March 04, 2009, 9:56 AM — Germany company Certgate has released versions of an SD card that encrypt data on Windows Mobile 6.1 smartphones and e-mail on BlackBerry devices.
The products, grouped under the name "Protector," have been approved to handle classified information by Germany's Federal Office for Information Security, which tests IT security products for the government, said Axel Stett, Certgate's chief operating officer. Certgate's cards have been used in tests but have been rolled out for general use this week at the Cebit trade show.
Mobile data security has become a prominent concern for IT administrators, as employees are increasingly using mobile devices to handle sensitive data, posing risks if devices are lost or stolen.
The cards slip into devices that have either an SD (Secure Digital), miniSD or microSD card slot. No software has to be installed on the mobile device, Stett said.
The card has a maximum of 1GB of flash memory. Memory is cheap, but it's hard at this point to put much more memory on a smart-card processor, Stett said. Most customers find 1GB of memory adequate now since the devices are intended for business purposes and not for storing music or photos, he said.
The phone is unlocked by entering a smart-card PIN (personal identification number). If a user enters the wrong code three times, the device is locked, Stett said.
Any data written to a Windows Mobile device, such as calendar and contact information, is hardware-encrypted using a combination of RSA 2048-bit and AES (Advanced Encryption Standard) 256-bit keys, Stett said. There is no need for a kill function since the data is encrypted, Stett said. Some vendors offer software that can remotely render a mobile device useless if it is lost.
Voice calls are not encrypted. The cards support SSL (Secure Sockets Layer) VPN (virtual private network) connection to e-mail servers such as Microsoft's Exchange, Stett said. Administrators can also lock down devices and forbid other applications from being installed, Stett said.
Certgate's card for BlackBerry devices only performs S/MIME e-mail encryption. While BlackBerry e-mail is already encrypted, Certgate says its SD card offers an additional layer of protection. So far, that is Certgate's only feature for the BlackBerry, but the company is looking to eventually offer more features.
"We're in talks with Research In Motion," Stett said. "We need to find out more about their interfaces and their software architecture. They may allow us to put on more applications or they may not. We really don't know at this stage."
However, many people stopping by Certgate's stand this week have been interested in the BlackBerry product. "So many people are interested in getting more security on the BlackBerry," Stett said.
Certgate is also considering making Protector compatible with phones running Google's Android OS depending on if there is a compelling business case, Stett said. The iPhone, however, will be left out since it doesn't have an SD card slot, he said.
Certgate's SD cards have been used in pilots within the German government, such as the Ministry of the Interior. About other 20 German authorities will start using the cards in the next month, Stett said. T-Systems, an integrator that's part of Deutsche Telecom, has partnered with Certgate to sell its technology to the government.
The cards cost about €100 (US$125) for a perpetual license, but pricing may vary according to the volumes ordered, Stett said. More product information is available on Certgate's Web site.
