Data scrambling for handhelds has been made simpler with new software from Extended Systems. Encrypting data on handhelds is recommended (see Lock up your mobile data), otherwise it is left exposed if a PDA or smartphone is lost or stolen.
OneBridge Mobile Secure, a new option in the company's OneBridge mobile middleware, lets owners encrypt all or part of their data on a range of handheld devices. The suite also includes APIs, database access and client programs for deploying applications on mobile devices.
The product joins an already busy market, where companies like Pointsec, Utimaco and JP Mobile have become established. Pointsec, particularly, has a solution that force-encrypts subsidiary storage on mobile devices. However, there could well be room for more mobile encryption solutions, since Pointsec reckons that only 43 percent of corporate PDAs are encrypted.
The initial release of Mobile Secure is for devices running PalmOS 3.5 or higher. This autumn, the company will release versions for the Microsoft PocketPC, Windows Smartphone 2003, and Symbian operating systems. The current OneBridge Win32 client for desktop and notebook PCs is being reworked slightly to support Mobile Secure, and will also be released this autumn.
Mobile Secure installs on a server and makes use of various elements in the OneBridge suite. An editor lets you create device encryption policies for your users, such as requiring a certain number of characters in a password and identifying what folders, subfolders, files and databases are to be encrypted.
The server program handles the software provisioning to the client devices as they log on and updates the devices with any changes to encryption policies. It encrypts data using Advanced Encryption System (AES - the US government standard encryption scheme, as used in the 802.11i secure Wi-Fi standard). It can also use Triple DES and Blowfish.
Users enter a PIN number, or a user ID and password, and the client code decrypts the data. The work takes place in the background, so other applications can still run. Mobile Secure decrypts the data according to preset priorities, and releases the data for use as soon as it’s unscrambled. If a user starts to work with a data set that's not yet encrypted, Mobile Secure is smart enough to pause, grab that data, and decrypt it at once.
On a smartphone, OneBridge leaves the telephony applications themselves untouched. But users will enter their PIN or password to decrypt personal or corporate data that might go into an e-mail message sent via the phone.
When the handheld goes into suspended animation after a delay, the screen locks, and after a time set by an administrator, all the data is automatically re-encrypted. If the device is stolen, an administrator can use OneBridge to delete all data if the device tries to log into the server again. OneBridge Secure Mobile costs US$75 per user.