TWC: TTP Option: Medium: Collaborative: Identifying and Mitigating Trust Violations in the Smartphone Ecosystem

TWC：TTP 选项：中：协作：识别和减轻智能手机生态系统中的信任违规行为

• 批准号: 1408790
• 负责人: Yan Chen
• 金额: $ 53.39万
• 依托单位: Northwestern University
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2014
• 资助国家: 美国
• 起止时间: 2014-10-01 至 2018-09-30
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1408790&HistoricalAwards=false
• 关键词: TWC; TTP; Option; Medium; Collaborative

The adoption of smartphones has steadily increased in the past few years, and smartphones have become the tool with which millions of users handle confidential information, such as financial and health-related data. As a result, these devices have become attractive targets for cybercriminals, who attempt to violate the trust assumptions underlying the smartphone platform in order to compromise the security and privacy of users.This research effort provides a novel framework to model the trust relationships between users, the smartphone platform, and the surrounding ecosystem, including smartphone apps and app markets. This model allows for the systematic exploration of trust-violation weaknesses (i.e., situations in which trust is misplaced and trustassumptions can be violated). In a complementary fashion, the model also supports the design of security mechanisms that address the identified weaknesses (i.e., techniques to prevent, or detect and mitigate trust violations).The results of this research have the potential of impacting the lives of millions of smartphone users, providing protection against attacks that might harm their well-being. Though this project focuses on the Android platform, its results are general and applicable to other smartphone platforms. The analysis techniques that have been developed as part of this research are made available to the public through a web portal that allows users to submit smartphone applications and obtain reports on possible trust weaknesses based on the static and dynamic analysis of the application and its interaction with other applications, the network, and other components in the Android platform.

智能手机的使用在过去几年中稳步增长，智能手机已成为数百万用户处理机密信息（如财务和健康相关数据）的工具。因此，这些设备已成为网络罪犯的诱人目标，他们试图违反智能手机平台的信任假设，以损害用户的安全和隐私。这项研究为用户、智能手机平台和周围生态系统（包括智能手机应用程序和应用程序市场）之间的信任关系建模提供了一个新的框架。该模型允许系统地探索违反信任的弱点（即，信任错位和信任假设可能被违反的情况）。以一种补充的方式，该模型还支持安全机制的设计，以解决已识别的弱点（即，防止或检测和减轻信任违反的技术）。这项研究的结果有可能影响数百万智能手机用户的生活，为他们提供防范可能损害他们健康的攻击的保护。虽然本项目主要针对Android平台，但其结果具有通用性，适用于其他智能手机平台。作为本研究的一部分而开发的分析技术通过一个门户网站向公众开放，该门户网站允许用户提交智能手机应用程序，并根据应用程序及其与其他应用程序、网络和Android平台中其他组件的交互的静态和动态分析，获得关于可能存在的信任弱点的报告。