webinos project deliverable: Phase 1 Security Framework

The webinos project aims to deliver a cross-device web application runtime environment, providing a unified development platform and standardized inter-device communication and interaction. This document contains the first iteration of the technical security and privacy framework designed for the webinos project. It accompanies two other documents - D3.1 System Specification and D3.2 API Specifications - and refers to concepts developed in them. The security and privacy architecture aims to protect webinos users and systems from many threats, including those of malicious software, unauthorised data collection, violations of privacy and loss of personal data. A number of contributions are made in this deliverable: existing mobile security architectures are analysed, key threats are identified, several pieces of security and privacy- protecting functionality are specified and guidelines are provided to developers of the webinos runtime. Security functionality includes a security and privacy policy architecture, platform integrity checking, authentication, authorisation, and interfaces to manage the end user's new personal webinos network of devices. The specifications, requirements and guidelines given in this document form the initial basis of the webinos security architecture. It is expected that this will be updated as the platform is implemented and evaluated, and phase 2 of the project will propose further improvements and functionality