GlobalPlatform Publishes TEE Security Best Practice Guidelines
Document sets a minimum level of security for handset manufacturers and will enable service providers to effectively manage risk
6 January 2014 – GlobalPlatform, the association which standardizes the management of applications on secure chip technology, has published the first Trusted Execution Environment (TEE) Protection Profile (PP)*. The document defines the level of security required in a TEE hosted in a mobile device to support the delivery of a range of value added services including premium content and mobile wallets, as well as enterprises and governments supporting bring your own device (BYOD) initiatives.
GlobalPlatform members have published the market’s first PP for TEE products; a secure area that resides in the main processor of a mobile device and ensures that sensitive data is stored, processed and protected in a secure environment. The document identifies the security needs of the TEE to support different market requirements by combining the standard security methodology outlined by Common Criteria, with the best practice specifications as defined by GlobalPlatform in relation to TEE architecture and interfaces**.
“There is an obvious need to trust the TEE to ensure service providers have the confidence and infrastructure to successfully and securely deliver mobile services to end-users,” explains GlobalPlatform’s Technical Director, Gil Bernabeu. “It is important to remember that end-users will have just one smartphone which must be able to support all the services that they select. This means that the TEE – regardless of manufacturer – must sufficiently meet the technical and business requirements of different markets and mobile services stakeholders. The GlobalPlatform TEE PP offers a ubiquitous security baseline that brings clarity, consistency and structure to the mobile environment. This in turn supports commercial efficiencies and product interoperability.”
The GlobalPlatform TEE PP specifies the typical threats a TEE needs to withstand, the security objectives that are to be met in order to counter these threats and the security functional requirements that a TEE will have to comply with in order to meet these security objectives. A security assurance level of EAL2+*** has been selected; the focus is on vulnerabilities that are subject to widespread, software-based exploitation. Gil adds: “It is important that the TEE offers security that allows service providers to develop convenient, secure services that enhance end-user experiences without necessitating additional authentication requirements.”
Gil concludes by highlighting that this is the start of GlobalPlatform’s work in this area: “The next step is to incorporate the security requirements of the recently released GlobalPlatform Trusted User Interface Specification within the TEE PP. We also need to establish how TEE certification will be managed. Part of our current work is to engage stakeholders globally to facilitate technical dialogue and identify scalable security practices within the TEE community.”
Download the Trusted Execution Environment (TEE) Protection Profile (PP), without charge, from the GlobalPlatform website.
-ENDS-
For further media information, please contact Kirsty Pearson or Rob Peryer at iseepr: kirsty@iseepr.co.uk / rob@iseepr.co.uk or on + 44 (0) 1943 468007
Keep up to date with the latest news from GlobalPlatform:
- Follow on Twitter: https://bit.ly/wOiHFp
- Join us on LinkedIn: https://linkd.in/xjxsN5
Notes to editors:
*A PP details the functional and assurance security requirements that a product should adhere to based on Common Criteria for Information Technology Security Evaluation (Common Criteria), which is an international standard for computer security certification.
**The TEE PP refers to two of GlobalPlatform’s Specifications:
- The TEE Internal API Specification v1.0 details how to interface trusted applications with a TEE in a consistent and secure manner.
- The TEE Client API Specification v1.0 outlines the communication between applications running in Rich OS and trusted applications residing in the TEE.
***EAL2+ means that the TEE product can withstand attacks that are more powerful than those addressed with standard EAL2.
About GlobalPlatform
GlobalPlatform is a cross industry, not-for-profit association which identifies, develops and publishes specifications which facilitate the secure and interoperable deployment and management of multiple embedded applications on secure chip technology. Its proven technical specifications are regarded as the international industry standard for building a trusted end-to-end solution which serves multiple actors and supports several business models.
The freely available specifications provide the foundation for market convergence and innovative new cross-sector partnerships. The technology has been adopted globally across finance, mobile/telecom, government, healthcare, retail and transit sectors. GlobalPlatform also supports an open compliance program ecosystem to ensure the long-term interoperability of secure chip technology.
As a member-driven association with cross-market representation from all world continents, GlobalPlatform membership is open to any organization operating within this landscape. Its 100+ members contribute to technical committees and market-led task forces. www.globalplatform.org
