Google announces Android pKVM framework SESIP Level 5 certification
Google has reached a significant milestone in mobile security with the announcement that Android’s Protected KVM (pKVM) hypervisor has officially received SESIP Level 5 certification. This achievement marks pKVM as the first software security system designed for large-scale consumer electronics deployment to attain this prestigious assurance level. The certification process involved rigorous evaluation by Dekra, a globally recognised cybersecurity certification laboratory, which conducted comprehensive testing against the TrustCB SESIP scheme in compliance with EN-17927 standards. The SESIP Level 5 certification incorporates AVA_VAN.5, representing the highest level of vulnerability analysis and penetration testing under the ISO 15408 Common Criteria standard. This certification validates that pKVM can withstand attacks from highly skilled, well-motivated, and well-funded adversaries who may possess insider knowledge and system access. According to Dave Kleidermacher, VP of Engineering for Android Security & Privacy, this certification enables Android to securely support next-generation high-criticality isolated workloads, including on-device AI applications processing ultra-personalised data with maximum privacy and integrity assurances.
The certified pKVM fundamentally transforms Android’s multi-layered security strategy by providing a single, open-source, and exceptionally high-quality firmware foundation that all device manufacturers can utilise. This standardisation eliminates the inconsistency challenges developers face when building highly critical applications requiring robust and verifiable security levels. Moving forward, Android device manufacturers will be mandated to implement isolation technology meeting equivalent security standards for various device-dependent security operations. This ensures that every user benefits from a consistent, transparent, and verifiably secure foundation across the Android ecosystem. Google’s achievement addresses a critical gap in the industry, where many Trusted Execution Environments (TEEs) lack formal certification or operate at lower security assurance levels.
