Security Strategies for Mixed Use Mobile Computing Devices

Smartphones are powerful computing devices that manipulate, store and transmit sensitive data and are becoming increasingly popular for malware attacks as a result. In order to use them for military purposes, a mesh of security techniques are needed in order to contain sensitive data and prevent it from leaving the device in an unapproved manner. Data separation primarily relies on address spaces defined by the operating system and enforced by the MMU of the processor, as well as permissions applied to data stored in files. Writing a new kernel in a secured development environment, or virtualizing the kernel and device drivers to run under a hypervisor, is the most direct way to increase the strength of data separation. However, it has technical limitations, it requires a handset-specific software solution, and it requires support of the handset manufacturer to build a custom system image. Rather than try to isolate all applications from each other, our solution is to isolate just the secure applications. Applying the proposed advanced platform integrity mechanisms along with secure data transformation for storage and transmission provides a complete solution against the adverse effects of intentional malware or accidental mishaps.