Row Over Phone Security Plans
The Trusted Computing Group (TCG), an industry consortium developing computer security specifications, has released a wish list of applications of TCG technology to cell phone security. The Electronic Frontier Foundation (EFF), a counter-group attended TCG's announcement last week and has criticized the proposals as steps in the wrong direction for the future of mobile communications.
"TCG is proudly offering to help cell phone carriers lock down your phone," said EFF Staff Technologist Seth Schoen. "The proposals described today aim to help your cell phone company decide who can publish software or media for your phone, whether you can load your own documents, and even whether you can switch carriers or resell your phone. These are not innovations that consumers will applaud."
"The cell phone industry hasn't yet realized that cell phones are little computers, and that users expect the same amount of choice about how to use their phones as they enjoy with their PCs and PDAs," Schoen added. "We should be working to make cell phones more like PCs rather than making PCs more like restricted cell phones. But today TCG has demonstrated its eagerness to assist carriers who wish to force more restrictions on consumers, rather than offer them more control and flexibility."
The use cases defined by the TCG include:
- Platform integrity to ensure the hardware and software are in a state intended by the manufacturer.
- Device authentication to protect and store identities of users and bind the device to the appropriate user.
- Digital rights management implementation to protect content on the phone.
- SIMlock/device personalization to ensure a device is locked to its network and prevents device theft.
- Secure software download to enable the safe download of updates, patches and other software.
- Secure channel between the device and UTMS Integrated Circuit Card (UICC) to help avoid malicious software that can interfere with applications or otherwise compromise it.
- Mobile ticketing to enable the secure download of tickets and manage them.
- Mobile payment to enable the secure execution of payments.
- Software use to ensure that software is safe and if not, can be removed, replaced or not executed.
- User data protection and privacy to allow users to prevent their information from being accessed or viewed by unauthorized entities and to give users access to services or data that might not require personal information.
Posted to the site on 3rd October 2005
