Study into the Implications of Smartphone Operating System Security

Recommendations

Info

Study into the implications of Smartphone operating system security Operating system updates OVERVIEW Android does not have a generic, single, method for managing operating system software updates. By licensing the platform based on an open-source software method, Google does not have full control over the method in which its licensees manage the software update and emergency patch process. Google has some degree of control over the Android ecosystem. It manages the development of new versions of the Android operating system and ensures that third-party companies (hardware OEMs) using it in their devices adhere to the Compatibility Definition Document (CDD). Section 11 of the Android 4.2 CDD 44 references software updates and states: “Device implementations MUST include a mechanism to replace the entirety of the system software. The mechanism need not perform "live" upgrades - that is, a device restart MAY be required. Any method can be used, provided that it can replace the entirety of the software preinstalled on the device. For instance, any of the following approaches will satisfy this requirement: FOTA downloads with offline update via reboot "Tethered" (physically connecting a Smartphone to a PC) updates over USB from a host PC Offline" updates via a reboot and update from a file on removable storage The update mechanism used MUST support updates without wiping user data. That is, the update mechanism MUST preserve application private data and application shared data. Note that the upstream Android software includes an update mechanism that satisfies this requirement. If an error is found in a device implementation after it has been released but within its reasonable product lifetime that is determined in consultation with the Android Compatibility Team to affect the compatibility of third-party applications, the device implementer MUST correct the error via a software update available that can be applied per the mechanism just described.” This section gives Android OEMs a good degree of flexibility in defining the process for operating software updates. 44 Android compatibility program. Android 4.2 Compatibility Definition, revision 2, updated 17 February 2013. http://static.googleusercontent.com/external_content/untrusted_dlcp/source.android.com/en//compatib ility/4.2/android-4.2-cdd.pdf Goode Intelligence © 2013 P a g e | 49 www.goodeintelligence.com
Study into the implications of Smartphone operating system security By having an open source model Google does lose a degree of control in the operating system update process. What it gains in openness and flexibility by being available on millions of devices from different hardware manufacturers it loses in control over the software update management process. Currently Google does not mandate when a software update is put on a partner’s device or when that partner pushes it out to its device owners. This results in a situation where Google releases a software update and then pushes it out to its own-brand devices but then has to rely on its other hardware partners to manage the software update themselves. This can result in a delay in Android device manufacturers releasing software updates to its device community. Except for Google-branded Android devices, the Android hardware manufacturer (OEM) is responsible for the software update lifecycle and management process. Android operating system software is pushed into the Android Open Source Project (AOSP) repository by Google. From here hardware manufacturers, who want to use and license Android, can download the source code. The hardware manufacturer may want to adapt the source code and add additional features that make their Android devices unique. This creates a new version of the firmware based on the source code that is held in the AOSP repository. Google has also created a standard that all hardware manufacturers must meet before they can use Google’s Android trademark. This standard is defined in the Compatibility Definition Document (CDD). Compatibility with the CDD also means that the hardware manufacture is eligible to license Google applications including Google Play (Google’s mobile App store) and Google Maps. Google has created a test process, with tools, that enables hardware manufacturers (OEMS) to test new software updates and security patches. At the heart of this test process is the ‘Google Compatibility Test Suite (CTS)’. As there are over 20 hardware manufacturers licensing the Android platform for use in their devices it would be difficult to investigate how they individually manage software updates. Instead, this report details how two device owners (manufacturers) manage this process. Firstly, how Google manages this process for its own-branded devices (in practice this is Google’s reference model for software management and as such is called “Pure Google”) and secondly how the current number one Android device manufacturer, Samsung, deals with operating system software updates. Goode Intelligence © 2013 P a g e | 50 www.goodeintelligence.com
Page 1 and 2: www.goodeintelligence.com £ Study
Page 3 and 4: Study into the implications of Smar
Page 49: Study into the implications of Smar
Page 101 and 102:
Study into the implications of Smar
Page 103 and 104:
Page 105 and 106:
Page 107 and 108:
Page 109 and 110:
Page 111 and 112:
Page 113 and 114:
Page 115 and 116:
Page 117 and 118:
Page 119 and 120:
Page 121 and 122:
Page 123 and 124:
Page 125 and 126:
Page 127 and 128:
Page 129 and 130:
Page 131 and 132:
Page 133 and 134:
Page 135 and 136:
Page 137 and 138:
show all

Study into the Implications of Smartphone Operating System Security

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?