This Small Business Innovation Research Phase II research project has as its objective the development and demonstration of a hardware-based security platform for the protection of applications and confidential data in mobile phones. The end-product components consist of an ultra-low-power security chip protected against attacks, by means of a unique compilation-driven instruction set obfuscation technology, built-in cryptographic acceleration support, and secure storage, a mobile security firmware supporting the Trusted Platform Module (TPM) specification of the Trusted Computing Group industry consortium and a unique mobile application protection technology with secure software plug-ins, and associated development tools to facilitate the use of our technology, including a security-focused compiler. By focusing on ultra-low-power approaches, this solution can be used by battery-powered applications and will not greatly reduce the time between recharges.
The broader impact of this activity is that it addresses key technical obstacles that are a barrier to expanding the use of mobile phones in financial transactions and enterprise applications. Currently, mobile phones do not have the amount of built-in security that would lead to the widespread use on them of electronic wallets, for example, or to allowing users to securely execute mobile enterprise applications.
The intellectual merit of this project is that it involves innovations in mobile applications and data security under power-constrained circumstances. The end product components consist of (i) an ultra-low-power security microprocessor protected against attacks, by means of a unique compilation-driven instruction set obfuscation technology, built-in cryptographic acceleration support, and secure storage; (ii) mobile security firmware supporting the Trusted Platform Module (TPM) specification of the Trusted Computing Group industry consortium and a unique mobile application protection technology with secure software plugins, and (iii) associated development tools to facilitate the use of our technology, including a security-focused compiler. Innovations in these areas, when taken together, permit the securing of applications and data on mobile phones as well as in traditional systems. The broader impact of this activity is that it addressed key technical obstacles that are at present standing in the way of expanding the use of mobile phones in financial transactions and enterprise applications. Currently, mobile phones simply do not have the amount of built-in security that would lead to the widespread use on them of electronic wallets, for example, or to allowing users to securely execute mobile enterprise applications. By focusing on ultra-low-power approaches, our solutions can be used by battery-powered applications and will not greatly reduce the time between recharges. The project resulted in an industry unique security microprocessor, TrustGUARD that not only has applications in the mobile space, but is also very suited to a variety of markets, including defense. To date, platforms containing the TrustGUARD core are currently in-use, protecting our customer’s critical assets. More details can be found at www.bluerisc.com. The testing effort in this project also inspired another commercially available product, WindowsSCOPE. WindowsSCOPE is a memory forensic and cyber analysis tool-suite that provides a user a deep view into the live state of Windows-based systems for use in reverse engineering, forensic analysis, educational purposes, as well as in a cyber-security context. This tool-suite is available online at www.windowsscope.com.
