Search

In a mobile ubiquitous environment, service interactions between a user device and a service provider should be secure, regardless of the type of device used to access or consume a service. We present a Secure Device Management Framework (SDMF), designed to securely deliver services to user devices, whilst also hiding (some of) the complexity of security management from users. Key to this framework is the Device Management Entity (DME), that manages a user device's security credentials, and interacts with service providers on its behalf. This framework also provides users with assurance that a compromised device cannot consume the delivered service, and, at the same time, prevents users from illegally sharing their credentials with other users. We achieve these objectives using Trusted Computing functionality and certain other security mechanisms.

The intent of trusted computing is to ensure that an information-processing device functions according to expectations. If the device has been designed to offer security protections, then it is reasonable for these expectations to include some assurance that the device will protect the security interests of the device's stakeholders. In the case of mobile phones, there are many different stakeholders that have diverse security interests. This paper discusses stakeholder interests in a mobile phone, describes how those interests are addressed using the Trusted Platform Module (TPM) specified by the Trusted Computing Group (TCG), and explains how improved protections are provided using the Freescale Advanced Trusted Platform (ATP).

This article is based upon the real experiences of one of the world's largest “private trusted networks” -S.W.I.F.T. which provides secure messaging services and interface software to over 5,400 financial institutions in 139 countries. It describes the level of trust typically expected from a Trusted Network and the responsibilities that a TTP (trusted third party) must accept if it is to provide trusted services. A general view of how TTPs might operate has been provided to explain their responsibilities.