NSA suggests using virtualization to secure smartphones

It's now feasible to secure smartphones using virtualization, a technology the NSA currently requires only on tablets and laptops

The National Security Agency is now suggesting government departments and businesses buy smartphones secured using virtualization, a technology it currently requires only on tablets and laptops

The change comes about with the arrival of the first virtualization-based smartphone security system on the U.S. Commercial Solutions for Classified list.

CSFC is a program developed by the NSA to help U.S. government agencies and the businesses that serve them to quickly build layered secure systems from approved components.

An HTC A9 smartphone security-hardened by Cog Systems using its D4 virtualization platform is now on that list, alongside devices without virtualization from Samsung Electronics, LG Electronics, and BlackBerry.

In the modified A9, communications functions are secured by running them in separate virtual machines on the D4 virtualization platform.

It's the first smartphone on the CSFC list to use virtualization, which the NSA has only required on more powerful devices such as tablets and laptops until now.

"If virtualization technology was commonly available in the smartphone, we could leverage it for some solutions. To date, the devices that have been considered did not offer that technology," the NSA's technical guidance reads.

Cog Systems' position on the list isn't definitive yet: It's still seeking certification for the D4/A9 combination against the National Information Assurance Partnership's mobile platform and IPSec VPN Client protection profiles. Vendors typically have six months to obtain the certification in order to remain on the list. For now, D4's validation is ongoing at Gossamer Security Solutions' Common Criteria Testing Laboratory.

Vendors don't seek certification lightly, according to Carl Nerup, chief marketing officer at Cog Systems. "It's a very expensive process," he said, between US$500,000 and $700,000 for each new model.

Somehow, though, Cog Systems is eating the additional cost of certification: The price for its security-hardened A9 is the same as HTC's list price for an unmodified phone, said Nerup. "We have multiple groups within the U.S. Department of Defense that have procured the device," he added.

A commercial off-the-shelf (COTS) smartphone like the modified A9 isn't only of interest to government customers, though, Cog Systems CEO Dan Potts pointed out. "In the oil and gas industry, they want to buy COTS. They want it to be at a competitive price, but with a greater concern for security."

Once certification for the modified A9 is in the bag, Potts is looking forward to seeking certification for D4 virtualization on other smartphones. The first time around takes time because there is a lot of preparatory work to do, but much of that work will also apply to other smartphones. Potts expects certification of D4 on other hardware to go more quickly.

Eric Klein, director for mobile software and enterprise mobility at analyst firm VDC Research, has had his eye on Cog Systems since meeting the company at Mobile World Congress.

He sees the broadest opportunity for Cog Systems in the enterprise market -- and expects that its approach to endpoint security could even take some business away from enterprise mobility management vendors.

Legal war with Apple hits Qualcomm's revenue projections

Qualcomm's reduced its third quarter revenue projections as it expects not to receive a large chunk of licensing revenue from Apple's partners

The legal fight between Apple and Qualcomm on licensing modem technology is turning uglier every day.

Apple has filed lawsuits against Qualcomm in countries like the U.S., U.K., China and Japan, accusing the chipmaker of using its dominant market position to overcharge licensing fees.

The iPhone maker itself doesn't pay licensing fees directly to Qualcomm. The fees are paid by partners like Foxconn, which makes the iPhone and iPad for Apple.

Qualcomm is now accusing Apple of interfering with the licensing payments owed by those partners. Its revenue forecasts for the third quarter are affected, Qualcomm said.

The chipmaker on Friday revised its revenue projections for the third fiscal quarter. It is projecting revenue to be between $5.3 billion and $6.1 billion. That range runs between a decrease of 12 percent and an increase of 1 percent, compared to the same quarter last year. The forecast removes royalty revenues from Apple's contract manufacturers.

In a second quarter earnings call, Qualcomm president Derek Aberle said the company's third quarter would be hurt by lower licensing revenue from Apple's partners, but he couldn't pinpoint an exact amount. Apple is a big customer of the chipmaker.

In the most recent quarter, Apple suppliers underpaid royalties to the tune of $1 billion, Qualcomm said. But the chipmaker didn't take a loss those underpayments because the amount was similar to a sum held up by Qualcomm but owed to Apple in a separate agreement.

Apple in January filed a $1 billion lawsuit against Qualcomm in a California court, claiming the chipmaker was overcharging for royalties. Apple said Qualcomm was charging royalties for a portfolio of technologies, and not for the price of the baseband chip used in mobile devices. Qualcomm countersued Apple earlier this month for breach of contract and failure to negotiate licensing terms in good faith.

The Apple's lawsuit came after an investigation by the South Korean government resulted in Qualcomm being fined $853 million for unfair licensing practices. Qualcomm accused Apple of cooperating with the South Korean government in its investigation.

Apple is one of Qualcomm's largest customers, with the chipmaker's modems used in iPhones. A small number of iPhones have Intel's modems. Intel is now ramping up its modem product and is making a run at 5G radios, and Apple could move more of its iPhones and iPads away from Qualcomm's modems.

For now, Qualcomm has a lead in modem technology and was the first vendor to offer gigabit modems. Qualcomm has also said outside of the lawsuits, it will continue to maintain a strong supplier relationship with Apple. Samsung continued making chips for Apple's iPhones even though the companies were previously embroiled in lawsuits.

EdgeX Foundry is the solution the IoT world desperately needs

The newest Linux Foundation project is aimed at creating a common framework for IoT companies to improve interoperability and healthy growth of IoT ecosystem

IoT (internet of things) is playing a very critical role in the industrial and enterprise space. It’s being used by shipping companies track containers. It’s being used in massive warehouses for better usage of space. It’s being used in factories, construction sites and mines to improve safety of workers. There are so many use cases.

It's gradually maturing in the consumer space also, though it’s largely plagued by security concerns for various reasons, mainly by the lack of a business model.

One challenge that is common across the board -- from industrial IoT to enterprise and consumer IoT -- is the lack of any standard based platform or framework. IoT companies are doing their own things, duplicating efforts, writing their own code, their own protocols, creating fragmentations and interoperability challenges as they do all of the above.

It’s actually hindering the healthy growth and adoption of IoT.

The Linux Foundation wants to fix that. More than 50 companies have come together to form a new collaborative project under the umbrella of the Linux Foundation called, EdgeX Foundry.

Just like any other Linux Foundation collaborative project, the goal of the foundry is to simplify and standardize the industrial IoT edge computing by bringing stakeholders together and at the same time allowing each vendor to create their own differentiating products on top of the common base.

Philip DesAutels, Senior Director of IoT for the Linux Foundation, told me in an interview that the core software component of the EdgeX Foundry is Dell’s Project Fuse that the company open sourced and donated to the Linux Foundation.

EdgeX Foundry aims at bringing these benefits to the IoT space:

End customers can deploy IoT edge solutions quickly and easily with the flexibility to dynamically adapt to changing business needs;

Hardware Manufacturers can scale faster with an interoperable partner ecosystem and more robust security and system management;

Independent Software Vendors can benefit from interoperability with 3rd party applications and hardware without reinventing connectivity;

Sensor/Device Makers can write an application-level device driver with a selected protocol once using the SDK and get pull from all solution providers;

System Integrators can get to market faster with plug-and-play ingredients combined with their own proprietary inventions.

Since the focus of EdgeX Foundry is on industrial IoT: when asked how it may help the consumer IoT, he said that the line between consumer and industrial IoT is blurred.

“When we look into consumer space, we see standalone products with ecosystems forming around them,” said Desautels. “Comcast and Verizon sell a whole bunch of home automation products. These products range from security systems, smart door locks, smoke alarms -- products that solve real problems for people. The consumer space in that case looks an awful lot like a small industrial or a small enterprise problem.”

IoT is actually going beyond what we can comprehend. DesAutels gave an example of a theatrical IoT company that does rock concerts and broadway shows, and their platform has to be in near real time. Everything has to sync -- live action and music.

IoT devices are saving companies millions of dollars in lost production. “Weir Group, a 150 year old maker of industrial pumps with over 150,000 assets in the field has turned to Dell Technologies to digitally instrument equipment in the field and move from guessing to knowing when servicing these critical assets,” said Jason Shepherd, Director, IoT Solutions and Partnerships, Dell. “If a pump fails, downtime can quickly exceed millions of dollars of lost production, and an emergency service event comes at a very high cost with some service trips requiring a helicopter ride.”

DesAutels said that we will also see BYOT (bring your own things) in scenarios like energy management systems, where one can bring consumer grade devices and integrate with the building system for monitoring things like air quality or what not. There will be a lot of crossover between industrial and consumer IoT.

The best way to deal with all of those scenarios is by creating a common framework, which is EdgeX Foundry.

However, user facing devices is not the only equation of IoT, it’s actually only the tip of the iceberg, the real iceberg is the back end, the data center, the cloud that run services for these devices.

That’s why Platform as a Service projects like Cloud Foundry are also part of the EdgeX Foundry.

The user facing IoT devices sit at the edge of the network which makes things complicated. You could be running a massive analytics in the cloud, at the same time needing a smaller analytics right at the edge because you don’t want to send every bits to the cloud, you just want to send some higher level information to the cloud to process.

Shepherd gave a good example of such use-cases, "Weir connected the unconnected with the Edge Gateway and used edge analytics on the sensor data to predict when pump failures will occur. Analytics in the core and cloud enable their customers to look at operations trends across all their assets, while keeping data on premise if they desire. Finally, Weir is using all this new data to optimize product development decisions and compete more effectively."

“There's a real compliment between Cloud Foundry being a standardized infrastructure, its standardized model for cloud compute, and EdgeX foundry in its standardized model for Edge compute, and then you have that little gray area in the middle where things kind of move back and forth over that edge, the permeable barrier,” said DesAautels.

The goal of the EdgeX Foundry doesn’t stop at creating this framework, it goes beyond that. Two additional key areas that the foundry will focus on is certification and compliance. “Once you have the first release of EdgeX foundry, this core framework, how do you start certifying things as being compatible and compliant with it?

The Linux Foundation is home to many IoT/cloud related projects, including the Cloud Foundry. Being part of the same organizations not only allows these projects to collaborate with each other at a much deeper level, it allows allows these projects to take advantage of the growing expertise of the Linux foundation in other areas including compliance, certification and educational courses.

The project will be governed in the typical Linux Foundation manner: there will be a technical steering committee to drive the code and provide technical direction of the project and then there will be a governing board to drive business decisions, marketing and ensure alignment between the technical communities and members.

This article is published as part of the IDG Contributor Network. Want to Join?

The Week in Apple News and Rumors: Today at Apple, iPhone 8 rumors, ‘Carpool Karaoke’ delayed, and more

Surface revenue does a U-boat, and dives

Microsoft blames line's age and tough competition for its biggest year-over-year beating

Revenue generated by Microsoft's Surface hardware during the March quarter was down 26% from the same period the year before, the company said yesterday as it briefed Wall Street.

For the quarter, Surface produced $831 million, some $285 million less than the March quarter of 2016, for the largest year-over-year dollar decline ever.

Microsoft blamed the portfolio's age and increased competition from hardware partners for the fall-off. "Our Surface results fell short of expectations impacted by end-of-product-lifecycle and increased price competition," contended Satya Nadella, Microsoft's CEO, in the Thursday earnings call.

The Surface Pro 4, the portfolio's top seller, was introduced in October 2015, and has not been refreshed since then.

Analysts accepted Microsoft's reasons for the downturn.

"There is competition that is lower-priced," said Carolina Milanesi of Creative Strategies in a Friday interview. "There's not just more of the same, but a lot that are positioned in the same space are cheaper. And there were expectations that we would have seen a [product] refresh that we haven't seen yet."

Jack Gold, principal analyst at J. Gold Associates, echoed Milanesi on the age angle. The revenue decline "indicates that the aging product needs a refresh badly," Gold wrote in a note to clients today. "Price cutting and competing vendors' products will continue to create declines until new product is released, rumored for later this year."

Microsoft threw cold water on any significant changes to the Surface line before June, forecasting that the current quarter will also post a revenue decline.

Initially, Surface was pitched by Microsoft as a kick-in-the-pants to its partners, the OEMs, or "original equipment manufacturers," which until 2012 had had a lock on the Windows hardware market. Microsoft meant to show the OEMs what a cutting-edge, premium-priced device could do, and how it could best demonstrate the power of Windows.

Milanesi rejected the idea that the quarter's revenue decline signaled retrenchment by Microsoft, that the company considered the line's mission fulfilled by the rise in 2-in-1s from partnering OEMs.

"Surface as a revenue segment is important; it's not just a reference design," said Milanesi, using the term bandied when Microsoft first entered the personal computer hardware space.

One reason why Surface carries weight at Redmond, said Milanesi: The 2-in-1, tablet-slash-notebook mostly sells to enterprises, or to employees who buy it themselves for work. That plays to Microsoft's own company-wide emphasis on corporate customers. It also brings the usual advantages earned by courting enterprises, including less price sensitivity and, unlike the consumer market, a steadier calendar that doesn't rely on high seasonal sales at the end of each year.

Even so, Milanesi thought Microsoft was missing an opportunity by focusing on business sales of the Surface, particularly the Surface Pro. "Microsoft needs to do more than just the enterprise -- such as looking at higher ed students, people who may have picked a MacBook Air -- and see what they can do in that space," she argued.

This story, "Surface revenue does a U-boat, and dives" was originally published by Computerworld.

Sony Xperia XZ Premium gets a new color: Bronze Pink

Sony Xperia XZ Premium gets a new color: Bronze Pink

As we near the start of sales of the Xperia XZ Premium, Sony has a surprise for us - a Bronze Pink color option. Here’s what Xperia Color Designer (that’s a job position apparently), Satoshi Aoyagi, has to say about the new hue:

“We wanted to find a colour that represented a feeling of warmth whilst at the same time exemplifying the premium features and design. The bronze metallic finish adds a feeling of depth to the glass on the front and back.”

Sony Xperia XZ Premium in Bronze Pink

Bronze Pink (don’t call it Pink Gold) certainly adds a pop of color to the monochrome Deepsea Black and Luminous Chrome. Pre-orders are already underway, but the new color option hasn’t been added yet (in fact, Amazon’s options are quite wrong).