(Keynote) Protecting Data on Smartphones & Tablets using Trusted Computing
No ratings
Presented at grehack 2016 by
Smartphone and tablets have treasures of personal and highly sensitive data, such as our e-mails, our calendars, our phone call histories, our voice recordings, our notes, and even our health information. This data can be easily stolen or manipulated. For example, malware could siphon this data off to a remote server. Malicious applications can fabricate or alter sensors data by faking GPS locations or photoshopping photos. Even worse, moderately skilled attackers could read sensitive information straight from a stolen device's flash card or even from its volatile memory (RAM). This talk presents two approaches to data protection on smartphone and tablets. First, we build software abstractions designed for the security needs of today's operating systems, networks, and cloud systems. For example, we built a software-only implementation of a TPM chip that runs in the firmware of millions of Windows Phones and Microsoft Surfaces, and was the first hardware or software implementation to support the newly released TPM 2.0 specification. Other examples include software abstractions for trusted sensors and for the cloud, or a TPM designed from cross-device scenarios. Second, we make use of trusted computing hardware to design and implement systems that offer strong security protections against malware, malicious applications, and attackers. For example, we will present Sentry, a system that allows mobile applications and OS components to store their code and data on the ARM System-on-Chip (SoC) rather than in volatile memory. With Sentry, smartphones and tablets can become much more resilient against memory-based attacks, such as cold-boot, using a bus monitor to observe the memory bus, and DMA attacks. Another example is Trusted Language Runtime a small runtime that offers a .NET interface to ARM TrustZone. TLR enables separating an application's security-sensitive logic from the rest of the application, and isolates it from the OS and other applications. All this work is done jointly with many researchers at Microsoft Research, engineers in the Windows group at Microsoft, and students from ETH Zurich, Max-Planck Institute for Software Systems, U. of British Columbia, and U. of California at San Diego.