Automatic Permission Optimization Framework for Privacy Enhancement of Mobile Applications

Qu, Yiting; Du, Suguo; Li, Shaofeng; Meng, Yan; Le, Zhang; Zhu, Haojin

doi:10.1109/jiot.2020.3039472

Cited by 7 publications

(3 citation statements)

References 19 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Qu et al proposed Permizer, an automatic permission optimization to recommend app permission configuration to users. Permizer builds a mapping between permissions and functionalities for each app then regulates the relationship between permission and functionality based on the user's privacy preferences [28]. Xiao et al proposed an approach to identify minimum required permissions for an android app.…”

Section: Related Workmentioning

confidence: 99%

Privacy Protection Framework for Android

et al. 2022

View full text Add to dashboard Cite

The increase in popularity and users of the Android platform in recent years has led to a lot of innovative and smart Android applications (apps). Many of these apps are highly interactive, customizable, and require user data to provide services. While being convenient, user privacy is the primary concern. It is not guaranteed that these apps are not storing user data for their need or scrapping algorithms through them. Android uses the system of permissions to provide security and protect user data. The user can grant permission for requested resources either at runtime or during the installation process. However, this system is often misused in practice by demanding extra permissions that are not required to provide services. These kinds of apps stop functioning if all permissions are not granted to them. Therefore, in this paper, a privacy preserved secure framework is proposed to prevent an app from stealing user data by restricting all unnecessary permissions. Unnecessary permissions are recognized by predicting the permissions required by a given app by using collaborative filtering and frequent permission set mining algorithms. Thus, the proposed model interacts with the target application and modifies the permission data inside. Experimental results reveal that the proposed model not only protects the user data but also ensures the proper functioning of the given application.

show abstract

Section: Related Workmentioning

confidence: 99%

Privacy Protection Framework for Android

et al. 2022

View full text Add to dashboard Cite

show abstract

“…Some recent solutions, such as (Caputo et al, 2021) focused on anonymization of data to preserve the privacy of the user. In (Qu et al, 2020), authors introduce an automatic permission management model, which collectively considers the risk of the permission, functionalities of the app, and user's privacy requirement. However, none of these solutions helps users understand the Intent of the developer.…”

Section: Low-level Modificationmentioning

confidence: 99%

Intent-aware Permission Architecture: A Model for Rethinking Informed Consent for Android Apps

Rahman

Miller

Hossain

et al. 2022

Proceedings of the 8th International Conference on Information Systems Security and Privacy

View full text Add to dashboard Cite

As data privacy continues to be a crucial human-right concern as recognized by the UN, regulatory agencies have demanded developers obtain user permission before accessing user-sensitive data. Mainly through the use of privacy policies statements, developers fulfill their legal requirements to keep users abreast of the requests for their data. In addition, platforms such as Android enforces explicit permission request using the permission model. Nonetheless, recent research has shown that service providers hardly make full disclosure when requesting data in these statements. Neither is the current permission model designed to provide adequate informed consent. Often users have no clear understanding of the reason and scope of usage of the data request. This paper proposes an unambiguous, informed consent process that provides developers with a standardized method for declaring Intent. Our proposed Intent-aware permission architecture extends the current Android permission model with a precise mechanism for full disclosure of purpose and scope limitation. The design of which is based on an ontology study of data requests purposes. The overarching objective of this model is to ensure end-users are adequately informed before making decisions on their data. Additionally, this model has the potential to improve trust between end-users and developers.

show abstract

“…Users of mobile OSs can utilize the permission mechanism to fine-tune the available resources on a perapplication basis. In the security research community, many studies have been conducted on permission mechanisms in mobile OSs, including large-scale measurements [4], [5], [6], user perception [7], [8], [9], [10], unauthorized privilege acquisition [11], [12], and the proposals of new permission mechanisms [13], [14], [15], [16]. While mobile OS permission mechanisms have been studied by many researchers, to the best of our knowledge, no studies have systematically analyzed the permission mechanisms of web browsers.…”

Section: Introductionmentioning

confidence: 99%

Understanding the Inconsistencies in the Permissions Mechanism of Web Browsers

Nomoto,

Watanabe,

Shioji

et al. 2023

Journal of Information Processing

View full text Add to dashboard Cite

Modern Web services provide advanced features by utilizing hardware resources on the user's device. Web browsers implement a user consent-based permission model to protect user privacy. In this study, we developed Permium, a web browser analysis framework that automatically analyzes the behavior of permission mechanisms implemented by various browsers. We systematically studied the behavior of permission mechanisms for 22 major browser implementations running on five different operating systems. We found fragmented implementations. Implementations between browsers running on different operating systems are not always identical. We determined that implementation inconsistencies could lead to privacy risks. We identified gaps between browser permission implementations and user perceptions from the user study corresponding to the analyses using Permium. Based on the implementation inconsistencies, we developed two proof-of-concept attacks and evaluated their feasibility. The first attack uses permission information to secretly track the user. The second attack aims to create a situation in which the user cannot correctly determine the origin of the permission request and the user mistakenly grants permission. Finally, we clarify the technical issues that must be standardized in privacy mechanisms and provide recommendations to OS/browser vendors to mitigate the threats identified in this study.

show abstract

Automatic Permission Optimization Framework for Privacy Enhancement of Mobile Applications

Cited by 7 publications

References 19 publications

Privacy Protection Framework for Android

Privacy Protection Framework for Android

Intent-aware Permission Architecture: A Model for Rethinking Informed Consent for Android Apps

Understanding the Inconsistencies in the Permissions Mechanism of Web Browsers

Contact Info

Product

Resources

About