Android for the Enterprise Ge#ng from Here to There

(1)

Android for the Enterprise

Ge#ng from Here to There

(2)

Overview

3LM addresses enterprise needs:

security and device management.

(3)

Overview

server so4 ware pl a6 or m

(4)

(5)

(6)

Use cases

Loss Remediation

Minimize risk of data exposure on lost devices

1

Device is lost or stolen and reported to IT

2

IT locates device using 3LM console and _{locks it}

(7)

Use

Cases

Application Management

Manage which applications users can run

IT remotely deploys policy on which applications can be used on devices

1

4

IT remotely installs approved enterprise applications to devices

2

3

IT runs audit of devices and finds new unauthorized applications to block

!

IT REMOVES the unauthorized application and updates policy

Use cases

(8)

Use

Cases

Permissions-Based Resource Access

Lock down which resources remote users can access

1

IT enables remote access for user and defines which resources they can access across the secure link

3LM routes and enables or blocks access to internal resources based on user profile

2 Use cases

Use cases

(9)

Use

Cases

Unique Configurations for Business

Track devices and whereabouts

Enable breadcrumb tracking of devices to track history of location of a device

Lock down and manage devices to limited purpose

Enable Kiosk-mode type scenarios limiting devices to only use one or a few applications

(10)

How it works

Device and transport encryption Application Control

Leverage data protection tools

•  Enforce strong passwords

•  Remote device lock when devices are lost

•  Remote data wipe – selective data or entire device

Set policy on hardware usage

•  Lock usage of Camera, Bluetooth, Wifi, SD Card, etc.

Track location

•  Fetch location of devices

•  Track location history (breadcrumb)

Secure remote access (VPN)

•  Enable remote access to internal enterprise resources

•  Set permissions by user on resource access

Monitor device health

•  Remote device health and status checking

•  Full device encryption and SD Card encryption using 192-bit AES

•  TLS and AES encryption of data transport over the air

•  Disable pre-installed applications

•  Remotely install applications and make permanent (user cannot remove)

•  Remotely remove applications

•  Set whitelist/blacklist of applications to be used

•  Manage application permissions post-install

How it works

Features

Use Cases

(11)

(12)

How it works

Experience

End User

3LM is running on device and is unnoticeable in normal usage. It does not require

launching an app of any sort for each use once provisioned.

IT can create and deploy policies to enable and disable software and hardware components as well as providing encryption for data protection. Policy management is performed from a remote console and gives IT complete

control of 3LM enabled Android devices.

(13)

Requirements

Handheld

Server Components

•  3LM features activated via app install and provisioning

•  3LM framework embedded on the Android device

•  Subset of features for non-3LM devices

•  Android 2.2 and higher

•  3LM router and 3LM enterprise server

•  Multiple network configuration options: based on who hosts what

(14)

How

it works

Server Components

3LM

Router Enterprise Server

Server that handles setup and management of security of the data transport. Can be hosted by 3LM or located within a customer s premise.

Server that hosts the IT management console for setting up and managing policies on devices. Also acts as the interface to Microsoft Exchange and other back-end systems.

3LM Router 3LM Enterprise Server

Multiple Configurations Possible

3LM Router

Enterprise Server

Enterprise Hosted Hybrid Hosted Full 3LM Hosted

Customer Premise

3LM

Customer Premise 3LM Hosted

3LM

3LM Hosted

VPN

Service RelayMail

Optional Service that allows for secure remote access to internal corporate resources

3LM VPN Service

Optional Service that allows for integration with Microsoft Exchange through the 3LM secure transport channel 3LM Mail Relay VPN Service Mail Relay VPN Service Mail Relay

(15)

How

it works

Enterprise Hosted Model

Enterprise Server Enterprise Server 3LM Router 3LM Router ·∙ Secure Data Transport ·∙ Management Console ·∙ Policy Management ·∙ Microsoft VPN Service Mail Relay 3LM Provisioning Services

Secured Device Provisioning and Setup

Ent erp ris e Ser ver Ent erp ris e Ser ver 3LM Ro ute r 3LM Rou ter ·∙ Sec ure D ata Tra nsp ort ·∙ Man age men t C ons ole ·∙ Pol icy M ana gem ent ·∙ Mic ros oft VPN Ser vic e Mai l Rel ay 3LM Pr ovi sio nin g Ser vic es Sec ure d D evi ce Pro vis ion ing an d S etu p Cus tom er Pre mis e 3LM H ost ed Fac ilit y Ent erp ris e ver Ser 3LM Ro ute r Ser vic es VPN vic Ser e Mai l ay Rel Ent erp ris

e ver Ser ter 3LM Rou

·∙ Sec ure D ata Tra nsp ort ·∙ Mic ros oft Exc han ge Int egr atio n ·∙ Bac k-e nd our Res ce Acc

ess e vic _VPN Ser _l ay _Mai Rel

(16)

Conﬁden)al 16

How

it works

Hybrid Hosted Model

Customer Premise 3LM Hosted Facility Enterprise Server 3LM Router 3LM Provisioning Services VPN Service Mail Relay Enterprise Server 3LM Router ·∙ Secure Data Transport ·∙ Microsoft Exchange Integration ·∙ Back-end Resource Access VPN Service Mail Relay Cus tom er Pre mis e 3LM H ost ed Fac ilit y Ent erp ris e Ser ver 3LM Ro ute r 3LM Pr ovi sio nin g Ser vic es VPN Ser vic e Mai l Rel ay Ent erp ris e Ser

ver ter 3LM Rou

·∙ Sec ure D ata Tra nsp ort ·∙ Mic ros oft Exc han ge Int egr atio n ·∙ Bac k-e nd Res our ce Acc ess VPN Ser vic e l ay Mai Rel C us to m er P re m is e LM H os te d ci lit y En te rp ris e Se rv er 3L M R ou te r 3L M P ro vi si on in g Se rv ic es VP N Se rv ic e M ai l Re la y En te rp ris e Se rv er ·∙ S ec ur e D at a Tr an sp or t ·∙ M ic ro so ft Ex ch an ge In te gr at io n ·∙ B ac k-en d R es ou rc e Ac ce ss VP N Se rv ic e Cus tom er Pre mis e 3LM H ost ed Fac ilit y Ent erp ris e ver Ser 3LM Ro ute r 3LM Pr ovi sio nin g es vic Ser VPN vic Ser e Mai l ay Rel Ent erp ris

·∙ Sec ure D ata Tra nsp ort ·∙ Mic ros

oft han Exc

ge Int egr atio n ·∙ Bac k-e nd Res our ce Acc

(17)

How

it works

Cloud/3LM Hosted Model

3LM Hosted Facility Enterprise Server 3LM Router 3LM Provisioning

Services 3LM Monitoring Services

Secure Data _Management

IT Management 3LM H ost ed Fac ilit y Ent erp rise Ser ver 3LM Ro ute r 3LM Pr ovi sio nin g Ser vice s VPN Ser vice Mai l Rel ay Ent erp rise Ser

ver ter 3LM Rou

·∙ Sec ure D ata Tra nsp ort Cus tom er Pre mis e 3LM H ost ed Fac ilit y Ent erp ris e ver Ser 3LM Ro ute r VPN vic Ser e Mai l ay Rel Ent erp ris

·∙ Sec ure D ata Tra nsp ort ·∙ Mic ros oft Exc han ge Int egr atio n ·∙ Bac k-e nd Res our ce Acc

(18)

(19)

Extending Android

Opportunities

Challenges

•  Leverage existing, mature modules such as eCryptFS, tun

•  Possibility to contribute code back into AOSP

•  Deep Android OS understanding

•  Thriving ecosystem

•  Maintaining platform extensions on top of unknown future changes

•  Reduced functionality for non-3LM devices

•  Must exist within the constraints

Device

Framework

(20)

OEM Collaboration

Benefits

Challenges

•  Helps us re-validate and improve our design

•  Helps strengthen our core “feature” set

•  Visibility into the whole ecosystem

•  A unique differentiator: there is a limit on what you can do with apps

… and the path through VM-land is far from proven

•  Patch lifecycle: ensuring all change sets are correctly applied

•  Debugging problems on unavailable codebase

•  Customized OS software, and hardware

Device

Framework

(21)

Case Study: SD Encryption

Device

Framework

Onboard Flash Memory

Removable SD card

(22)

Case Study: SD Encryption

The harder part

Other proprietary extensions

•  Multiple SD devices, variety of partitioning schemes

•  Various use models, custom media control apps

•  Use of SD card for OTA storage (/cache too small…)

Device

Framework

The easy part

•  dmCrypt already available on the device!

(23)

(24)

Putting it all Together

Main components

Hosting challenges

•  Provisioning server •  Message router •  Enterprise server •  E-mail / VPN components

•  But also: Monitoring, Load balancing and clustering, DB shards

•  Multiple hosting modes (cloud, intranet)

•  Connection throttling (among other EC2 challenges)

•  Switching between networks; internal hosting: scale in vs. scale out

Server

Infrastructure

(25)

Reliability and Tuning

Framework Hell

Performance

•  SSL (Harmony, Netty, thread [un]safety, bugs in EDH implementation)

•  Crypto providers (Android: an oldish built-in Bouncy Castle)

•  C#...

•  Memory demands: 100K’s of live connections

•  Fast asynch I/O, clustering

Server

Infrastructure

(26)

Android for the Enterprise Ge#ng from Here to There