Cell phone security

The world of cell phones is constantly evolving, in terms of the players involved, the technologies involved in manufacturing mobile equipment, and the business models it enables. In just a few decades, the cell phone has gone from being a simply practical tool, enabling us to receive and make phone calls while on the move, to a tool for work, social contact and managing our daily lives. The use of this object has been democratized, reaching a penetration rate of 50% in Europe in 2015 according to eMarketer, inducing new behaviors in users. Who would have thought that we could make a bank transfer from a cell phone, or book a vacation, by entering our credit card details on the same object, sometimes in a public place? So it's worth asking ourselves how much we can trust it. How can we assess the level of security of such a technological object? How can conventional cell phone architectures secure the deployment and use of mobile applications? In this article, we cover the issues surrounding security in advanced cell phones (known as smartphones). We cover the economic and technological aspects, and draw on advances in standardization work relating to the component and application domains that enter into cell phone usage.

We begin by detailing the sensitive uses of smartphones. We list the various economic players present on the market, as well as the technologies they promote. To better understand the need to protect smartphones, we outline the possible risks and vulnerabilities associated with the use of mobile applications. After outlining the architecture of a cell phone, we cite the technologies implemented in cell phones to enhance confidence in this equipment. We take a detailed look at the mechanisms of runtime environments, guaranteeing a degree of control over the runtime environment of advanced mobiles such as Android or iPhone. We then review the list of technologies that, when integrated into a mobile, can act as security relays, such as secure chips (SIM cards or embedded secure elements) or Trusted Execution Environments (TEEs). Finally, we identify new trends in technology and usage, which represent the challenges of tomorrow's connected world.

A glossary of the main terms used is provided at the end of the article.