Dave Ishii - Problem Solving Blog

1. Hardware Supply Chain Integrity

• The Problem: Preventing malicious "hardware Trojans" from being secretly embedded in a smartphone's processor (SoC) during its complex, global manufacturing process. A single compromised chip could bypass all software security.

• Related Pure Math Topic: Formal Methods & Model Checking. This is a branch of mathematical logic used to prove that a complex system (like a circuit design) adheres to a specific set of rules. You model the chip as a mathematical object and use automated reasoning to verify properties, such as "this memory location can never be accessed by this process," to detect deviations.

• Key Researchers: Edmund M. Clarke, E. Allen Emerson, and Joseph Sifakis. They won the Turing Award for their pioneering work in developing model checking, the core automated technique for this kind of formal verification.

---

2. Mitigating Side-Channel Attacks

• The Problem: Attackers can steal encryption keys not by hacking the software, but by observing the phone's physical side effects, like its power consumption patterns or electromagnetic (EM) radiation. These physical leakages provide statistical clues about the secret data being processed.

• Related Pure Math Topic: Statistics & Information Theory. The attack is a statistical one: finding a correlation between the leaked signal (power usage) and the secret key. The defense (called "masking") is based on probability theory, adding mathematical "noise" to break this correlation, making the leaked information statistically useless.

• Key Researchers: Claude Shannon (the "father of information theory," who mathematically defined information leakage) and Paul Kocher (who first demonstrated how to use these statistical methods in practice to break real-world cryptographic systems).

---

3. Effective and Scalable App Vetting

• The Problem: Malicious apps still get past the automated and human reviews of the Google Play and Apple App Stores. They hide their malicious intent until after they are approved, making detection incredibly difficult at scale.

• Related Pure Math Topic: Computability Theory (specifically, the Halting Problem). This mathematical concept, proven by Alan Turing, states that it is impossible for a computer to determine for all possible programs whether that program will ever stop running. By extension, it's impossible to create a perfect, universal "malice detector" that can analyze any app and definitively prove it will never perform a malicious action.

• Key Researchers: Alan Turing and Alonzo Church. Their work (the Church-Turing thesis) established the fundamental, mathematical limits of what computers can and cannot compute, which is the theoretical barrier that app vetting systems will always face.

---

4. Zero-Day OS and Kernel Vulnerabilities

• The Problem: Attackers find and exploit unknown flaws (zero-days) in the core operating system (iOS or Android). Because the OS kernel has a "privileged" level of access, a single flaw here gives an attacker complete control, bypassing all app-level security.

• Related Pure Math Topic: Computational Complexity Theory (specifically P vs. NP). A program's code can be modeled as a massive graph of possible states. Finding a vulnerability is like finding a specific, hidden path in that graph. The P vs. NP problem asks (among other things) if finding such solutions is fundamentally "hard." The difficulty of finding exploits is deeply related to the (presumed) difficulty of solving these NP-complete problems.

• Key Researchers: Stephen Cook and Leonid Levin. They formalized the concept of "NP-completeness," which provides the mathematical framework for understanding why finding these vulnerabilities is so difficult—both for defenders (who want to find and fix them) and attackers (who want to find and exploit them).

---

5. Securing the IoT and Wireless Perimeter

• The Problem: A smartphone must constantly connect to "untrusted" devices (smartwatches, IoT sensors, car Bluetooth) over insecure wireless channels. A vulnerability in a simple smart-bulb's Bluetooth stack could become an entry point to compromise the entire phone.

• Related Pure Math Topic: Number Theory & Elliptic Curve Cryptography (ECC). This is the math that allows for public-key cryptography. It enables two devices that have never met (like your phone and a new Bluetooth headset) to agree on a secret, encrypted key over an open, public channel. ECC, which is based on abstract algebra, is crucial for phones because it provides the same level of security as older methods (like RSA) using much smaller keys and less computational power.

• Key Researchers: Whitfield Diffie & Martin Hellman (who invented public-key exchange) and Neal Koblitz & Victor S. Miller (who independently proposed the use of elliptic curves for cryptography, making it efficient enough for mobile devices).

---

6. Device-Level Social Engineering Defense

• The Problem: The most effective attacks (like "smishing") don't hack the code; they hack the human user, tricking them into giving up a password or installing malware. The industrial challenge is to build a system that can detect and block this deception in real-time.

• Related Pure Math Topic: Game Theory. This is the mathematical study of strategic decision-making. A phishing attack can be modeled as a "game" between the attacker (who chooses a deceptive strategy) and the user. The phone's OS must act as an agent for the user, analyzing the attacker's "moves" (e.g., sense of urgency, suspicious links) to predict the strategy and recommend the best counter-move (e.g., "This message appears to be a scam").

• Key Researchers: John von Neumann (who founded the field) and John Nash (who developed the concept of the "Nash equilibrium," a key way to analyze the strategies of all "players" in a game).