Qualcomm has announced an upgrade to the Snapdragon 855's Secure Processing Unit (SPU) which will bring the unit in line with the security standards of smart cards.
On Wednesday, the US chipmaker said the SPU, an on-die security component, has been awarded the Common Criteria EAL-4+ global security certification. In order to receive this level, a product has to be thoroughly reviewed by an independent organization and tested for security vulnerabilities.
The certification of the Qualcomm Secure Processing Unit was approved by the Bundesamt für Sicherheit in der Informationstechnik (BSI).
Qualcomm's SPU is currently used for systems including Android StrongBox and Gatekeeper.
Qualcomm says that with the certification, the Snapdragon 855 is the first mobile System on Chip (SoC) to obtain "smart card levels of security assurance."
In addition, the company claims that OEM customers will be able to reduce their materials expenses without sacrificing strong levels of security.
"Completing the EAL-4+ security certification is a major milestone in our journey to bring smart card levels of security to our Snapdragon customers and users. Use cases that previously required separate security chips will now be possible fully integrated in Snapdragon 855 powered devices," said Jesse Seed, senior director of product management at Qualcomm. "This certification is a testament to the industry firsts that Snapdragon 855 brings to market and Qualcomm Technologies' continued leadership in embedded security."
The Qualcomm Snapdragon 855 debuted in December. The SoC includes the Snapdragon X50 5G modem for multigigabit connectivity, Qualcomm Kryo 485 CPU and Qualcomm Adreno 640 GPU -- which combine to create a fourth-generation AI engine -- 4K HDR video capture and playback, and Bluetooth 5.0.
In April, Qualcomm resolved a severe security flaw, CVE-2018-11976, in the tech giant's chipsets with Qualcomm Secure Execution Environment (QSEE) enabled. The vulnerability relates to how sensitive data in Android smartphones and Internet of Things (IoT) devices is handled, and if exploited in tandem with obtaining root access on a device, can result in the leak of 256-bit ECDSA keys.
Previous and related coverage
- Security flaw lets attackers recover private keys from Qualcomm chips
- Qualcomm President Amon intends to win in cloud where company failed in past
- Windows 10 PCs to get 5G for first time as Qualcomm unveils new modem
Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0