Otukan gives an OEM or institution control of its mobile device security programme by building protection into the firmware of each device model, inside the OEM’s own build and signing process. You decide which models and chipsets are in scope, who approves each release, and who owns updates after devices ship. Otukan engineers the controls for each model, tests them on the physical devices, and keeps them maintained for the life of the model. Device security covers Android-based devices whose system image the OEM or its ODM builds.
Product scope
Otukan offers three products that protect different layers. Device security is the one that sits below the apps, in the firmware and system image, so it covers the boot chain, system image and update path rather than one app or one policy.
| Device security | App protection | Device management | |
|---|---|---|---|
| Where it runs | Firmware and system image | Inside one app | Operating system management interfaces |
| What it protects | The device: boot chain, system, updates | One app’s code, runtime, data and API | Fleet policy, enrolment and configuration |
| Who integrates it | The OEM or its ODM, with Otukan | The app owner’s engineering team | The fleet operator |
| Typical buyer | Device makers and institutions with their own devices | Banks, fintechs and app publishers | Organisations running device fleets |
The three work together. Signed evidence of each device’s boot state gives device management a verified input for policy, and gives app protection a stronger signal about the device it runs on.
What you get
- Devices that prove what they run. Each device reports signed evidence of its boot state, firmware version and patch level to a server you control, so your services can decide whether to trust it.
- An update path you control. Devices accept only firmware signed through your process and refuse older, vulnerable images.
- A hardened system. Privileged system apps and services, the usual route to taking over a device, are hardened as part of your system image.
- Control where it matters. Institutions choose where device data and verification services live, and who can reach them.
For app-level protection, see mobile app security. For enrolment and policy across a fleet, see mobile device management.
Integration access
Otukan’s protection lives inside your firmware, so the programme starts by confirming the access that makes it possible. Otukan agrees these points with you for each model:
- Model and chipset. The devices, the system-on-chip and the board support package in scope.
- Firmware build access. Who builds the system image and where Otukan’s integration work takes place.
- Signing authority. Who holds the keys for system images and over-the-air updates. Otukan works inside that process and does not take custody of your keys.
- Supplier agreements. What the ODM and chipset vendor allow, and who supports each layer.
- Hardware security features. Which features the chipset provides, so that keys and attestation are anchored in hardware where it offers a trusted execution environment or secure element.
With these confirmed, Otukan designs the controls for each model and builds them into your firmware under your change control.
The integration process is covered on OEM device security integration, and the system design on Android device security architecture.
Lifecycle
A device programme outlasts any single release. Otukan agrees a named owner for each duty before the first device ships, and keeps the protection current through every update.
| Duty | What it covers | What Otukan agrees with you |
|---|---|---|
| Control definition | Which protections are enabled and how they are configured | Who approves a change, and how it is tested |
| Firmware updates | Building, signing and delivering updates | Who builds, who signs, which channel delivers |
| Security patches | Applying platform and vendor patches within the programme | How patches are integrated and retested with the protection |
| Key management | Custody and rotation of signing keys | Where keys are held and who can use them |
| End of support | When updates stop and what happens to devices in the field | The date, and the plan for devices still in use |
Each firmware release is rebuilt with the protection and retested on the physical models before it ships, so security keeps pace with your product. Programmes for OEMs, institutions and operators are set out on device security use cases.
Institutions that need to keep control of device data and access should read sovereign mobile device security. Device makers can read how a manufacturer’s programme is evaluated on device security for device manufacturers. The OEM device security evaluation guide lists the questions to settle before a programme starts.