Simplifying letters of approval

Industry association GlobalPlatform has released a specification which standardizes the digital format of Letters of Approval issued from certification bodies and standardizes how they can be retrieved. This clarity will simplify the process for validating the functional compliance and security certification status of a secure component product or of an application.

The Digital Letter of Approval (DLoA) Specification, which is free to download from the GlobalPlatform website, will be of interest to stakeholders wanting to clarify the certification status of secure component products, such as a secure element (SE) or trusted execution environment (TEE), and of applications. This includes trusted service manager vendors, certification bodies, platform and application developers, platform evaluators, issuers, manufacturers and verification authorities.
Gil Bernabeu, Technical Director at GlobalPlatform, explains: “Today, multiple applications can reside on one secure component. If product issuers commit to ensuring DLoAs are centrally available and presented in a globally consistent manner, as outlined in our specification, trusted service managers and other parties can quickly and easily validate if a product is secure and if an application can be updated without complication.”
The specification also:
·         Clarifies how to access all certification documents (DLoAs) available for a given secure component.
·         Improves the management of the certification lifecycle.
·         Defines a new entity called a DLoA registrar. A repository that states the interface which enables a management system to retrieve a digital letter.
“It is important that product testing and security certification activity does not become a barrier to adoption,” adds Gil. “While the need to confirm the security and performance of a product is paramount, we must continually seek ways to streamline these processes and better align to the product lifecycle needs of the connected device marketplace. This specification defines a relatively easy approach to manage the security of secure component products that carry sensitive and/or basic applications and simplify post-issuance management of applications.”
As AI adoption lags among UK SMEs, potential risks emerge. How can small businesses overcome...
BOXX Insurance is set to join Zurich Insurance Group, continuing its mission in cyber insurance and...
CISPE appeals Broadcom's VMware acquisition approval, citing competition risks and exclusion of...
runZero teams up with Aqaio to enhance its exposure management platform in Germany, aiming to...
A study reveals significant benefits and challenges for U.K. businesses transitioning to Microsoft...
Red Hat introduces updates to streamline partner interactions, focusing on specialisation and...
Slow AI adoption poses financial risks for UK businesses, but strategic opportunities exist in...
Tintri's VMstore is setting new standards in data management for Kubernetes, with significant...