News : December 12, 2000
Fixing a security hole where the rain gets in:
Two-zone encryption limits wireless usage
By Ephraim Schwartz
Wireless World
December 03, 2000
LAST WEEK, I wrote about the hole in two-zone security. This week, let's look at what's at stake, who's at fault, and some possible solutions. If you are a bank, a stock trader, a health care provider allowing access to patient records, or any business running a relatively high-value system, then end-to-end (or single-zone) encryption is mandated by federal agencies. Having a gateway in the middle of your transmission, as in two-zone encryptions, breaks the basic rule that you must know where your data is at all times and that only authorized people can reach it.
This means that content providers cannot offer the full extent of their services to their customers because the level of security is not up to federal standards. In some regulated industries companies may decide to send only low-value information because the technology itself is falling short.
Banks and health care providers must not expose customer records. It doesn't matter if it's only a momentary exposure; such records must not pass through a wireless gateway.
Bill Anderson is managing director of MobileTrust at Certicom. Certicom sells its Elliptic Curve Cryptography (ECC) to wireless infrastructure providers.
But even Certicom has no solution to close the two-zone security hole for cellular handsets. They do offer, however, an ECC end-to-end solution for other devices such as the Palm Pilot and Research in Motion (RIM) Blackberry. When these devices use ECC, the data is encrypted and transported directly to the enterprise or content server, passing through any networks as if it were in a sealed envelope.
Certicom's certificate authority service, MobileTrust, allows companies deploying mobile devices to take advantage of the recent Electronic Signature Act. The certificate gives the mobile user a confirmed identity. I asked Anderson how the identity is first confirmed, and told me that in some cases when a new employee is issued an ID badge and a PDA, the unique certificate is already on the device.
So it comes to this: If you want true security, don't use a cell phone. In doing the research for this column I never expected I would once again have to hammer the wireless network providers. But that appears to be necessary. Profit motive aside, providers can architect their services in such a way that they do not require gateways. Until they do, the kinds of business content providers that can transact over cell phones will be limited.
Does it have to be this way? I'll let Bill Anderson answer that. "There are the wireless operators who want to control their wireless customers, and they want to run the customers, and they want to define what content they see," he said. "Is it possible for the wireless networks to architect a system without the need for a gateway and two-zone security? I know it is possible."
Maybe it's time for GSM (Global System for Mobile communications). I know GSM is national, and in speaking with users, I know it covers major metropolitan areas. GSM offers a programmable SIM (Subscriber Identity Module) card that can be used for encryption as well as for applications.
With an application on the SIM card, performance increases and air time decreases.
But the key advantage is that encryption can be embedded on the SIM card. It is still two-zone, but the middleware doing the translation does not reside on the gateway. The password is encrypted on the handset and passes through the entire network. The displayed information does get decrypted in the middleware box, but that box is held by the bank or hosted by an audited and inspected third party. This is the system used by Royal Bank of Canada for its wireless customers. The key on the SIM card is known only to the SIM card and the bank, said Jim Connor at Royal Bank.
Because SSL standards are heavy-duty, users will pay a performance price; a secure connection will take about 45 seconds to establish. But the service is network independent. All a user will need is a dial tone.
Back to Top
|
