Permission based Android security: Issues and countermeasures
Permission based Android security: Issues and countermeasures
复制标题
DOI：
10.1016/j.cose.2014.02.007
复制
发表时间：
2014-06
期刊：
影响因子：
--
通讯作者：
Zheran Fang;Weili Han;Yingjiu Li
中科院分区：
文献类型：
--
作者：
Zheran Fang;Weili Han;Yingjiu Li
Android安全问题是近年来学术界研究和公众关注的热点问题，Android平台上的安全攻击和隐私泄露事件层出不穷。Android安全性建立在基于权限的机制之上，该机制限制第三方Android应用程序访问Android设备上的关键资源。这种基于权限的机制因其对应用程序权限的粗粒度控制以及开发人员、营销人员和最终用户对权限的困难管理而受到广泛批评。在本文中，我们研究了Android安全中出现的问题，包括权限粒度粗糙，权限管理不称职，权限文档不足，权限过度声明，权限升级攻击和TOCTUNK（检查时间到使用时间）攻击。我们说明了这些问题之间的关系，并探讨了现有的对策，以解决这些问题。特别是，我们提供了一个系统的回顾这些对策的发展，并根据他们的技术特点进行比较。最后，我们提出了几种方法来进一步降低Android安全风险。
Android security has been a hot spot recently in both academic research and public concerns due to numerous instances of security attacks and privacy leakage on Android platform. Android security has been built upon a permission based mechanism which restricts accesses of third-party Android applications to critical resources on an Android device. Such permission based mechanism is widely criticized for its coarse-grained control of application permissions and difficult management of permissions by developers, marketers, and end-users. In this paper, we investigate the arising issues in Android security, including coarse granularity of permissions, incompetent permission administration, insufficient permission documentation, over-claim of permissions, permission escalation attack, and TOCTOU (Time of Check to Time of Use) attack. We illustrate the relationships among these issues, and investigate the existing countermeasures to address these issues. In particular, we provide a systematic review on the development of these countermeasures, and compare them according to their technical features. Finally, we propose several methods to further mitigate the risk in Android security.