Embedded Java Security: Security for Mobile Devices

Java brings more functionality and versatility to the world of mobile devices, but it also introduces new security threats.

This book is a comprehensive presentation of embedded Java security. It is compared with the security model of the Java 2 Standard Edition in order to view the impact of limited resources on security. The main components of embedded Java are also generally presented to give an idea about the platform architecture. To assess the effectiveness of the security model, an evaluation of the security features is carried out with results presented in the framework of the MEHARI method for risk analysis, and the Common Criteria methodology of security evaluation. The usefulness of this security evaluation is to point out areas that need security hardening.

This book provides researchers and practitioners alike with a broader and deeper understanding of the issues involved in embedded Java security, and –as a larger view- mobile devices security.

Whereas Java brings functionality and versatility to the world of mobile devices, at the same time it also introduces new security threats. The rapid growth of the number of mobile devices that support Java makes this a pressing issue. Embedded Java Security carefully examines the security aspects of Java and offers a security evaluation for the Java platform.

After explaining background material on the architecture of embedded platforms and relating to its role in security, the book deconstructs the security model into its main components: It explains each component and relates it to the aim of securing the applications and the device. Toward this end, several implementations of the Java platform are examined and tested to relate the model to its actual implementation on devices. The security holes found are further used to clarify security issues and point out common errors. Finally, the book provides an evaluation of embedded Java security that includes security models and security tests performed on real-life implementations.

Topics and features:

• Presents the security model underlying Java ME

• Provides a vulnerability analysis of Java CLDL and a risk analysis study of Java ME vulnerabilities

• Supplies an example of a protection profile for Java ME - illustrated using the common criteria framework

• Discusses the most prominent standards that are relevant for Java ME security

• Reports on areas of common vulnerabilities, and considers specifications and programming mistakes

• Hints and suggestions are provided as ways for hardening security

This invaluable volume provides researchers and practitioners with a broader and deeper understanding of the issues involved in embedded Java security, and, as a larger view, mobile-devices security. It can also serve as an ancillary course text or helpful guidefor self study in the field.