<?xml version="1.0" encoding="utf-8"?>
<!-- Copyright (c) 2007-2010 Nokia Corporation and/or its subsidiary(-ies) All rights reserved. -->
<!-- This component and the accompanying materials are made available under the terms of the License 
"Eclipse Public License v1.0" which accompanies this distribution, 
and is available at the URL "http://www.eclipse.org/legal/epl-v10.html". -->
<!-- Initial Contributors:
    Nokia Corporation - initial contribution.
Contributors: 
-->
<!DOCTYPE concept
  PUBLIC "-//OASIS//DTD DITA Concept//EN" "concept.dtd">
<concept id="GUID-9058F379-C495-4B22-B270-FF6A80E450B8" xml:lang="en"><title>Device
security mechanisms</title><prolog><metadata><keywords/></metadata></prolog><conbody>
<p>The list below contains some common device security mechanisms.</p>
<section id="GUID-24AD1095-E039-46B5-A39A-1D814D697DA1"><title>Device protection</title>
<p>The Symbian platform is not well equipped to protect against a physical
attack (that is, when an attacker has physical access to the mobile device)
because access to a device is controlled by the device lock feature, which
is often not used. Other external methods of protection, like a PIN code or
Subscriber Identity Module (SIM) locking, tend to provide protection only
when accessing a cellular network, leaving the information content vulnerable.
Without <xref href="GUID-A1ED2377-E196-423F-A5A2-1889C1CC3E05.dita">cryptographic
protection</xref>, it is possible to gain access to the device's information
storage with hardware-based methods (for example, wiretapping connectors and
direct reading of memory chips).</p>
</section>
<section id="GUID-BE16A5D1-B580-4ED6-82D7-16B33B8EEADF"><title>Device authentication</title>
<p>Sometimes, for security reasons, an application needs to identify the
mobile device it is running on, for example, to use specific ciphering keys
or to apply copy protection. Identification can be done by checking the device's
International Mobile Equipment Identity (IMEI) code, which is unique in each
device used in cellular networks. To retrieve the IMEI code, you can use,
for example the <xref href="jar:GUID-35228542-8C95-4849-A73F-2B4F082F0C44.jar!/sdk/doc_source/reference/reference-cpp/ETel_3rd_Party_API/CTelephonyClass.html#%3a%3aCTelephony%3a%3aGetPhoneId%28TRequestStatus%20%26amp%3b%2cTDes8%20%26amp%3b%29const" format="application/java-archive"><codeph>CTelephony::GetPhoneId</codeph></xref> method. For more information,
see <xref href="GUID-5E10D5B7-C407-51E0-8C16-466A8BC89106.dita">Phone
Identification Tutorial</xref>. There are different APIs for retrieving the
IMEI code in different versions of SDKs. Refer to the SDK API or Symbian documentation
for the proper method.</p>
<p>Another way to get information about the running platform and the mobile
device is to use the <codeph>HAL:Get()</codeph> method defined in <codeph>hal.h</codeph> header
file. For more information and examples, see <xref href="http://developer.symbian.org/wiki/index.php/Device_Product_ID,_Platform_ID_and_HAL_information" scope="external">Device Product ID, Platform ID and HAL information</xref> at
the Symbian Foundation.</p>
<p><b>User authentication</b></p>
<p>When powering on the device, the user is authenticated in the <i>operating
system level</i> with standard device authentication methods, such as a PIN
code and security code requests. However, these features can be turned off
by the user and are easily reset with special hardware. If an application
needs to authenticate the user, it should be done in the <i>application level</i> by
implementing a separate user name/password authentication mechanism.</p>
</section>
<section id="GUID-962E0183-0CBD-457D-B24C-C0BDB30A58A4"><title>Mobile hardware</title>
<p>The Symbian platform attempts to ensure the integrity of data even in
the presence of unreliable communication and a shortage of resources, such
as memory, power, and storage.</p>
<p>The user may detach removable storage media at any time, either intentionally
or unintentionally. The platform has a built-in detach handling mechanism,
but applications should still be prepared for a sudden loss of storage media
to prevent data loss or corruption. To check the type of storage media (removable/fixed),
use the <xref href="jar:GUID-35228542-8C95-4849-A73F-2B4F082F0C44.jar!/sdk/doc_source/reference/reference-cpp/F32_EKA2/RFsClass.html#%3a%3aRFs%3a%3aDrive%28%29" format="application/java-archive"><codeph>RFs::Drive()</codeph></xref> method. </p>
<p>The device may shut down at any time, either by accident or because
the battery runs out. Important data stored in nonpermanent memory should
be written to permanent memory as early as possible. To query the battery
level, use the <codeph>HAL::Get(EPowerBatteryStatus)</codeph> method. For
information on how to retrieve system information, see the <xref href="GUID-54042C84-6216-5930-9CBF-BAF635CECD4D.dita">Power
HAL Handler Tutorial</xref>.</p>
<p>Even though internal storage is not physically protected, you can secure
memory cards with password protection. If the locking option is used (method <xref href="jar:GUID-35228542-8C95-4849-A73F-2B4F082F0C44.jar!/sdk/doc_source/reference/reference-cpp/F32_EKA2/RFsClass.html#%3a%3aRFs%3a%3aLockDrive%28%29" format="application/java-archive"><codeph>RFs::LockDrive</codeph></xref>), memory card contents are protected
with a password and cannot be read in any other device without it. Password
locking is an extended functionality of the Multimedia card (MMC), and may
not be compatible with all hardware and software configurations.</p>
</section>
<section id="GUID-9058F379-C495-4B22-B270-FF6A80E450B9"><title>Third-party solutions</title>
<p>A mobile device can be protected with third-party security applications. <i>Antivirus
software</i> can detect and quarantine any viruses that try to access the
device, as well as restore infected files. Antivirus software is usually used
together with <i>firewalls</i> to observe and protect both incoming and outgoing
data connections. This enables monitoring of important data and prevents it
from being sent out of the device. Firewall and antivirus software can also
be part of an <i>intrusion detection system</i> that notifies the user whenever
a malicious attempt is detected.</p>
<p>Furthermore, there are applications you can use to encrypt existing
files, manage passwords, and store information and data securely (in vaults).
You can even cipher information in applications and connection methods which
do not initially support ciphering (for example, short message service [SMS]).</p>
</section>
</conbody></concept>