Open Kernel Labs bets big on mobile security

Embedded virtualisation company Open Kernel Labs has introduced a mobile security product based on the company's phone-specific hypervisor, the OKL4 'microvisor'.

The SecureIT Mobile Enterprise package allows the creation of independent secured domains on a mobile device, the company announced at Mobile World Congress 2011 on Monday.

Open Kernel Labs has introduced a mobile security product based on the company's phone-specific hypervisor, the OKL4 microvisor. Photo credit: Open Kernel Labs

The product, which combines an embedded hypervisor with tailored security software, is part of a future vision where "employees bring personal devices to work and happily let employers install enterprise mobility solutions [on them]", Open Kernel Labs said.

For example, if a SecureIT Mobile Enterprise-equipped phone is brought into the enterprise, the IT department can create a virtual secure enterprise instance on the personal phone. This will house corporate data and communications in a sandboxed area, partitioned from the owner's personal area.

If the employee leaves or is made redundant, the enterprise instance can be zapped away without any collateral damage to the owner's personal data, according to Open Kernel Labs.

SecureIT Mobile Enterprise is installed as a firmware update on top of Open Kernel Labs's own phone-specific hypervisor, the OKL4 microvisor. A microvisor is the company's term for an embedded hypervisor with a smaller codebase than a typical hypervisor.

"As a type-1 [bare metal] virtualisation solution, the microvisor addresses the [security] issue by replacing all the complex Linux code with a much smaller — less than 10,000 lines of code — privileged layer, which significantly strengthens the fences between the personal domain and enterprise domain," Rob McCammon, Open Kernel Labs's vice president of product management, told ZDNet UK.

Betting on take-up

Open Kernel Labs's idea is that when people take their personal phone into a business, it will support SecureIT Mobile Enterprise. Therefore, the success of the product will be decided by its uptake by mobile hardware manufacturers, McCammon admitted.

"We are engaged with a couple of lead customers; we will not name them until the devices are commercially in the market," he said. "Think of it as a feature of a particular model of smartphone and tablet.

I believe that over a time measured in years — but single-digit years — this will become as ubiquitous on devices as touchscreens and cameras.

– Rob McCammon, Open Kernel Labs

"When the first handful of devices that are enabled this way come out and offer state-of-the-art tablet and handset capabilities — plus a secure managed enterprise environment — it'll be easier for employees to choose a list of phones they like off a list of approved corporate devices," McCammon said.

"I believe that over a time measured in years — but single-digit years — this will become as ubiquitous on these devices as touchscreens and cameras," he said.

McCammon expects the first mobile devices with the product pre-installed to be unveiled soon. "Within the next month, you'll see our own announcement with one of the top five device makers," he said.

There are plans in the future for the product to be downloadable, but at the moment it requires collaboration between Open Kernel Labs and the original equipment manufacturer (OEM) to get it tailored and locked down to the specific device.

Initially, it will support Android, as that is where the company sees "the biggest opportunity", according to McCammon.

"That same drive that led server virtualisation to become ubiquitous will lead to mobile-device virtualisation happening over time," he added.

Open Kernel Labs has worked with virtualisation company Citrix, an investor in the company, to develop a phone that can be turned into a thin client for remotely accessing enterprise desktops.

The company's other industry partners include Motorola, LG, HTC, Qualcomm, Toshiba and ARM.

Going up against VMware

In 2008, VMware launched its own mobile virtualisation product — the Mobile Virtualisation Platform — and in 2010 announced plans to team up with LG to put the technology into some future handsets.

McCammon said that although VMware is a huge player in virtualisation, that does not mean that Open Kernel Labs cannot compete.

"It's a different architecture," he said. "VMware runs as an application on top of the operating system rather than directly on the hardware, which means the security benefits it offers in terms of supporting multiple environments is minimal."