|Table of Contents|

Android application fine-grained access control based on self-defined security policy

《南京理工大学学报》(自然科学版)[ISSN:1005-9830/CN:32-1397/N]

Issue:
2016年02期
Page:
142-
Research Field:
Publishing date:

Info

Title:
Android application fine-grained access control based on self-defined security policy
Author(s):
Yu YanJin FengWu Jiashun
School of Computer Science and Engineering,Nanjing University of Science and Technology,Nanjing 210094,China
Keywords:
access control security policy code redirection
PACS:
TP309
DOI:
10.14177/j.cnki.32-1397n.2016.40.02.003
Abstract:
Aiming at the drawbacks of the Android permission model's coarse-grained access control and the over-privileged deficiencies,an Android application fine-grained access control method based on the self-defined security policy is proposed.This method applies the security code redirection technology to control the Android application access to the sensitive system resources based on security policies defined and described by users,and remove the over-granted permissions.The experimental results show that the method has good compatibility to different versions of the Android system,and it can limit application access to the sensitive system resources flexibly and effectively.

References:

[1] Wikipedia Encyclopedia.Google play[EB/OL].http://en.wikipedia.org/wiki/Google_Play,2015-05-08.
[2]张玉清,王凯,杨欢,等.Android安全综述[J].计算机研究与发展,2014,51(7):1385-1396.
Zhang Yuqing,Wang Kai,Yang Huan,et al.Survey of Android OS security[J].Journal of Computer Research and Development,2014,51(7):1385-1396.
[3]帅小应,钱焕延.基于PCF的突发实时访问控制协议[J].南京理工大学学报,2012,36(2):266-271.
Shuai Xiaoying,Qian Huanyan.Burst real-time access control protocol based on PCF[J].Journal of Nanjing University of Science and Technology,2012,36(2):266-271.
[4]Nauman M,Khan S,Zhang X.Apex:extending Android permission model and enforcement with user-defined runtime constraints[C]//Proceedings of the 5th ACM Symposium on Information,Computer and Communica-tions Security(ASIACCS'10)[C].New York,US:ACM Press,2010:328-332.
[5]Blue Ridge Networks.AppGuard[EB/OL].http://www.appguardus.com/,2015-06-10.
[6]Jeon J,Micinski K K,Vaughan J A,et al.Dr Android and Mr Hide:fine-grained permissions in Android applications[C]//Proceedings of the 2nd ACM Workshop on Security and Privacy in Smartphones and Mobile Devices(SPSM'12).New York,US:ACM Press,2012:3-14.
[7]Davis B,Sanders B,Khodaverdian A,Chen H.I-ARM-Droid:a rewriting framework for in-app reference monitors for Android applications[C]//Proceedings of the 2012 IEEE Mobile Security Technologies(MoST'12).Washington D C,US:IEEE Computer Society,2012.
[8]Davis B,Chen H.RetroSkeleton:retrofitting Android apps[C]//Proceedings of the 11th International Conference on Mobile Systems,Applications,and Services(MobiSys'13).New York,US:ACM Press,2013:181-192.
[9]Hao Shuai,Li Ding,Halfond W G,et al.SIF:a selective instrumentation framework for mobile applications[C]//Proceedings of the 11th International Conference on Mobile Systems,Applications,and Services(MobiSys'13).New York,US:ACM Press,2013:167-180.
[10]Android Open Source Project.Bytecode for the dalvik vm[EB/OL].https://source.android.com/devices/tech/dalvik/dalvik-bytecode.html,2014-11-29.
[11]丰生强.Android软件安全与逆向分析[M].北京:人民邮电出版社,2013.

Memo

Memo:
-
Last Update: 2016-04-30