CHAPTER ONE INTRODUCTION
1.0 Background to the Study
The term security lacks meaning until one has defined what is to be secured and for whom. Likewise, security is difficult to comprehend without a potential threat. Mobile phones for third-generation mobile systems (3G) have several security stakeholders for which the mobile platform must provide security services. Moreover, the potential threats may differ from stakeholder to stakeholder.
The first class of security stakeholders, users, expects that mobile phones will offer secure and reliable communication – that is, they assume their phones can be trusted to handle sensitive tasks, such as e-commerce transactions. The main threats to this class of stakeholders are malicious software, such as viruses and Trojans, or weak or misbehaving security mechanisms. The second class of stakeholders, mobile network operators, relies on phone network identification mechanisms (related to billing capability) and networkrelated software.
Criminal-minded users or hostile software must not be allowed to circumvent these mechanisms.
Operators thus require that the integrity of software can be guaranteed when the mobile phone is in operation. They also want to be certain that users cannot break SIM lock mechanisms.
A third class of security stakeholders, content providers, wants to be paid for the content
(music, pictures, videos and software) that users download. It also wants to know that users cannot (mis)use their phones to illegally copy or distribute content. This is where digital rights management (DRM) functions come into play. However, DRM mechanisms alone cannot provide all necessary security. To provide a DRM solution that meets content provider requirements, the mobile phone platform must contain security functions that guarantee secure execution and code integrity.