Modeling and Enhancing Android’s Permission System

  • Elli Fragkaki
  • Lujo Bauer
  • Limin Jia
  • David Swasey
Conference paper

DOI: 10.1007/978-3-642-33167-1_1

Part of the Lecture Notes in Computer Science book series (LNCS, volume 7459)
Cite this paper as:
Fragkaki E., Bauer L., Jia L., Swasey D. (2012) Modeling and Enhancing Android’s Permission System. In: Foresti S., Yung M., Martinelli F. (eds) Computer Security – ESORICS 2012. ESORICS 2012. Lecture Notes in Computer Science, vol 7459. Springer, Berlin, Heidelberg

Abstract

Several works have recently shown that Android’s security architecture cannot prevent many undesired behaviors that compromise the integrity of applications and the privacy of their data. This paper makes two main contributions to the body of research on Android security: first, it develops a formal framework for analyzing Android-style security mechanisms; and, second, it describes the design and implementation of Sorbet, an enforcement system that enables developers to use permissions to specify secrecy and integrity policies. Our formal framework is composed of an abstract model with several specific instantiations. The model enables us to formally define some desired security properties, which we can prove hold on Sorbet but not on Android. We implement Sorbet on top of Android 2.3.7, test it on a Nexus S phone, and demonstrate its usefulness through a case study.

Preview

Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.

Copyright information

© Springer-Verlag Berlin Heidelberg 2012

Authors and Affiliations

  • Elli Fragkaki
    • 1
  • Lujo Bauer
    • 1
  • Limin Jia
    • 1
  • David Swasey
    • 1
  1. 1.Carnegie Mellon UniversityPittsburghUSA

Personalised recommendations