TinMan: eliminating confidential mobile data exposure with security oriented offloading
TinMan: eliminating confidential mobile data exposure with security oriented offloading
复制标题
TinMan：通过面向安全的卸载消除机密移动数据暴露
DOI：
--
复制
发表时间：
2015
期刊：
影响因子：
--
通讯作者：
Haibo Chen
中科院分区：
文献类型：
--
作者：
Yubin Xia;Yutao Liu;Cheng Tan;Mingyang Ma;Haibing Guan;B. Zang;Haibo Chen
智能设备的广泛采用刺激了安全关键数据从桌面到移动设备的快速转移。然而，经常发生的设备盗窃和丢失使移动设备面临各种安全威胁甚至物理攻击。本文介绍了TinMan系统，该系统可以保护网站密码和信用卡号码（我们用cor来表示这些数据，这是confidential Record的缩写）等机密数据，即使在设备被盗的情况下也不会被泄露或滥用。TinMan将cor的访问与应用程序的其他功能分开，通过引入一个可信节点来存储cor，并将任何代码从移动设备卸载到可信节点来访问cor，这完全消除了cor在移动设备上的暴露。TinMan面临的主要挑战包括决定何时以及如何高效且透明地卸载执行；TinMan解决了这些挑战，采用了面向安全的卸载，采用了一种低开销的称为非对称污染的方案来跟踪对cor的访问以触发卸载，以及透明的SSL会话注入和TCP付费负载替换来卸载对cor的访问。我们已经实现了一个基于Android的TinMan原型，并演示了TinMan如何在不修改应用程序的情况下保护用户的银行账户和信用卡号码信息。评估结果还表明，TinMan只会产生少量的性能和功耗开销。
The wide adoption of smart devices has stimulated a fast shift of security-critical data from desktop to mobile devices. However, recurrent device theft and loss expose mobile devices to various security threats and even physical attacks. This paper presents TinMan, a system that protects confidential data such as web site password and credit card number (we use the term cor to represent these data, which is short for Confidential Record) from being leaked or abused even under device theft. TinMan separates accesses of cor from the rest of the functionalities of an app, by introducing a trusted node to store cor and offloading any code from a mobile device to the trusted node to access cor. This completely eliminates the exposure of cor on the mobile devices. The key challenges to TinMan include deciding when and how to efficiently and transparently offload execution; TinMan addresses these challenges with security-oriented offloading with a low-overhead tainting scheme called asymmetric tainting to track accesses to cor to trigger offloading, as well as transparent SSL session injection and TCP pay-load replacement to offload accesses to cor. We have implemented a prototype of TinMan based on Android and demonstrated how TinMan protects the information of user's bank account and credit card number without modifying the apps. Evaluation results also show that TinMan incurs only a small amount of performance and power overhead.