OnQ Blog

Qualcomm Technologies’ product security solutions receive vital FIPS certification

Qualcomm Trusted Execution Environment and Qualcomm Secure Processing Unit receive FIPS certification for the first time.

Apr 16, 2020

Qualcomm products mentioned within this post are offered by Qualcomm Technologies, Inc. and/or its subsidiaries.

One of the ways Qualcomm Technologies is helping the world better connect is by enhancing the security of our products. We do this in part by constantly strengthening our security certification portfolio.

Our latest achievement is acquiring Federal Information Processing Standard (FIPS) certifications on the cryptographic modules on the Qualcomm Trusted Execution Environment (TEE) and Qualcomm Secure Processing Unit, found in the Qualcomm Snapdragon 855 mobile platform.

The crypto modules on the Qualcomm TEE received a FIPS Level 140-2 Level 1 certification, while the modules on the Qualcomm Secure Processing Unit were awarded a FIPS 140-2 Level 2 certification. Both subsystems are designed to help safeguard vital and sensitive end user data.

Our newest FIPS certifications

The newly certified crypto modules, listed below, are used in applications requiring robust security such as mobile payments and biometrics, integrated SIM (iUICC), and key management for user data and privacy like Android Keymaster and Strongbox.

  • Qualcomm Trusted Execution Environment Software Cryptographic Library – FIPS 140-2 Level 1 (#3559)
  • Qualcomm Secure Processing Unit
    • FIPS 140-2 Level 2 (#3549)
    • Previously certified in Common Criteria EAL4+ (BSI-DSZ-CC-1045-2019) AVA_VAN.5 (resistance to high attack potential)

Because these certified modules meet government and military standards, end users can rest assured that their data is stored and processed in a highly protective manner. In addition, the Qualcomm TEE cryptographic ACVP test framework is available to customers on the Snapdragon 855, making software-cryptographic certifications easier for mobile OEMs.

These two newly certified modules will enhance our current portfolio of FIPS-certified hardware cryptographic modules, which are utilized in key generation and File Based Encryption (FBE) features:

  • Qualcomm Crypto Engine Core – FIPS Level 2 (#3434)
  • Qualcomm Pseudo Random Number Generator– FIPS Level 1 (#3114)
  • Qualcomm Inline Crypto Engine  – FIPS Level 1 (#3124)

The significance of FIPS 140-2 certifications

Cryptographic modules are responsible for device functions that require the highest level of security, such as encryption, digital signatures, and authentication methods. The information protected by these cryptographic modules — which includes passwords, personal biometric information, mobile payment tokens, and SIM profiles— need to be well-guarded.

While FIPS 140-2 Level 1 certification focuses on a basic level of compliance, Level 2 concentrates on a tougher authentication implementation and a physical protection of the plaintext cryptographic keys and critical security parameters within the module. To meet the requirement, modules need to have tamper-evident mechanisms that are designed to prevent clever hackers from stealing information.

These additional protocols are engineered to support an increased level of security that’s needed for important and valuable personal data on a device. They’re especially critical when it comes to protecting biometric data, such as an individual’s fingerprint or iris.

What this means for smartphone manufacturers and buyers

Incorporating a system-on-chip with multiple FIPS 140-2 certifications enables device manufacturers to qualify for additional business opportunities, including government contracts that need to standardize purchases across numerous branches, enterprise customers, automobile contracts that want to enhance overall security practices, and healthcare devices.

 

Qualcomm Snapdragon, Qualcomm Trusted Execution Environment, Qualcomm Crypto Engine Core, Qualcomm Pseudo Random Number Generator, Qualcomm Inline Crypto Engine and Qualcomm Secure Processing Unit are products of Qualcomm Technologies, Inc. and/or its subsidiaries.

 

Engage with us on

and

Opinions expressed in the content posted here are the personal opinions of the original authors, and do not necessarily reflect those of Qualcomm Incorporated or its subsidiaries ("Qualcomm"). Qualcomm products mentioned within this post are offered by Qualcomm Technologies, Inc. and/or its subsidiaries. The content is provided for informational purposes only and is not meant to be an endorsement or representation by Qualcomm or any other party. This site may also provide links or references to non-Qualcomm sites and resources. Qualcomm makes no representations, warranties, or other commitments whatsoever about any non-Qualcomm sites or third-party resources that may be referenced, accessible from, or linked to this site.

Related News

©2020 Qualcomm Technologies, Inc. and/or its affiliated companies.

References to "Qualcomm" may mean Qualcomm Incorporated, or subsidiaries or business units within the Qualcomm corporate structure, as applicable.

Qualcomm Incorporated includes Qualcomm's licensing business, QTL, and the vast majority of its patent portfolio. Qualcomm Technologies, Inc., a wholly-owned subsidiary of Qualcomm Incorporated, operates, along with its subsidiaries, substantially all of Qualcomm's engineering, research and development functions, and substantially all of its products and services businesses. Qualcomm products referenced on this page are products of Qualcomm Technologies, Inc. and/or its subsidiaries.

Materials that are as of a specific date, including but not limited to press releases, presentations, blog posts and webcasts, may have been superseded by subsequent events or disclosures.

Nothing in these materials is an offer to sell any of the components or devices referenced herein.