Significance: There was some confusion about why Apple was paying $356m for security specialist Authentec, except to gain some patents and steal a prized partner from Samsung. The price seemed high to acquire fingerprint recognition systems, however fashionable for secure mobile transactions or BYOD ‘ though not high enough for some class action lawyers. But behind the biometric sensors, Authentec has other security technologies which could help Apple build a robust DRM platform to boost the iPad’s ability to receive premium video legally, and even more importantly, a security core to rival ARM’s TrustedZone and protect all kinds of sensitive functions within the iPhone.
The $356m purchase of Authentec by Apple has not been universally welcomed. Investors and class actions lawyers, are trying to work out whether the 60% trading premium in the price was sufficiently high. There is a thought out there that, since Authentec had just concluded a deal with Samsung, its directors had the fiduciary duty, when approached by Apple, at least to ask Samsung if it wanted to counterbid ‘ and there was much speculation that the Korean firm would do so anyway, as it saw a potential prize in the worlds of mobile payments, security, digital rights management and BYOD (bring your own device) slipping through its fingers. There was also much confusion about why Apple wanted Authentec, especially at higher price than it paid for PA Semiconductor, the foundation of its processor line. Many have leapt at the obvious answer of fingerprinting technology for enterprise and mobile payments, but far more significant could be Authentec’s security cores, which have the potential to be an alternative to ARM’s would-be trusted zone standards.
Apple is paying $356m, or $8 a share, for Authentec, and also gains the right to pay patent licences totaling as much as $115m. The smaller firm is the leading supplier of smart sensors, identity management software and hardware, and embedded security devices such as fingerprint readers. These use a patented sub-surface technology to read the live layer beneath the skin’s surface where the fingerprint is first formed, which is harder to crack than traditional fingerprint readers. Last year Authentec worked with chipmaker NXP and payments software company DeviceFidelity in an Android NFC project.
As well as appealing to the enterprise, where Apple has been strengthening its mobile capabilities over the past two release of iOS, Authentec’s technology could score the double whammy of disadvantaging similar moves by Samsung, while building on the new Passbook facility. This includes tickets, transports passes, loyalty cards and other items in a single wallet but has not yet gone as far as to support NFC payments or credit cards. With Authentec and NFC it could go up against Google Wallet.
There is still the chance that Samsung could mount a counterbid (Authentec’s mobile VPN client is preloaded on the Galaxy S III), though that would come up against two cancellation fees included in the Apple deal (valued at $20m and $10.95m). But more likely, despite the Korean firm’s out-of-joint nose and possible class actions, Authentec will go to Apple.
Why does Apple want the firm? The bulk of Authentec’s revenue comes from fingerprint recognition systems and it has genuine IPR here. It is a decent market leader in this nascent field, and most analysts assume that Apple will use this technology to secure iOS devices on a fingerprint for two purposes – for enterprise apps and/or mobile payments. Apple is under pressure to step up the hi-tech credentials of its next iPhone to steal back some thunder from Samsung, and mobile devices will need to pack in more security as they handle sensitive functions like payments and location services.
However, nobody can push the global banking community and introduce authentication technology that it has yet to approve of, no matter how ground breaking. Apple already has patents on accessing devices using unique gestures and these have already all been copied by rivals. On the enterprise front there may be applications where this could be used, but to put this in perspective, right now Authentec has quarterly revenues of only just over $10m in fingerprint recognition. These revenues are going down, or are at best flat, and the company has recently reduced its R&D in this area marginally.
So what else could Apple be after? Well there are two other security businesses where Authentec is present – using software protection to create secure downloadable digital rights management, and its silicon-based embedded execution area for encryption ‘ a set of cores that can be used to securely process decryption on-chip, which any security software layer could benefit from. Samsung has recently taken this to underpin its VPN, but it might just as easily be used to underpin a DRM system for video delivery.
The first of these is relevant to one of the debates that has been raging around the most recently launched iPad – the ability of its screen to handle HD video content. Hollywood has vacillated between banning premium HD video from portable devices and allowing it. The best solution has seemed to be to downgrade this video for tablets. Many content owners allow premium video, such as pay-TV, to be delivered over IP in parallel with their TV delivery, to tablets, but at a lower resolution; while others ban it altogether.
The problem for premium content providers has been the software-only nature of the security and only two solutions have emerged which really offer any comfort at all, one from Arxan, which Authentec uses, and one from Irdeto called Active Cloak for Media. These two systems are dominant but slightly different, and they are not secure enough to entrust premium paid HD content to, where it has not yet been widely pirated. One security analyst told us that if smartcards scored nine out of 10 in security terms, these would rate 2.5.
The most secure approach is putting a secure set of decryption processing cores ‘ complete with a hardware enforced firewall and separate processing elements for decrypting keys. The problem here is that, although Authentec offers its DRM Fusion product as a secure software-only, downloadable DRM, the underlying security technology belongs to Arxan, and so it has no real IPR to offer Apple. Many of the App Store video apps are based on either the Arxan or Authentec implementations, but Apple should have been buying Arxan if it wanted to control this process.
This brings us to Authentec’s third security business, based on its SafeXcel IP chip cores. Authentec acquired this technology from Safenet two years ago along with its DRM Fusion product and since it did so it has been investing more R&D in this than any other part of its product portfolio, doubling it each year so far. This included some 23 patents as well as hardware products, and when it bought them, these were seen as simply decryption accelerators for many forms of security processing. Authentec has spent time extending the crypto hardware into a full trusted island inside silicon called SafeZone, a secure execution environment for handsets and tablets. This can be dropped into the Apple A6 and successor chips designed by Apple, which drive its core iOS product lines, making them secure overnight.
It can then offer this to any number of processes – DRM for video delivery, VPN for enterprise security, and potentially it could go beyond this to replacing the heart of security in financial transactions and in identity management (SIMs). Other areas it has been focused on are as a secure OS boot to avoid OS rollback attacks, a secure real time clock for date and time enforcement, random number generator and a safe asset store. The cores can process AES, triple DES and ARC4 decryption with acceleration logic, all in a low power, small, silicon footprint.
This technology can be included in any application processor SoC and used like most hardware security systems, such as a conditional access smartcard, to underpin both a DRM and a VPN. These cores only talk only through an email gateway to each other and to other processor cores. It has already been sold into a number of LG Android devices and is used in Motorola Droids and in NEC devices in Japan. It has similarities to the CryptoFirewall from Cryptography Research, which is included in many set-top box chips.
It could be that there is a happy coincidence here of Apple getting a bunch of technologies that it wants for a number of projects, all at once. But would it pay substantially more than it paid for PA Semiconductor, the basis of its A5/A6 chips ($278m) to provide it merely with an access technology (fingerprint sensors). It seems more likely that the real play here is to differentiate and retain control of hardware security on its devices, in direct response to ARM’s bid to dominate this area via its would-be standards alliance with Gemalto and Giesecke & Devrient.
Apple is also paying $7.5m for some product development, so it looks as though it is in a hurry to build something, probably to come out in one of its next launches. Most likely, this will see the SafeZone core appearing inside an Apple device this fall, which could set the cat among the pigeons for ARM.
This analysis was first published in Wireless Watch’s sister title Faultline, which provides weekly research notes and analysis on the worlds of digital media and quad play.