<!--Arbortext, Inc., 1988-2004, v.4002-->

<!DOCTYPE concept PUBLIC "-//OASIS//DTD DITA Concept//EN"

 "concept.dtd">

security mechanisms</title>

<prolog>

<metadata>

<keywords></keywords>

</metadata>

</prolog>

<conbody>

<section id="GUID-24AD1095-E039-46B5-A39A-1D814D697DA1"><title>Device protection</title> <p>The

Symbian platform is not well equipped to protect against a physical attack

(that is, when an attacker has physical access to the mobile device) because

access to a device is controlled by the device lock feature, which is often

not used. Other external methods of protection, like a PIN code or Subscriber

Identity Module (SIM) locking, tend to provide protection only when accessing

a cellular network, leaving the <?Pub Caret?>information content vulnerable.

direct reading of memory chips).</p> </section>

<section id="GUID-BE16A5D1-B580-4ED6-82D7-16B33B8EEADF"><title>Device authentication</title> <p>Sometimes,

for security reasons, an application needs to identify the mobile device it

is running on, for example, to use specific ciphering keys or to apply copy

protection. Identification can be done by checking the device's International

Mobile Equipment Identity (IMEI) code, which is unique in each device used

in cellular networks. To retrieve the IMEI code, you can use, for example

the <xref format="application/java-archive" href="jar:GUID-35228542-8C95-4849-A73F-2B4F082F0C44.jar!/sdk/doc_source/reference/reference-cpp/ETel_3rd_Party_API/CTelephonyClass.html#%3a%3aCTelephony%3a%3aGetPhoneId%28TRequestStatus%20%26amp%3b%2cTDes8%20%26amp%3b%29const"

><codeph>CTelephony::GetPhoneId</codeph></xref> method. There are different

APIs for retrieving the IMEI code in different versions of SDKs. Refer to

the SDK API or Symbian documentation for the proper method.</p> <p>Another

way to get information about the running platform and the mobile device is

to use the <codeph>HAL:Get()</codeph> method defined in <codeph>hal.h</codeph> header

file. For more information and examples, see <xref href="http://developer.symbian.org/wiki/index.php/Device_Product_ID,_Platform_ID_and_HAL_information"

scope="external">Device Product ID, Platform ID and HAL information</xref> at

the Symbian Foundation.</p> <p><b>User authentication</b></p> <p>When powering

on the device, the user is authenticated in the <i>operating system level</i> with

standard device authentication methods, such as a PIN code and security code

requests. However, these features can be turned off by the user and are easily

reset with special hardware. If an application needs to authenticate the user,

it should be done in the <i>application level</i> by implementing a separate

user name/password authentication mechanism.</p> </section>

<section id="GUID-962E0183-0CBD-457D-B24C-C0BDB30A58A4"><title>Mobile hardware</title> <p>The

Symbian platform attempts to ensure the integrity of data even in the presence

of unreliable communication and a shortage of resources, such as memory, power,

and storage.</p> <p>The user may detach removable storage media at any time,

either intentionally or unintentionally. The platform has a built-in detach

handling mechanism, but applications should still be prepared for a sudden

loss of storage media to prevent data loss or corruption. To check the type

of storage media (removable/fixed), use the <xref format="application/java-archive"

href="jar:GUID-35228542-8C95-4849-A73F-2B4F082F0C44.jar!/sdk/doc_source/reference/reference-cpp/F32_EKA2/RFsClass.html#%3a%3aRFs%3a%3aDrive%28%29"

><codeph>RFs::Drive()</codeph></xref> method. </p> <p>The device may shut

down at any time, either by accident or because the battery runs out. Important

data stored in nonpermanent memory should be written to permanent memory as

early as possible. To query the battery level, use the <codeph>HAL::Get(EPowerBatteryStatus)</codeph> method.

For information on how to retrieve system information, see the <xref href="GUID-54042C84-6216-5930-9CBF-BAF635CECD4D.dita">Power

HAL Handler Tutorial</xref>.</p> <p>Even though internal storage is not physically

protected, you can secure memory cards with password protection. If the locking

option is used (method <xref format="application/java-archive" href="jar:GUID-35228542-8C95-4849-A73F-2B4F082F0C44.jar!/sdk/doc_source/reference/reference-cpp/F32_EKA2/RFsClass.html#%3a%3aRFs%3a%3aLockDrive%28%29"

><codeph>RFs::LockDrive</codeph></xref>), memory card contents are protected

not be compatible with all hardware and software configurations.</p> </section>

<section id="GUID-9058F379-C495-4B22-B270-FF6A80E450B9"><title>Third-party

solutions</title> <p>A mobile device can be protected with third-party security

applications. <i>Antivirus software</i> can detect and quarantine any viruses

that try to access the device, as well as restore infected files. Antivirus

software is usually used together with <i>firewalls</i> to observe and protect

both incoming and outgoing data connections. This enables monitoring of important

data and prevents it from being sent out of the device. Firewall and antivirus

software can also be part of an <i>intrusion detection system</i> that notifies

the user whenever a malicious attempt is detected.</p> <p>Furthermore, there

are applications you can use to encrypt existing files, manage passwords,

and store information and data securely (in vaults). You can even cipher information

in applications and connection methods which do not initially support ciphering

(for example, short message service [SMS]).</p> </section>

</conbody>

</concept>

<?Pub *0000006870?>