Securing Android Apps using Trusted Execution Environment (TEE) - 07/08/14

Securing Android Apps using Trusted Execution Environment (TEE)- 07/08/14 Presented by:Mike Hendrick VP Product Dev @ Sequitur Labs

Company Background Team Founding • Incorporated in 2010 • Prior decade of work on mobile platforms • Domain expertise in authorization/authentication • Large enterprise policy frameworks • Phil Attfield – CEO, (Founder Signal9, acquired by McAfee) • Paul Chenard - CTO • Mark Reed – COO • Abhijeet Rane – VP Marketing • Mike Hendrick – VP Product Dev Experience Customers and Partners • Deep Experience in • Network security • Embedded systems / mobile • Massive scale telecom systems • Boeing, T-Mobile, Qualcomm, HP • AT&T • Trustonic • ARM (working relationship) • Atmel (working relationship)

Overview Our Vision Develop enabling technologies and solutions to better secure and manage connected devices of today and the future. PCs Servers Tablets Smartphones IoT

Why does it matter? everyone is at risk. • Business enablers: Mobile + Devices + Cloud • New devices and use cases • Changing IT and information consumption environment for end users and enterprises • Changing and diverse security and manageability requirements • Traditional IT perimeter has vanished • The promise of mobility can only be realized if TRUST exists between users, services and devices $5.5 million U.S. average cost of data breach.

TrustZone and the TEE • ARM provides the reference design for the TrustZone to be incorporated by • SoC manufacturers • Device OEMs • Trustonic provides a Trusted Execution Environment (TEE) • Protects against software attack from open/Rich OS • Provides scalable and secure environment for apps like user auth, anti-malware, transactions • Two separate domains, normal and secure • Extends across entire system • Secure • Processing path • On/off-chip memory • I/O and display • Increasingly available on devices Trustonic Trustonic Driver API Trustonic TEE Trustonic Driver Trustonic Driver Kernel Module API Trustonic Microkernel Trustonic Driver Kernel Module

A healthy eco-system is forming around the TEE Trustonic TEE Eco-system

DeadBolt™ – streamlining access to the tee Android Application Sequitur DeadBolt™ Java Library Secure Storage TEE-SSL Authentication +++ Sequitur Trusted Applications Secure Storage TEE-SSL Authentication +++ Trustonic Trusted Execution Environment TrustZone enabled SoC

DeadBolt Encrypt • DeadBolt Encrypt – provides data at rest encrypted storage • 256 AES CBC cypher • Encrypt an OutputStream • Decrypt an InputStream • DBCryptParams – specifies crypto parameters • APK_BOUND • KEY_BOUND • DEV_BOUND • CUSTOM_BOUND • NOT_BOUND • Errors • Exception • Version

DeadBolt Encrypt – Difference from Standard Android • Using FileOutputStream: FileOutputStreamfos = new FileOutputStream(pictureFile); • Using DBEncryptFileOutputStream: DBEncryptFileOutputStreamfos = new DBEncryptFileOutputStream(picturefile, MainActivity.main_activity, new DBCryptParams(MainActivity.CryptoParamMask, MainActivity.CryptoPassword));

DeadBolt SSL • Preform SSL encryption in the TEE • Only call is to initialize the connection DBSSL.Init(context);DBSSLSocketFactory.InitHttpsDefault(); Or Socket sock=DBSSLSocketFactory.createSocket(host,port);

DeadBolt Authorization (Future) • Local Authorization via Trusted User Interface • Number PIN Code • AlphaNumeric Passcode • One Time Password – HOTP based on RFC 4226 • Remote Authorization • Key Pair Generation • Secure delivery of Key to Server • Message Signing and Encryption • Message Validation and Decryption

Developing TEE secured apps with DeadBolt™ • Sequitur simplifies the development and commercial activation of a TEE secured app • Does not require developers with systems level development experience • Does not require learning new platform primitives • Significantly lower cost of initial and ongoing investment • Rapid time to market Sequitur Developer Portal $$

DeadBolt™- Key benefits

Sequitur Labs Inc. • Contact • Abhijeet Rane, VP Marketing, Abhijeet.rane@seqlabs.com • Jennifer Multari, MarCom Manager, Jennifer.Multari@seqlabs.com • Mike Hendrick, VP Product Development, Mike.Hendrick@seqlabs.com • www.seqlabs.com

Securing Android Apps using Trusted Execution Environment (TEE) - 07/08/14