The Mobile Linux Platform security section contains security objectives and guidelines essential to analyzing and mitigating threats and improving resiliency to attacks on mobile Linux-based systems. These guidelines support security objectives for mobile systems derived from assumptions based on the following:
Mobile devices are characterized by the following:
The Mobile Linux Platform Security section contains guidelines essential to ensuring and maintaining operational integrity of mobile devices, both internal- and external-facing. An example of an internal-facing security guideline is:
An example of an externally-facing guideline is:
Some general guidelines that were used to develop these guidelines for security for mobile devices are described below. Specific guidelines are driven by specific objectives including:
For some types of phones, capabilities are specified that enable the network operator to add:
Linux Foundation MLI specifies that system software MUST provide a robust set of cryptographic primitives.
Description: Linux Foundation MLI specifies that the system software SHOULD be configurable to disallow low-strength cryptography.
Description: Linux Foundation MLI specifies that the system software SHOULD be configurable to disallow high-strength cryptography.
Description: Linux Foundation MLI specifies that the system software MUST provide a standard interface or interfaces to hardware and software cryptographic/security tokens (e.g. OpenSSL, PC/SC. PKCS#11, PKI)
Description: Linux Foundation MLI specifies that the system software SHOULD provide a facility to allow trusted processes to store sensitive information in a “secure facility”. To ensure the security of such a facility, all processes able to access vaulted information must be at a sufficient level of mutual trust.
Any process shall be able to store data inside the vault. The data would be visible only to the creator and to specified high trust level processes (e.g. backup application).
Description: Linux Foundation MLI specifies that the system software SHOULD provide the ability to specify a FIPS-140 or Suite-B mode in which only cipher-suites defined by those standards are active.
Description: Linux Foundation MLI specifies that the system software MUST provide a mechanism for clearing user data. The mechanism may be activated manually by the user, or automatically by the system in case security of the device is compromised.
Linux Foundation MLI specifies that system software MUST provide mechanisms to distinguish the origin, and insure the integrity, of programs, libraries and other resources utilized by the system. Such mechanisms would typically include the use of certificates, signed binaries, etc.
Description: Linux Foundation MLI specifies that the system software MUST provide the capability to be pre-configured with a base set of trusted certificates.
Description: Linux Foundation MLI specifies that the set of trusted root certificates MUST be configurable by the device manufacturer, the network operator, corporate customers. The set of trusted root certificates MAY be configurable by the end user.
Description: Linux Foundation MLI specifies that the system software SHOULD support different “kinds” of trust for different certificates, e.g. a certificate which may allow email signing may not be trusted for code signing.
Description: Linux Foundation MLI specifies that the system software MUST provide a robust interface for the addition and deletion of certificates and for the alteration of certificate-related metadata.
Description: Linux Foundation MLI specifies that the interface for updating certificate metadata MUST be “protected.” In other words, messages that update certificate trust metadata MUST be signed by keys derived from a previously trusted root.
Description: Linux Foundation MLI specifies that the types of trust to be supported MUST include (but are not limited to): SSL Server, Email Signing, Email Encryption, Policy Update, Root Key Update, Code Signing
Description: Linux Foundation MLI specifies that trust policy SHOULD be updateable by a sufficiently authorized entity at runtime.
Description: Linux Foundation MLI specifies that the system software SHOULD support code signing, but not necessarily require it.
Description: Linux Foundation MLI specifies that signed executables or shared object libraries MUST map to “policies” that describe what an application signed with a particular key can do. (I.e. signed applications may be able to access the SMS APIs without querying the user while non-signed applications may require the user to explicitly allow use.)
Description: Linux Foundation MLI specifies that the system software SHOULD be configurable to boot from a “known-good” state, and only launch certified executables. This would require facilities to exert control over the operation of the system software prior to the actual initiation of the kernel.
Description: Linux Foundation MLI specifies that the system software SHOULD enable network operators and/or service providers to make measurements to determine that the platform on which the system software is running is in a “known-good” configuration for device management and high-value content services (for trusted network management and service attestation)
Linux Foundation MLI specifies that the system software MAY provide mechanisms to avoid the subversion of its operation by unprivileged parties.
Description: Linux Foundation MLI specifies that the system software MAY be configurable, either by the carrier or by the user, to provide secure authentication and the ability to apply new authentication mechanisms.
Linux Foundation MLI specifies that the system software MUST support a mechanism for implementing new operating system authentication mechanisms.
Description: Linux Foundation MLI specifies that the system software mechanism of MLISEC 3.2 MUST allow for dynamic loading of authentication modules.
Description: Linux Foundation MLI specifies that the system software MUST provide mechanisms to provide integrity and confidentiality of network transmissions to and from the system.
Description: Linux Foundation MLI specifies that the system software MUST provide support for limiting the resource usage of users and processes. In particular, per-process limits on memory, file-system quotas, the number of processes which can be created, etc., will be controllable via policy.
TBS