How GlobalPlatform's TEE is Solving the Missing Security Link for Mobile Wallets Dongyan Wang GlobalPlatform Technical Program Manager Thursday 20 March GP Confidential ©2013 @GlobalPlatform_ www.linkedin.com/company/globalplatform

GlobalPlatform Members

GlobalPlatform Positioning GlobalPlatform is the standard for managing applications on secure chip technology Trusted Execution Environment Secure Element AND Across several market sectors and in converging sectors Premium Content

Mobile as a Center of the New Service Deployment Trusted Execution Environment (TEE) TEE provides with a unique capability to ensure that the transaction: Is approved by the right end user Takes place on the right and trusted device Takes place between the application and cloud or back-end server

A Basic Wallet and Extensions Means to authenticate users A list of services An identified device Root of trust Device authentication Wallet APP Transaction management User Authentication On device: Personal sensitive data storage Transaction validation by user User authentication Secure communication to cloud Secure communication to secure element (SE) Wallet application maintenance Loading 3rd party app on m-Wallet

Sensitive Data Protection in View

GlobalPlatform TEE Isolation of sensitive assets Open to malware and rooting / jailbreaking Isolation of sensitive assets Primary device environment runs as normal, including other security mechanisms Security critical code and resources protected by TEE applications GlobalPlatform APIs ensure portability across handsets / platforms TEE provides the constant security foundation independent of OS choice TEE provided hardware based isolations from rich operating system (OS) TEE has privileged access to platform and device resources: User interface, memory controller, video / audio hardware, crypto accelerators, biometry, …)

What Makes the TEE Secure? Isolation in databus & addr bus level Main security properties in TEE Isolation between rich OS and TEE Isolation between trusted applications (TAs) within TEE Isolation between TAs and TEE OS Temporary or permanent exclusive access to some device resources TEE is an association of: Hardware: Hardware security technology Software: TEE secure operating system (secure kernel, secure drivers, etc.) TEE is built upon: Hardware-based isolation: e.g. system-on-chip hardware-based secure mode Hardware root of trust Secure boot process chain started from ROM code Hardware unique key present within chipset and solely accessible by TEE Small footprint of TEE OS to pass a security certification TEE is designed to protect against any software attack arising from rich OS environment, such as malware or due to device being rooted + TEE OS

Trusted Execution Environment TEE for Wallets Trusted Execution Environment Companion Wallet Trusted Application Financial Server TEE OS Wallet Application Trusted User Interface Open OS Device Secure Storage Crypto Application Processor Secure Elements

TEE: A Toolbox for Wallet Sensitivity in Wallets TEE Security Function in Wallet Scenario TEE Primitives User authentication Protect credential entry (e.g. login/password or PIN entry ) TUI Device authentication By using device specific credentials Crypto Explicit payment action Protect from interactions on the device not intended by the user Transaction information validation Protect transaction information display and potential credential entry (e.g. PIN entry) Data storage Protect information such as user’s profile or transaction logs/statistic Secure storage Hosting of additional 3rd party applications in m-wallet Protect application code & data such as loyalty and couponing All functions SE applet configuration Protect user-configured parameters such as amount threshold for no-PIN transactions TUI + SE + Crypto Communication to SE and SE applet Protect access and communication to SE applets from only TEE applications SE + Crypto Cloud Communication Secure communications from / to cloud Crypto + Network

Fingerprint / Biometry The objective is to protect the control access of biometry sensor Secure enrolment and verification either within the TEE or the TA To support ID initiative, such as FIDO, OpenID 2.0. GlobalPlatform will publish biometry API for Trusted Application including fingerprint sensor access support Target date for public review: end of 2014

Complete End-to-End Infrastructure for Secure Wallet Deployment Messaging End-to-end security

to enable interoperable Ease the Interoperable Wallet Deployment GlobalPlatform Specifications to enable interoperable services Transport Payment Retail MNOs Card Configurations Compliance GlobalPlatform UICC Configuration v1.0.1 / - Contactless Extension v1.0 GlobalPlatform Mapping Guidelines GlobalPlatform Basic Financial Configuration v1.5 GlobalPlatform ID configurations (under review) Common Implementation configuration (under review) TEE Compliance GlobalPlatform TEE Initial Configuration Test Suite 1.1.0.2 GlobalPlatform TEE Protection Profile v1.0 Current and first-phase focus = DEVICE PLATFORM Final product (smartphone, tablet etc): in light delta compliance and / or security certification will be defined in second phase + TEE OS TSM Compliance GlobalPlatform System Messaging Specification for Management of Mobile-NFC Services v1.1.2 Systems Profile and Scripting Specifications v1.1 GlobalPlatform E2E Simplified Services Deployment v1.0

More @ www.globalplatform.org