Semantically Rich Application-Centric Security in Android

Abstract

Abstract-Smartphones are now ubiquitous. However, the security requirements of these relatively new systems and the applications they support are still being understood. As a result, the security infrastructure available in current smartphone operating systems is largely underdeveloped. In this paper, we consider the security requirements of smartphone applications and augment the existing Android operating system with a framework to meet them. We present Secure Application INTeraction (Saint), a modified infrastructure that governs install-time permission assignment and their run-time use as dictated by application provider policy. An in-depth description of the semantics of application policy is presented. The architecture and technical detail of Saint is given, and areas for extension, optimization, and improvement explored. As we show through concrete example, Saint provides necessary utility for applications to assert and control the security decisions on the platform.

Android Mobile Platform Security and Malware Survey

“…A behavior-based malware detection system (pBMDS) is proposed in [31] that use correlation between user's inputs and system calls in order to detect anomalous activities related to SMS/MMS sending. A new service named Kirin security service for Android is described in [33] and [34] that perform lightweight certification of applications to mitigate malware at install time. This service uses security rules, which matches undesirable properties in security configuration, bundled with applications.…”

An Android Malicious Code Detection Method Based on Improved DCA Algorithm

“…Enck, Ongtang, Nauman and others [7][8][9] put forward an optimizing of an Android authorization mechanism. Wognsen et al [10] have conducted in-depth research and analysis on the Dalvik byte code.…”

Attacks on Android Clipboard

“…Several work have been proposed to restrict the app's privilege. While Apex [45] allows users to selectively grant permissions to applications during the installation, Saint [46] goes further by governing runtime permission use as dictated by application provider policy. At the same time, several ideas have been proposed to defeat privilege-escalation attacks, including WoodPecker [40], PScount [26], DroidChecker [31], XMandDroid [28], Stowaway [38], and the work developed by Felt et al [39].…”