TWC: Small: Develop Fine-Grained Access Control for Third-Party Components in Mobile Systems

智能手机和平板电脑正在被广泛使用，在这种普遍使用的情况下，保护移动系统至关重要。移动系统的一个独特功能是，许多应用程序结合了第三方组件，如广告、社交网络API和WebView组件(运行第三方Java代码)。使用第三方组件，应用程序开发人员开发的代码和来自第三方的代码在相同的上下文中以相同的权限执行。没有开发访问控制系统来将第一方应用程序代码的特权与第三方组件的特权分开。这导致了过度特权的问题。该项目的目标是开发适当的访问控制系统，以弥补第三方组件带来的风险。这一开发基于对各种第三方组件、它们如何与应用程序交互、哪些功能是可取的以及它们的保护需求的系统研究。该项目通过三管齐下的方法实现了这一目标：(1)向WebView添加新的访问控制，以控制与第三方代码的交互；(2)在应用程序中添加包级访问控制，以防止过度权限；以及(3)使用可视元素隔离第三方组件。这个项目可以让移动系统开发人员更深入地了解系统中的安全问题，向他们建议如何更好地设计出移动系统所需要的安全属性，并最终提高移动系统的安全性。

Smartphones and tablets are being used widely, and with such a pervasive use, protecting mobile systems is of critical importance. One of the unique features in mobile systems is that many applications incorporate third-party components, such as advertisement, social-network APIs, and the WebView component (that runs third-party JavaScript code). With third-party components, the code developed by application developers and the code from third parties are executed within the same context and with the same privilege. No access control system is developed to separate the privilege of the first-party application code from that of third-party components. This has resulted in over-privilege issues. The objective of this project is to develop adequate access control systems to remedy the risks introduced by third-party components. The development is based on a systematic study of various third-party components, how they interact with applications, what features are desirable, and what their protection needs are. The project meets this objective using a three-pronged approach: (1) add new access controls to WebView to control the interactions with third-party code; (2) add package-level access controls within apps to prevent over-privilege; and (3) isolate third-party components with visual elements. This project can offer mobile system developers a deeper understanding of the security problems in the systems, suggest to them how better to design into mobile systems desired security properties, and eventually improve the security of mobile systems.