Maemo 6 Platform Security
This is a modal window.
The media could not be loaded, either because the server or network failed or because the format is not supported.
Formal Metadata
| Title |
| |
| Subtitle |
| |
| Alternative Title |
| |
| Title of Series | ||
| Number of Parts | 97 | |
| Author | ||
| License | CC Attribution 2.0 Belgium: You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal purpose as long as the work is attributed to the author in the manner specified by the author or licensor. | |
| Identifiers | 10.5446/45722 (DOI) | |
| Publisher | ||
| Release Date | ||
| Language |
Content Metadata
| Subject Area | ||
| Genre | ||
| Abstract |
|
00:00
Information securityDigital rights managementBinary fileAsynchronous Transfer ModeComputing platformProgrammable read-only memoryMechanism designOpen setBootingProcess (computing)Computer fontMaxima and minimaBitSoftwareComputing platformINTEGRALInformation privacySet (mathematics)BootingArithmetic meanMechanism designAxiom of choiceEncryptionInformation securityOrder (biology)Source codeComputer hardwareGreatest elementSoftware developerAsynchronous Transfer ModeGame controllerSlide ruleCASE <Informatik>WordMedical imagingDigital rights managementPresentation of a groupSimulationOperator (mathematics)Different (Kate Ryan album)Kernel (computing)PlastikkarteOpen sourceTerm (mathematics)Spline (mathematics)Formal languageMultiplication signConnectivity (graph theory)Data storage deviceCartesian coordinate systemDynamic random-access memoryEntire functionSemiconductor memoryMathematicsService (economics)Level (video gaming)Control flowComputer programmingPrinciple of maximum entropyLimit (category theory)AverageVariable (mathematics)Peer-to-peerMereologySoftware frameworkGoodness of fitDesign by contractComputer fontExtension (kinesiology)Modul <Software>Flock (web browser)Sign (mathematics)InterprozesskommunikationData integrityFreewareMetropolitan area networkPower (physics)Product (business)TorusComputer fileConfiguration spaceBinary codeComputer animationXMLLecture/Conference
08:23
Process (computing)BootingControl flowExecution unitComputer configurationColor managementAuthorizationUniform resource locatorPoint (geometry)Digital rights managementOcean currentCartesian coordinate systemGraph coloringSoftwareKey (cryptography)Multiplication signDistribution (mathematics)BitWordSlide ruleComputer fileOrder (biology)Process (computing)Endliche ModelltheorieProjective planeComputer programmingToken ringGame controllerComputing platformBinary codeInformation securityCASE <Informatik>Software frameworkSource codeDatabaseRoutingClassical physicsString (computer science)Type theoryResultantGoodness of fitBuildingFunctional (mathematics)Real numberSign (mathematics)UsabilityTask (computing)Arithmetic progressionDifferent (Kate Ryan album)Repository (publishing)WaveCellular automatonIdentifiabilityBootingLevel (video gaming)Physical systemInstallation artDefault (computer science)MereologyMedical imagingMathematical analysisSoftware repositoryArithmetic meanView (database)RootComputer configurationMathematicsLimit setEmailNumberService (economics)AbstractionGroup actionOperator (mathematics)CuboidLecture/Conference
16:40
Information securityMultiplicationMaxima and minimaWindowComponent-based software engineeringComputer iconMoment (mathematics)SoftwareGame controllerPhysical systemAdditionCartesian coordinate systemFile systemFunctional (mathematics)Library (computing)Information securityUniform resource locatorSource codeCollisionDecision theoryResultantSet (mathematics)MappingRun time (program lifecycle phase)Different (Kate Ryan album)MereologyComputing platformOrder (biology)Open sourceInternet service providerProcess (computing)Electronic mailing listCASE <Informatik>Fluid staticsData integrityDemonStructural loadConfiguration spaceComputer filePosition operatorPatch (Unix)Default (computer science)InterprozesskommunikationConnectivity (graph theory)Form (programming)Group actionRule of inferenceINTEGRALKernel (computing)BitInstallation artSingle-precision floating-point formatIntrusion detection systemInformationSoftware developerWeb 2.0MathematicsSpline (mathematics)Moment (mathematics)Public-key cryptographyView (database)Component-based software engineeringTask (computing)Token ringLevel (video gaming)Data structurePoint (geometry)Observational studyExecution unitValidity (statistics)RhombusProduct (business)TwitterBus (computing)Power (physics)Multiplication signInheritance (object-oriented programming)IsochoreRight angleWeb pageTerm (mathematics)Slide ruleSign (mathematics)FluidSystem callDigital rights managementAdventure gameoutputBit rateLipschitz-StetigkeitService (economics)FreewareOvalLecture/Conference
24:56
WindowData storage deviceConvex hullMoment of inertiaInterprozesskommunikationFingerprintInterprozesskommunikationWordLibrary (computing)Repository (publishing)Mobile WebFeedbackData storage deviceComputer fileBinary codeMultiplication signCartesian coordinate systemClosed setHash functionMereologyComponent-based software engineeringElectronic signatureOpen sourceDifferent (Kate Ryan album)INTEGRALDigital rights managementConfiguration spaceSoftwareMechanism designData integrityValidity (statistics)Information securityContent (media)Key (cryptography)Scripting languageSystem callIP addressComputing platformEncryptionPresentation of a groupService (economics)Computer hardwareUniform resource locatorPoint cloudProduct (business)Bus (computing)Time zoneInformationInstallation artPolygonPrincipal idealWeb 2.0Software frameworkSlide ruleFlash memoryVolumenvisualisierungLattice (order)CASE <Informatik>TelecommunicationProjective planeToken ringIntegrated development environmentArmClique-widthBit rateWater vaporLevel (video gaming)Address spaceNP-hardLecture/Conference
33:13
Programmable read-only memoryInformation securityRoutingPasswordComputer programmingGame controllerGastropod shellWaveWeb 2.0Mechanism designRootRepository (publishing)Uniform resource locatorRun time (program lifecycle phase)Control systemMaxima and minimaCartesian coordinate systemInformationSpeech synthesisLecture/Conference
35:12
Repository (publishing)Key (cryptography)Source codeCartesian coordinate systemRun time (program lifecycle phase)Computer fileSign (mathematics)Classical physicsSinc functionLecture/Conference
36:04
Exploratory data analysisConvex hullBootingProcess (computing)Asynchronous Transfer ModeProcess (computing)Reading (process)CASE <Informatik>Service (economics)Repository (publishing)WebsiteSpacetimePoint (geometry)Data storage deviceFlow separationMoment <Mathematik>Ocean currentPhysical systemProjective planeBus (computing)DatabaseEncryptionSign (mathematics)Order (biology)RhombusKey (cryptography)BackupComputer hardwareInformation securityDigital rights managementGame controllerFinite differenceDifferent (Kate Ryan album)Side channel attackBootingRevision controlDecision theoryLocal ringSoftware frameworkMultiplication signBitLevel (video gaming)Arithmetic progressionSemiconductor memoryAxiom of choiceLecture/Conference
45:53
Lecture/ConferenceXML
Transcript: English(auto-generated)
00:07
I think it's already a bit after two, so good afternoon to everybody, and I hope everybody had a nice lunch, and this is the first talk of the security session, and my name
00:21
is Elena Reschettova, and I'm coming from Nokia, I'm a platform, and I don't know if many of you are familiar with this N900 device, so this is a device which runs open source development platform, the name is Maimo, I guess there is even a competition
00:40
where you can get some of these devices today, and I'm working for platform security in Maimo, and the new platform security which is coming for Maimo 6 release, and this presentation is supposed to give a short overview about Maimo platform security, and let's see how much time we have, I
01:05
here is a short outline, so first of all I will just briefly talk about what is platform security, or to be sure that we speak the same language when we say this term platform security, then we will take a look on two
01:20
different device modes of operation for Maimo 6 device, and I will say the reasons for these two different modes, and also during the boot we will take a look on a boot process to understand how you can get these two different modes loaded, we will take a look on access control, one of the primary things in
01:41
security framework, and we will take a look on different things related to access control, also integrity protection, and we will finish with security of inter-process communication, so what is platform security, so here's in the slide it says that it's set of mechanisms and
02:00
techniques which are used to protect the entire software platform, so let's imagine we will try to build a house which called platform security, so what are the bricks here, so what are the mechanism and techniques here, so in the bottom of our house there is a big brick called hardware enablers, so this is actually very important piece for whole platform security, so these
02:24
hardware enablers are needed in order to guarantee that software, the security software which runs on top of it, it's actually really secured from the software and attacks, possible attacks, then there is three middle bricks which here stand for integrity protection, access control, and privacy
02:44
protection, so integrity is to we need to protect integrity in this case it's integrity of binaries, executable, source of configuration, data files, so everything which I would like to be sure that it was not modified during the lifetime of a device, of course authorized modification are load but
03:04
non-authorized or not, and when I access control very known thing in security frameworks, so who is allowed to access what and why and so on and very last one is the privacy protection, so here it mostly means the encryption, encryption of user data or your private data for reasons that you
03:25
would like to keep them secret and not accessible for anything else, when a set of for example limited programs, and on the side of all these bricks of our house there is a key management, so key management is needed on all of these
03:43
levels, so that's why it stand aside, and on top of house there is a roof it called here security policy, so this is the control point of whole platform security, so security policy defines how all these mechanisms are working and what is the needed security level, so this is really just
04:03
a couple of words to explain what is platform security, and so now let's move to the interesting part, so here is a slide called device modes, so many people afraid, so my platform is an open source development platform and many people afraid but now when I'm starting to speak about platform
04:23
security it means okay the platform will be closed, so when it's cute there is like a common understanding when security comes a platform goes closed, so and that's why I have this first slide already explaining you but it's not going to be the case, and we will take a look on the first mode of device operation, there is no particular name for this mode, I don't know they
04:43
probably will come up with interesting names after, but these mode of device operation is the same mode as we used to have on previous memory releases, so for example this device runs mem5 release, so you can do whenever you want with a device, you can compile, build your own kernel, you can
05:04
run your own kernel, you can make any low-level platform development, so whenever you were able to do before you can still do, and there is a special mode even for you to do it, so the only thing which you need you need to put your device, MIMA6 device to this mode and then you can do
05:24
things that you would like to do, there is a second mode which gonna be for MIMA6, and the reason for introducing this mode which I would like to have to even extend even more our developer offering, so we know that
05:40
there are developers who would like to make a bit of profit from very good software, and we would like to give a choice to them to do it, so it doesn't mean that when it says here copy protection it doesn't mean that all software needs to be copy protection and it will be DRAM protected, it's just a choice for you, so if you would like to have the possibility to own money on this platform you can use the copy protection, you can
06:03
put your software into DRAM, but if you don't want to do it, there is nobody who will force you to do it, so you can still distribute open software and it's more than welcomed, and there will be also a way to move between these two modes, and this can be done via the booting process,
06:21
and next slide will show how actually you can reach each of these modes. So the boot process, very high level, so not many details will start from a boot ROM which will first check integrity of the loader, and if integrity of the loader is okay, the loader can continue, so the loader starts to run and it will check the integrity of software image,
06:44
and if its software image is considered to be Nokia Science software image, then this second mode which I showed on a previous slide, so the mode which provides you DRAM protection and like access to application store which in Nokia called Ovi store, so you can load
07:04
this mode because the kernel is fine, the software image is fine, and it's Nokia Science software image, so let's now take a look on what happens when some of these components are not fine. So if the loader is, if the integrity of the loader failed, then they can't allow this because they can't allow the untrusted loader, so the device goes to reset,
07:22
so they're not allowing the change of the loader, but if the integrity of software image failed, so there is still one question to be asked here, so if this device is SIM locked, so SIM locked here means that you, for example, buy the device from operator, usually it's less price, but you have to use it with the same
07:42
I never tried to do it, so you probably have to use it for one year with some SIM card and it's locked to the SIM card, so if the device is SIM locked, then in picture it says that the other image is not allowed, but it's not up to us, so it depends on operator, on your contract with operator,
08:04
maybe some local legislation in the country, so they really don't have any stand on it, so it's up to operator, but it's also up to you not to buy these devices from operator, so, but just to mention this part, and then if device is not SIM locked, then we will allow to boot any unsigned kernel,
08:22
any unsigned software image, there is only one step which will happen in between here, this box saying restrict security functionality, so here this step we need in order to protect things like, for example, DRAM keys, because these keys can't be compromised, and we need to disable these keys,
08:41
and there are also a couple of small things which happened here, but after these things are done, you can load pretty much any, so you can load any unsigned software image, so the one you did and the one you compiled, so nothing prevents you to do it, so this is, again, high level, the boot process,
09:01
so let's move to access control part now, and here we got actually quite many questions already that are existing, there are many existing access control solutions in whole, let's say in whole operating systems, and the question obviously which we were asked is, why are we doing our own access control here,
09:21
and here's a slide which presents a bit of our reasoning why we decided to go this way, and first let's start what we had before, so what does our, what do the previous MIMO devices have, so the only thing we actually had, it was the classical Unix access control model, which is a very user-centric model,
09:42
so it was the threat model at the time when it was developed was there was a number of users who were using the same PC, and the goal was to separate data of these users, which one, let's say, some bad user can't read your emails or can't read your private files,
10:00
so this was a threat model when this classical Unix access control was created, and it was discretionary access control, so user and owner of the file could change the ownership of the file, and later the situation, we were trying to change this, let's say extend the classical Unix access control by producing, for example, POSIX capabilities,
10:21
and it was, I think, a very good idea, but they're not really in use now, so for example, root, by default, has all of them and others, users none, so kind of the concept is there, but it's not really used. And then our criteria, so MIMO devices are mostly one-user devices, so there's no actually need to protect
10:40
one user from another user, so what in a threat model now is that we would like to protect data between the processes because there's many applications with user installs, and the typical user, he doesn't really understand, and the program may look very nice and things and can be malicious, so users don't understand it, and they may install malicious programs
11:02
and they may try to steal the data and do other harmful things, so they would like to have access control, which is in process level, so they don't want to protect users from each other, but would like to protect processes from each other, and also important thing that we wanted to have,
11:21
we didn't want it to change the enforcement model, the current Linux enforcement model too much, so the goal was to make a minimal change to it. And of course, things like group level of flexibility, granularity, some concept that would be easy to understand even for a typical user, let's say, not only for specialist. And we did a lot of analysis of current security frameworks
11:42
and just access control frameworks, and some of them are listed in the slide, and based on this analysis, I don't have time to explain it here, actually, we understood that there was no any of these frameworks which fit our criteria, and that's why we decided to go with our model,
12:01
and I hope in next slides I could explain it a bit. There's not much time, but let's try. So if we start from beginning, so what are the principles and key concepts we are using? So the first one is, let's say, very obvious principle, called the principle of least privilege. So the principle it says that every application
12:23
should be able to access only a limited set of resources which are needed in order to accomplish its intended task, so not any possible task, intended task, and this is very important principle of least privileges, so you don't give more privileges to application which it needs to have in order to make its function,
12:43
and I think it's very good principle and basic principle of many access control frameworks and security frameworks in general. And then we have this new concept which called here protected resource, so before on MIMO platform, all resources were available by default, so you call the IPI to get, let's say,
13:02
location of the current location of the user, and you get location back, but now some of these resources will be protected, so examples here, for example, cellular functionality, so the reason to protect these resources is that if the misusage of such resource
13:22
could cause a harm, first of all, to a user or to a manufacturer of a device, so there is different scenarios, so that's considered to be protected resource. We don't have any final lists, the work is real and progress, so we are not finished with all this platform security, but we are building it, we are in the process of building it,
13:45
and then each of these protected resource will be described with resource token, so resource token is like abstract name, abstract string describing this resource, and this will be a credential also for a process, so if a process would like to access
14:00
our protected resource, it need a corresponding resource token in its credentials, and then our application also, from now it has to declare the resources it needs, and for this one, we'll have this Aegis manifest file, and I'm going to introduce in more details in the next slide, and also important thing about our security framework,
14:21
there is no any security IPIs by default, so you don't have to change your application in order to use some special security IPIs, you can just use standard one and benefit from security framework, which is underneath, so couple of words about Aegis manifest file, so in my platform, the software distribution
14:43
is done inside Debian packages, so and this Aegis manifest file is an optional XML file inside a Debian package, so optional means that if you don't need any particular resources, you don't have to put it there, and then this file, as I said, declares needed resources and also provided resources,
15:03
because our models, our resource token model is dynamic, so any new package which comes, it could introduce a new resource that it personally would like to control and protect, if it has some special, for example, database, its own special database which it would like to protect, it can define a new resource for doing it,
15:20
so it's not limited in any way with the concept, and then this file should be generated automatically by SDK, given a source code of your program, so that you don't have to figure out actually what kind of resource tokens my program needs in order to function normally, and there is couple of other stuff
15:42
about this Aegis manifest file, but I would like to introduce the last concept here, it's called application identifier, so this is the unique identifier of an application on a platform, it's supposed to preserve between, so during whole lifetime of an application on the device, and it constructs it in the following way,
16:02
so it identifies software source where this application came from, the package name, and the application name, in case there are many binaries, many applications inside of a package, and we will use this concept a bit later, so it's quite important one. So still couple of words about software distribution,
16:22
so as I said, software comes inside Debian packages, and from device point of view, from application manager point of view, each package has a software source, so in classical way, when it's based in repository signing, so classical Debian distribution way, it's the source of software repository,
16:40
or it can be also any virtual entity, if we used, we're also gonna support package signing, so it also be single developer or web page, or somebody who has a key pair and can sign a package. Also, so as I said, in order to be recognized, this software source has to have an asymmetric key pair
17:02
and public key needs to be known for a device, and to a private key used to sign the packages, quite standard things, and on the device, each software source is assigned a trust level, and this trust level, we will basically mostly use for, let's say, we call it update rule,
17:21
so that you can't, if you have some package which came from our trusted source, very much trusted source, you should not be able to update this package with a source with less trust, because it maybe uses an attack against the user, but users sees nice update which is available under,
17:40
through example application manager, which nice update of some system, very important system functionality which comes from some completely unknown, maybe even malicious source, so this is the way to prevent such an updates, and I will move forward, so IGIS security policy,
18:00
so as I said in my first slide, with security policy, usually it's a control point of whole platform security, and this is our control point, and by the way, name IGIS doesn't, I know that there is somebody else who is using the same name, so I think it's just collision of names happened, so we don't have anything to do with that ages, so IGIS security policy,
18:21
it contains a mapping between software sources and allowed credentials for that source, so there is example here below, but there is like three software sources there, one is Nokia, now one is Miami.org, so open source development portal, and then there is a list of our resource tokens which the source can potentially grant
18:41
for an application, so if an application comes from the source, Miami.org, it can get user date, can get access to user date or seller functionality, if it requires it in its IGIS manifest file, and this policy can be changed for different devices in order to provide different security levels
19:02
on the devices, so this policy can be very strict or very lightweight, and this is how you can change the security policy. And now let's take a look on our installation time, so how the components are interacting with each other and how actually the application gets the runtime credentials,
19:23
so the application arrives to installer to get the package together with the ages manifest, installer consults the security policy to get the allowed set of credentials for that software source because it can determine the source of this application, and then based on this ages manifest
19:40
and ages security policy entry, it computes a rule, so used what we call intersection rule, which I will show in the next slide, and it computes the runtime credentials of the process and writes it to the file here called credential position list. So let's take a look on this intersection rule,
20:01
so very easy, so we have ages manifest inside the package which declares what kind of application we would like to access, so in the example on the right side, there is user data in Celero, so application would like to get access to user data in Celero functionality, and then it comes from the software source, and the software source declares
20:22
what kind of credentials this application can get if it arrives, if it was certified by that software source, and an example here, there is user data and location, so and at the end, the result credential set, result runtime credential set here for the example contains only user data,
20:41
and this is because it can't get the Celero, it requested the Celero here in ages manifest, but it can't get it because the software source can't grant this resource, it doesn't have enough trust to grant this resource, and it also doesn't get location because it simply didn't request for location, so it didn't say, and I just manifest that it needs location,
21:02
and this result credential set is actually the result runtime credential set which will be added to the process, and here's the runtime, so what happens when our application starts, so at the moment when it starts, we have a component called process credential assigner which goes to this credential position list,
21:22
it finds the entry related to this particular application, it finds the credentials, this runtime credentials which are allowed for this application, and then it loads them to the process task structure in the form of supplementary group IDs, so this is how it's done technically,
21:40
and then after process start to execute and it's always have this supplementary groups IDs attached to it, so credentials attached to it, and then the access control happens, for example for file system it happens as before, so there's no any changes here, so there is file access control list and file systems and various process credentials,
22:01
and there's no any changes, in case of DBAS inter-process communication we have a small patch to DBAS daemon, which it's like small addition to DBAS daemon, the only thing that addition does, it allows the DBAS daemon to take into consideration the supplementary group IDs, because by default DBAS daemon takes,
22:22
when it makes its access control decision it takes into consideration only user ID and group ID from static files, and then so DBAS daemon loads the process credentials and DBAS policies, so DBAS configuration file, it's called DBAS terminology, and then it can make an access control decision,
22:43
and there are gonna be also a third way for application to make an access control, it can do it by itself, so it can call our libcredits library, so we'll provide a special library to get credentials for another process, and then it could check for special credentials it needs, and then it make a decision if we'd like to have this application
23:02
accessing some IPI or get some particular data, and just to finish with access control part I would like to explain shortly this shared libraries case, so what happens when the application try to load a shared library, so in the example here we have an application which has two resource tokens
23:20
and it's credentials to seller and user data, and we'd like to load library A, and we have like a bit of information here that suppose library A comes from very strange source and the source is not unknown to device security policy, so it's not known, it's unknown source, and what happens, so the application sends a request to kernel
23:42
to load a library, kernel redirected to our library checker component, which gets the credentials of application to seller and user data, it will determine the source of library, and it will load the credential set corresponding to that source, and then it will simply make sure
24:01
that both sets are matching, and in this case there is mismatch because application has access to seller functionality, but the library source can't grant it, so unknown source can't grant it, and in this case the loading of library fails, and this is needed from security point of view in order to prevent that our trusted processes
24:22
loads very untrusted shared libraries, because after the library is loaded to the process, it's in the process context, so it gets access to the same things that the process gets, so very simple rule to avoid these things, and then in case it's a library B which comes from the source which can grant seller in this example,
24:43
the loading will succeed and everything is fine, so let's move on to the integrity protection now, so we have the two main components here, first one is HS validator, so this is the component which ensures the integrity of all executables,
25:01
all different executables like binaries, libraries, scripts on the platform, so just a small picture how it works, so we have an application binary which is about to be started, we have HS validator which will calculate the hash over this binary, and then it will get the reference hash
25:21
for this binary from special storage, and the storage is populated during the installation of the corresponding package which brought this binary in, and it will try to match these hashes, and if everything is fine, so the hashes match, then the binary can start to execute and everything is fine,
25:41
but if there is a mismatch, the integrity protection policy will be taken into use, and now it's very simple, so currently if there is a mismatch, the binary is simply not allowed to be loaded, because if the binary was modified on the device and not via software update,
26:02
so just simply modified, there's probably something wrong with this binary, and then the storage of reference hashes is also needed to protect the storage because it's a very important part of information, and for this we use the component which is called HS protected storage, it's in the next slide,
26:21
so this component is used to ensure the integrity of data and configuration files, so I also get a small example here, so we have an application which has some data and configuration files, and suppose it would like to protect the integrity,
26:44
yes, so it can be used by applications as well, so I will explain, it's actually simply, it doesn't have any size, it simply allows you a signature or encryption over it, so it's just your data, it's not any particular size,
27:01
so you just use the services to, we'll consider it in a picture, to encrypt or send the data, so you have this HS protected storage APIs, it's a library which you can use, so you can call the API of this library to place these files in protected storage if you would like to guarantee integrity, but in principle it will just sign the data in its own way,
27:22
and then every time you would like to check if your data is still okay, you can use a different API from the same library which checks integrity on a high level, and it will get the signature, it will verify the signature, and it will report you the status, so it will say if this integrity of this data is okay or not, and it's up to you,
27:40
what to do after with it, so you can, even if it's integrity, it's not, if the file is modified, maybe you will decide to use it anyway, but it's just a mechanism that you can use, and also this protected storage provides you not only integrity protection, but also encryption, so you can use it to store securely the files
28:01
which you would like to encrypt, and this even survives the offline attacks, so it's really encryption. Here, and just to finish, I think I have a couple of minutes left, let's move to our IPC communication, so yes,
28:24
yeah, it's simple file, you can open it, and you can see that all stuff is encrypted where you can't even, so you can open it in a normal way, but you will see that the content is encrypted, it doesn't make any sense. The keys are stored in hardware, so you don't have to worry about it.
28:43
We have this, but I didn't mention it in the first slide, we call trusted execution environment, so this is the hardware enablers which we are using, for a not mobile word, for a PC word there is a TPM, for mobile word there is a different technology, but you don't have to worry about it,
29:01
so you don't have to worry about key management in this case at all, but if you have a signature, so usually how the signature works, so there is a hash computed and verify the signature of the file,
29:21
but you don't have to really kind of call the special IPS to verify the signature, you have only one IPS to check integrity, and this does all this cryptographic things in behind. Yeah, pretty much.
29:41
So I think this is the last my slide, so let's go over it. So here's another situation, you have an inter-process communication inside a device, and you may be afraid that while you're transferring something, for example over a D-bus, you get somebody kind of read the data, so here I have two applications,
30:01
which application one would like to send data, it would like to send it to application two, or this kind of cloud thing which called here potential untrusted zone, for example it could be D-bus or any other inter-process communication, and then what the application one can do, they provide also library, which called MIMO Crypt library,
30:21
which it can ask this corresponding IP from the library to sign this data in this case, and the data will be just returned together with signature, and then the data, when the signature can be transferred over for example a D-bus or anything else, and then an application two can use the same library
30:43
to check if this data really comes from application one, and again here the good thing, you don't have to worry about any key management to establish the keys or to do, everything is done again in hardware, all the key management is done, and there is very convenient IPIs to use to actually check these things,
31:02
so the same could apply for encryption, so that you can encrypt some data using MIMO Crypt IPI, you can transfer the data over the, again example D-bus, and then another application could decrypt this data only if it's possessed some, or for example resource token, the mechanism of resource token is used here as well,
31:22
so you can say that you can encrypt the data and say everybody who has user data, access to user data can decrypt this data, or everybody who has access to location data can decrypt this data, because I know that inside there is location data, so it's very convenient and it's very flexible, this how you can also,
31:41
with the usage of another library you can secure your IPC communications, and short conclusion, so our goal is to open source most of our security framework, it's not only up to us, we're coming from a company, but we'll try our best, and then we actually already created a public project,
32:02
it's called MIMO 6 platform security, and you can find it in mimodetorios.org, so we already have one repository under there which hosts libcred library, so you can go check it out, and start watching it, we really hope that we will add more repositories very soon, and at the end of the presentation and later
32:21
I can answer any questions you have, and the main thing while we're here, because we would really like to get a feedback from you and your opinions about our security framework, because it's the only way to get it better, so we won't get it better if the closing say that nobody knows about it, and we try to make it like very secure, so we don't believe in it,
32:41
we don't believe in security about security, so we are here, we are talking about it, and we would like to get feedback for it, and thank you for your attention, so if there are questions.
33:24
And this is a principle of maximum surprise to a geek that you haven't got your own password. You mean the password for what? Well, so that I can run pseudo out of the box, I mean I just need to set a password. I don't know actually about current devices.
33:43
Sorry? I don't know about current, you mean that when you go to this device you will not be able to run it as a root or? Yes, I mean I have to install a package called extras and get a root shell on it, which means I have a password that's root, no security. No, but I think they're going to work on it so that it will be protected.
34:01
I mean, I've got no security on here. I don't know much about the previous devices, I don't really work even for these kind of devices, so I guess you're speaking about MIMO5 release, so I can't even say anything about that one, I don't even work for that one, sorry.
34:21
Any other questions?
34:51
But access control is not pre-repository, so it's really per program on the device. So the repository, the mechanism is a way that,
35:01
so the application on the device has its runtime credentials, so which for example access to some private, access to user data, access to location, but there is a control mechanism how it gets, so for example if it comes from very untrusted source, some source which there is no reputation whatsoever, when you don't trust the source, then it won't be able to get actually,
35:22
it can ask for many things inside this manifest file, but it won't be able to get them during runtime. So it can mean a repository in a classical way, it can mean also what I said, we're gonna support package signing, so it can also mean that it's really per pair
35:42
whenever who has a key pair, so.
36:01
No, so the application can, the package can provide a new resource, it can't provide some generic resource, so it can't overwrite the current resource, but it can provide a known resource, the space name will be local to package, so it doesn't conflict with memory resources, but it can provide any resource,
36:21
there's no actually restrictions on that one, yes.
36:50
So this protected storage which is going to be encrypted varies, so it probably should not be used for database cases, because the database, so we are using hardware accelerators to speed up the process,
37:03
so it's actually quite fast, but for database cases, when you need to access like very often the database, it's probably not the best solution, so they're actually working on one more solution, they are working on better solution, especially for better cases. I hope they can update on this one soon.
37:32
Yes, you're asking about user prompting, so I don't know, I can't really comment on this one, in case we'll have it or not yet,
37:41
so we have to wait a bit, so it's really a work in progress now, and the current thing that I'm presenting, it's things that we already decided to do.
38:13
Yes, so I'm not a hardware person, so I understand what you're talking about, with side channel attacks,
38:20
but I think we have hardware persons who knows about it,
38:40
and I understand the only problem, I'm not a hardware person, I don't know Jan, if you can comment on that one.
39:19
Okay, I have a question.
39:34
What do you mean to install your own package?
39:40
Okay, we should be very careful about each and every privilege, there will be privileges, you have to actually, in order to get it, you have to be very very trusted, and I'm not the one, I'm just a technical person, so I don't know to whom these privileges will be given, like for example DRAM privilege, so this is a very sensitive privilege, we have to protect, but in any case,
40:01
for example I have my motor torque side, so my virtual repository is there, which is going to have quite high trust level, probably again, I don't know, I'm not the one who's defining these policies, so I'm presenting the framework, which actually can do many things, but I'm not the one who will decide, but I think in my motor torque, you should be able to do this.
40:35
I understand, so if you go to this, whenever presenting these two modes at the beginning, so if you go to this first mode,
40:41
when you're allowed to do everything, you're allowed to modify the security policy, you're allowed to create your own, you're allowed to trust, I don't know, maybe your friend repository the most, and then you say that Nokia don't trust, and something like this, but in that mode, yes,
41:00
so if you go between the modes, so the encryption is our, so this is one thing we have to, so if you had some data encrypted using this, for example, protected storage in this first mode,
41:21
which is like shipped with DRM things, when you move to open mode, this won't be able to decrypt the data, because they don't have any control of the kernel, and they can't actually preserve to guarantee anything, so this is just like the thing, but you can still in that mode use the encryption, and then it will be different encryption, the keys are available, yes,
41:45
no, so the key is bound to the device, so you can't back them up, because you can't actually transfer them between devices, there is, I know that there is a pro, there is a project in MIMO,
42:01
which was called backup service, which will be able to back up your data, and there is a complicated project, or complicated process, how it will be done, so you will be able to back up your data, but not the keys, no, but the keys, no, the keys are, the data would be probably, I don't know how it will work again, I'm not from there, but it probably will be decrypted,
42:22
and encrypted in some different keys, and then pushed back up, for example, so, but it's your choice to use it, or not to use it, you don't have to use it in this encryption service,
43:27
so, MIMO currently is GPL 2, and I don't have any, I'm not the one who is even deciding these things, but MIMO currently is GPL 2,
43:44
yes, okay,
44:16
so what you're concerned about,
44:21
and, so we'd like to put a different operating system on this device, but there should be an enforcement point for us,
45:04
I mean, there should be a point where we actually will make decisions here, and we have to keep at least something,
45:21
but if you can get still your own loader, like on top, why do you want to get rid of this loader, that's probably not good reason enough yet,
45:42
okay, I'm afraid I have to finish for now, but I will be available, and to give my colleagues available today, the whole day for questions, but I think I have to finish now, thank you.