Mitigating risk with over-the-air software

Throughout the summer, the first significant proof-of-concept viruses started to hit mobile devices. In June, the Cabir worm targeted the Symbian operating system, which runs about 70% of the open OS mobile market. And in July, attacks on Microsoft moved off the desktop and onto handhelds with the creation of the Dust virus, which targeted PocketPCs and smartphones running Windows CE. In August, a malicious variation of the original Cabir worm again targeted the Symbian OS, clearly demonstrating that hackers have the means to attack mobile devices.

In short order, nasty viruses likely will soon find their way to popular, often unauthorized ringtone and gaming sites, where, left unchecked, they can spread at will. Unfortunately, mobile viruses are quickly becoming a reality; yet 90% of devices still lack appropriate protection from hackers and attacks.

If carriers and handset manufacturers aren't yet feeling threatened by malicious code, software bugs have proved to be an expensive and devastating problem as software and functionality becomes increasingly complex. Carriers are in a vicious battle for subscribers and are using next-generation networks and increases in device memory to develop more impressive features. From cameras, video recorders, MP3 players, mobile television and more, the devices now have the capability to be all things to all consumers. But this complexity is also resulting in more problems for users and carriers.

For instance, in August Siemens issued a warning to users of a bug discovered in its 65-series handsets. When the phone ran out of power, the disconnect melody played at extremely high volume--loud enough to possibly cause hearing damage. Siemens immediately went to work on a software patch to fix the problem, but the damage to the company's reputation--and bottom line--had likely been done. It was estimated that the bug cost the company between $25 and $95 million.

Siemens isn't alone. Mobile device field failure rates are a huge overhead for the industry. Customer service calls, device returns and product recalls cost carriers and manufacturers an estimated $30 and $50 for each device failure. Research firm Strategy Analytics estimates that the cost of recalling 500,000 handsets varies between $21 and $36 million. Gartner expects that between 620 million and 650 million handsets will be sold in 2004. There is little doubt that many of these will contain problematic software.

Customers are no longer willing to put up with these mistakes, and it's not necessarily the device manufacturers that suffer. The number of carriers and pricing options, mobile number portability and the ease with which customers can change services means they will jump wireless providers at the slightest disappointment. Clearly, carriers need a way to combat both viruses and buggy software in these advanced handsets.

Just as importantly, the ability to deliver new, advanced functionality to existing handsets can prove a boon for carriers looking for ways to keep customers engaged and spending money.

A new way to secure and update

A new technology, over-the-air (OTA) software management for mobile devices, is addressing each of these issues. OTA sends bug fixes, virus defenses, feature upgrades and new applications wirelessly to anyone on the network, without inconveniencing the end user. Carriers should no longer risk deploying applications and features without OTA update-ready mobile device management capabilities. Customer loyalty and the bottom line are at stake.

OTA isn't an entirely new idea. The PC industry now relies on sending software, security, bug fixes and updates over the Internet. Similarly, OTA can keep mobile devices updated and secure. Today, carriers do not use OTA software management to deliver and install ringtones and mobile games; however, the use of OTA capabilities significantly enhances user experience and reduces carrier overhead. OTA solutions are able to send complex, full-size software and patches efficiently over existing networks by reducing the update file size to a manageable level (it is about sending the smallest dif file).

Not only can carriers now combat fatal bugs and viruses with OTA software fixes, they can also generate revenue by offering new services and features on existing handsets by sending them over the air. OTA vendors provide carriers, device manufacturers and end users with a secure process for updating software and sending virus and bug fixes.

First the software creator registers the new software update via a Web-based interface provided by the OTA vendor. The new software is run through a differential algorithm that compares it to existing software components on the device, and generates a small "delta file." This file, with only the new components necessary for the update, is typically 1% to 3% of the original application size. Update time is often just a few minutes for the consumer. Some OTA solutions use "static and dynamic addressing technologies," which determine changes at an even more finite level, and deliver download times that are faster with unparalleled performance and flexibility.

Once the delta file is created, a secure, encrypted software package is sent to the carriers. Carriers then test the software package using an on-site emulator or in a lab, to be certain the entire package was received correctly and will run efficiently for users. With the software package confirmed and authenticated, carriers send the packages to an upgrade server, also provided by the OTA vendor, which handles the actual distribution of software updates.

Carriers are then able to access their own Web-based OTA interface to initiate software updates. For instance, wireless carriers can proactively send bug fixes to users, even when devices have malfunctioned and the user can't request a fix. In other cases, carriers can allow users to schedule updates for a specific time. Carriers can also promote new software and services to customers. For instance, carriers could allow customers to opt-in to text messages highlighting new capabilities, giving them the option to download services like MP3 players or instant messaging clients on-the-fly.

Carriers determine how and when to notify users of impending updates by scheduling the transmission of update notification messages to targeted devices. Carriers often decide to stagger updates to reduce server loads, customer service calls and bottlenecks, particularly when many customers must receive the same update. User groups can be determined by region, area code or device type. Devices can be notified via mobile e-mail or SMS that an update or fix is ready. After receipt of an update notification, and depending on carrier update policy, users can initiate the update immediately or schedule it for a later time. (This works in much the same way many PC software updates are sent and scheduled via e-mail.)

Once the update is initiated, the OTA-capable device establishes contact with carrier servers and begins updating. The device is authenticated, determining the user, device model and again comparing the software version on the device to that which is about to be sent. To guarantee the new software can fit on the device, the delta file size is also compared with how much memory space remains. Once these final hurdles are cleared, the phone downloads the file. Some OTA systems even allow users to continue using the device without interruption during the download.

If service interruption occurs during download, OTA downloading can resume from the exact point of interruption after service is restored. After download, the update itself is initiated. The user is asked again if they want to complete the update and is alerted to the amount of time it will take. After the user confirms the update, normal phone operation is disabled for the first time in the OTA process, and the software update begins. Again, if the update is interrupted--by a battery drop, for example--the update will pick up where it was interrupted. After completion of the update, the device is returned to normal operating mode, and a report is sent back to the carrier's OTA servers alerting the carrier of the successful update.

OTA gives carriers complete control over the update process, ensuring they are able to keep customers updated and secure, and outfitted with the latest functionality and services. Carriers, particularly in Asia, are taking advantage of OTA capabilities on fully functional 3G networks. As those networks are unveiled across Europe, the United States and developing nations, the ability to upgrade via OTA will be quite common. In fact, Strategy Analytics expects that 69% of all handsets will have OTA capabilities by 2009.

OTA is working

It's already saving many carriers from myriad headaches. Earlier this year, NTT DoCoMo in Japan found a bug affecting as many as 160,000 of its new 3G FOMA handsets, which caused unexplained device shut-off. But DoCoMo was prepared: Using software from InnoPath already embedded on the FOMA phones, NTT DoCoMo was able to download a patch to fix a "reboot" bug in 160,000 phones and another set of software bugs in 470,000 phones, respectively, in a matter of minutes. By being able to update these phones seamlessly and quickly, sales and service for the FOMA handsets were not affected, saving the company valuable time and money. Existing inventory was fixed in-store, and the device could still be sold. The company kept customers informed and solved the problem quickly and without interruption.

Meanwhile, KDDI Corp., the second largest wireless operator in Japan, plans to deploy an OTA solution by the middle of next year. KDDI will use OTA to expand revenue by offering new products and services, as well as servicing customers instantly if there is ever an issue with advanced devices and software.

Carriers are in a rush to develop new applications and features that differentiate their services, drive greater revenue and keep customers happy. While advanced networks and powerful handsets allow for amazing functionality, this also opens the door to viruses and bug-filled software. The PC industry has dealt with these problems for years, and there is little doubt the wireless industry must also combat this very real threat. Carriers can take a proactive approach to solving those very problems by implementing OTA mobile device software management. Both the risks and opportunities are too great to ignore.

Dr. Luosheng Peng is CEO and co-founder of InnoPath.

Visit InnoPath online.