TWC: Small: Develop Fine-Grained Access Control for Third-Party Components in Mobile Systems

智能手机和平板电脑正在被广泛使用，由于使用如此普遍，保护移动系统至关重要。移动系统的一个独特特性是，许多应用程序都包含第三方组件，例如广告、社交网络api和WebView组件（运行第三方JavaScript代码）。对于第三方组件，应用程序开发人员开发的代码和来自第三方的代码在相同的上下文中以相同的权限执行。没有开发访问控制系统来将第一方应用程序代码的权限与第三方组件的权限分开。这导致了过度特权问题。该项目的目标是开发适当的访问控制系统，以补救第三方组成部分带来的风险。该开发基于对各种第三方组件的系统研究，包括它们如何与应用程序交互、需要哪些特性以及它们的保护需求。该项目采用了三管齐下的方法来实现这一目标：(1)向WebView添加新的访问控制，以控制与第三方代码的交互；(2)在应用程序中添加包级访问控制，防止权限过大；(3)用可视化元素隔离第三方组件。这个项目可以让移动系统开发者更深入地了解系统中的安全问题，并建议他们如何更好地设计到移动系统所需的安全属性，最终提高移动系统的安全性。

Smartphones and tablets are being used widely, and with such a pervasive use, protecting mobile systems is of critical importance. One of the unique features in mobile systems is that many applications incorporate third-party components, such as advertisement, social-network APIs, and the WebView component (that runs third-party JavaScript code). With third-party components, the code developed by application developers and the code from third parties are executed within the same context and with the same privilege. No access control system is developed to separate the privilege of the first-party application code from that of third-party components. This has resulted in over-privilege issues. The objective of this project is to develop adequate access control systems to remedy the risks introduced by third-party components. The development is based on a systematic study of various third-party components, how they interact with applications, what features are desirable, and what their protection needs are. The project meets this objective using a three-pronged approach: (1) add new access controls to WebView to control the interactions with third-party code; (2) add package-level access controls within apps to prevent over-privilege; and (3) isolate third-party components with visual elements. This project can offer mobile system developers a deeper understanding of the security problems in the systems, suggest to them how better to design into mobile systems desired security properties, and eventually improve the security of mobile systems.