB

TPM

RBA

RBA

PIN

NFC

NFC

USB

TPM

USB

TPM

USB

USB

USB

USB

NFC

TPM

NFC

FACE

USB

FACE

USB

USB

TPM

USB

USB

USB

USB

USB

FACE

USB

USB

USB

USBRBA

USB

USB

USB

USB

USB

USB

USB

RBA

USB

USB

USB

NFC

USB

USB

USB

USB

USB

USB

USB

USB

USB

USB

USB

USB

USB

USB

USB

USB

Appendix!

PRIVATE & CONFIDENTIAL! 16!