My Dissertation Secure tablet application for portfolio managers

The ultimate aim of the project is to secure a tablet application that is used in the financial sector for transactions. This project will encounter the various security issues faced by mobile devices and attempts to provide one or more solutions to the threats. The project was initiated with the investigation of threats that could attack the tablet application. Though the evolution in technology has made many things possible, the most profound architectural challenge lies in the security of the system. It also puts the solutions into practice and displays a secure application for portfolio managers. The secure application will be encapsulated with different layers of security, so that even if the device is lost, the user can still secure his data from being used by unwanted users. The project on a whole looks at the security from developer and end user perspectives.

Application running on Android 

Application running on Android  

Login error from OpenAM

Logout screen confirms to save

Same Application on IOS IPAD

                                  The project begins with the analysis of various threats that could affect a tablet-based application. It mainly deals with storing a data securely in a tablet device, securing the inter process communications & avoid hacking its data by other applications. It also deals with the secure server interactions. The project also secures the “intent” messages & broadcast signals to avoid the hacking data by other applications. It ensures that even when the device is jail-broken (A jail-broken phone can be used with any service provider or can be updated independently from the device manufacturer) the person should have a password, to decrypt the data from the device. The user identity and access will be validated by an identity management server and authorized before they log on to the corporate server. The portfolio application will fetch the data from a JSON servlet and displays it on the tablet. So the project required that server communication be secured with SSL/TLS by authenticating both server and client using certificates. The data transferred will be done using JSON objects. Normally applications use 1-way SSL where the client usually verifies the server, however in this scenario a 2-way SSL encryption is used where both client and server verify each other. The application is restricted to communicate only with specific web servers. On top of all the above mentioned security, the application will connect via Virtual Private networks (VPN) based connectivity to the corporate network along with split tunneling, which ensures the best security for the project.

Android Application Security

Application Security Tips 

       The android architecture is a successor of Linux architecture, it uses the same security model. The android architecture has got several levels of permissions to which we can secure our application. To start with every application will have a unique id called user id (UID), created when installing an application. The applications run only on that UID. All permissions, data access, intent messages were sent using UID.  We can configure the permissions to accept or reject the actions done by the application using the UID. The UID is unique and never gets repeated even when you install the same application in any other device.

  The application also has a share user id which helps share the data of the application with other applications developed by the same developer. Each developer has got a digital signature and it bundled when you pack an application. The share user id uses the digital signature and verifies it and shares its data that application.

Configuring share user ID in   Androidmanifest.xml

            <manifest xmlns:android="http://schemas.android.com/apk/res/android"

       package="com.sencha.portfolio"

       android:versionCode="1"

       android:versionName="1.0"

       android:shareUserId='com.sencha.portfolio.sharedUID"  >     

            </manifest>

Adding the various permissions that your App can use can be determined in the following permissions tab.

Each activity or a process that an application runs can be made private to that process. By default that application will start that process with reference to the UID of an application. If two applications run a same process, to save time and memory we can share it using the share user ID concept.

each activity of your app can be secured in the same GUI 

<activity

 .

 .

 android:name="ActivityNumber95"

 android:process=”com.sencha.portfolio.ShareProcessIDnumber”

       

      </activity>          

Android File system:

    The application runs with its own UID and uses the same for the data storage as well. This design prevents the other applications to access this applications data. It creates the path of storage with the package name and the directory is assigned to the concern UID. This makes the data inaccessible to other applications. The assigned UID act as owner and has got all permission to read or write.

       The application creates the files in the directory assigned and android allows specifying the permissions for the same. This can be done using the function call openFileOutput().

There are three levels of granting access to the files

1)MODE_PRIVATE

2)MODE_WORLD_WRITABLE

3)MODE_WORLD_READABLE.

To make your application more secure we need to use only private mode so that it can be accessed only by the concern application. 

Barclay's Pingit Review

First of all kudos to the app developers.  The idea of making a common app for any bank access is a very innovated  development in the integration of various banks and their accounts. Barclay's  have taken a wide step in this development. Lets move on to the app, The Barclay's Pingit has given a very rapid development in the recent days. Initially it had very limited facilities like checking balance and sending money,but now they had enabled the view to show the various transactions done with the accounts and a separate view for Pingit transactions. 

           

                  The Version 1.2 of Pingit has improved a lot in the various options to see the bank transactions, local branch and share it with various friends. The GUI of the individual views (Bank transactions,show balance, Pingit transactions and other options ) were designed very well but the home view to all these options wasn't impressive. The user wont be given a clear view of various options available in the app.Couple of the options are hidden from the main view but still connected via the main view. The real estate of the user screen hasn't thought properly before the design. On a whole the views were assorted and user needs ample of time to understand the culture of the app. 

With respect to the performance the app  has given its best where it can. The transactions made through the Pingit is ultra fast and it reaches the receiver the next moment. The transactions are made through the mobile numbers connected to the respected accounts and bank. It has made it very easy and secure ,faster than anything. But often the app gets an error because of no connection with the server. Though the device has got enough of service provider signal it fails to make the connection with the server. The app works even in GPRS connections. 

The Pingit app has got enough of security features enabled. It wont store any data in the card . All data directed to device memory . It just store the policy, phone number and app UID. In the latest version released it has crashed the whole app in blackberry device. and it holds up lots of memory. The App also runs in background which is major flows in the security. Any secure App will never be given permission to run in the background.This causes information threat.Even you dont exit the App it has to auto-close itself so that the data security can be maintained.