Hardware encryption for mobile data

Question

Assume a requirement for creating a custom application for Android or iOS smartphones, which will send and receive data (documents, e-mails, etc.) to/from a corporate server, perhaps after local editing via standard applications (e.g., Word or Powerpoint). The data will have to reside at the smartphone for certain amounts of time.

The application has to be

• Fast
• Secure
• Standardized

i.e. it should use as much of existing functionality as possible.

It seems that, for the network part, HTTPS is a better option than VPNs.

So, a general model of operation will be for the user to supply authentication credentials, login to the server, identify the document to be retrieved and download that document to the smartphone. Vice versa, the user should be able to load the document from the smartphone storage, edit it and then send it to the server.

Based on the above:

1. Is there any open source solution for the client part (Android and iOS) of the client-server communication, i.e. a recommended HTTS client library?
2. Is hardware encryption the recommended path for smartphone data storage (in terms of performance and security)?
3. Is there any other part of the communication that needs to be secured?

Thanks!

Answer 1

Question1:

Not sure about this one, I guess any RESTful design would do where each application gets an activation token which will allow him to retrieve its identity (used for authentication)

Question 2:

It's not actually. Most corporate applications use a different approach. For instance if you look at GOOD for Enterprise you will note that they encrypt their complete local storage based on a user password. If the user can't remember his password then he can't access the application (no password reset option).

The encryption key is derived from the password and should always be given by the user to start a session. After a few moments of idleness (5 - 10 minutes) you should lock the application again.

GOOD also goes a step further, three wrong password attempts and your local storage gets wiped and your account invalidated for REST requests.

Question 3:

Never use external storage, always use the internal memory. Refer to the good security guidelines for mobile development.

References:

• Apple iOS Secure Coding Guide
• Android Security Tips