Safeguarding Mobile Data with Samsung’s ‘Plug and Play’ Secure Element IC

For better or worse, smartphones now rule our lives. They connect us 24/7 via text and social media, manage our finances, unlock our vehicles, turn on the lights, and even let the dog out when we’re not home. We trust our phones with access to almost every aspect of our lives and don’t ask questions. Up until recently, it’s been a leap of faith too far to assume that all this nascent device tech is keeping our data safe and secure. But luckily for us (and our dogs), new developments in semiconductors may be just what we need to remain blissfully ignorant of how exposed we’ve really been all these years. Securing a mobile device, one that is connected 24-7 on not only cellular networks but also Wi-Fi and Bluetooth, turns out to be no easy feat. Compared to “traditional” computers, mobile devices come with additional vulnerabilities. Some of the features specific to smartphones and other mobile devices that create additional vulnerabilities include: • Common operating systems – all smartphones operate on one of two OS. • User culture – mobile users are less likely to update their OS in a timely fashion and more likely to not read terms and services or check origins when installing apps. • 24-7 connectivity – smartphones are almost always connected to some type of network, making them vulnerable at almost all times. • Software-based solutions – common software tools used on computers do not extend to mobile devices, because they store more types of data through more varied means, i.e. attacks through text vs. attacks through calling vs. attacks through apps. This is where semiconductors step in to shore up defenses. Rather than relying on software to secure smartphones, hardware devices can be used to protect the OS and users’ data. At their basic level, all computers are just a collection of chips and semiconductors storing code in memory and talking to each other to execute that code. Let’s say the code necessary to boot the OS, the OS itself, and stored data all live on one hardware chip. A hacker only has to break into that single piece of hardware to access the entire system. On the other hand, a separate semiconductor chip can house some of that code and store some of the users’ data. One common example is storing the code needed to boot the OS on a separate semiconductor. Another example is using a separate semiconductor as secured storage for critical data, such as banking information. Now, an attack on the system must go through one or more additional hardware chips to reach sensitive data. The device now has an extra layer of security that, by its hardware nature, is much harder to breach. In February 2020, Samsung unveiled their best-in-class semiconductor chip for security with the Common Criteria Evaluation Assurance Level (CC EAL) 5+ certified Secure Element (SE) turnkey chip (S3K250AF). This SE consists of a semiconductor chip with dedicated software that stores a users’ critical data on an isolated piece of hardware.

CC EAL is validation of the hardware’s security by an unbiased third party, meaning Samsung’s chip has been tested rigorously to ensure it performs as claimed. “Turnkey” means that the chip is essentially “plug and play,” and can be easily and inexpensively integrated into a wide variety of devices. Adding even more security to Samsung’s new SE solution is that it is manufactured at secure sites. “Our new turnkey SE solution for mobile devices will not only keep user data safer on the go but also enable new mobile applications that will broaden and enrich our everyday lives,” said Dongho Shin, senior vice president of System LSI marketing at Samsung Electronics. Samsung’s Secure Element chip has several additional key features that make it the best-in-class for mobile security, including: • A dedicated microcontroller • A non-generic, optimized OS • The ability to house both sensitive user data and root-of-trust code for booting the smartphone’s OS • The ability to protect against complex attacks, such as power glitches Samsung’s new semiconductor chip is being integrated into the mobile applications that require the highest level of security. High-end, “flagship” smartphones are integrating this technology. However, this chip is not just adding security to cell phones. Other mobile applications, such as e-passports and hardware cryptocurrency wallets, are making use of this technology. This new SE chip is also poised to play a crucial role in larger systems of networked devices, such as secure communication between automated equipment in a factory. In May 2020, Samsung announced an updated version of the chip with twice the memory, CC EAL 6+ certification, and root of trust (RoT) capabilities, aptly named ‘The Mobile Guardian’ (S3FV9RR).

“With the new standalone security element solution (S3FV9RR), Samsung is mounting a powerful deadbolt on smart devices to safeguard private information,” said Dongho Shin, senior vice president of System LSI marketing at Samsung Electronics. Mobile computing is without a doubt the future of ‘computers’. Gone are the days of requiring a desktop, laptop, and a phone to manage our work and personal lives. Almost everything can be done with a smartphone now. And finally, mobile device security is catching up with even the most sophisticated cybersecurity threats. But not all smartphones will be equipped with the latest Secure Element tech. So while processor speed, hard drive capacity, 5G capability, and screen resolution are all cool features that allow you to explore the best games, videos and websites, it’s a tiny Secure Element chip from Samsung that quietly stands guard, vigilant against the worst the Internet has to offer.