Collaborative Research: EAGER: Towards Safeguarding the Emerging Miniapp Paradigm in Mobile Super Apps

移动计算中快速发展的迷你应用范例正在彻底改变用户与移动应用的互动。超级应用作为拥有多项服务的主机，促进了小应用在其平台内的安装和运营，从而培育了一个类似Google Play和Apple App Store的生态系统。微信、TikTok和Snapchat等领先的社交应用已经采用了这种方法，极大地提高了用户的便利性和互动性。然而，在这些进步的同时，迷你应用范例也带来了截然不同的安全和隐私挑战，需要紧急解决。随着迷你应用的流行程度不断升级，建立适当的保障措施难以跟上步伐。现有的跨现代移动操作系统(OS)管理系统资源的安全策略经常表现出不透明和分散，阻碍了对小应用程序的有效隔离，并掩盖了各种移动操作系统固有的复杂性。此外，超级应用程序能够从众多小应用程序中收集大量用户数据，因此经常避免将自己识别为数据控制器。这种数据做法缺乏透明度会产生潜在的隐私威胁和监管问题。该提案旨在向系统理解和保护移动超级应用中新兴小应用范式的安全和隐私迈出第一步。我们认识到与这一模式相关的紧迫关切，并致力于调查新的安全和隐私威胁，例如跨平台支持、微型应用程序API的设计和实施以及与访问控制和安全和隐私政策有关的敏感数据管理。我们的研究还将探索在微型应用生态系统内进行风险评估和漏洞检测的创新技术。此外，我们建议采用正式方法对这些政策进行严格推理，并标准化API的设计和实施，以实现更安全和更符合隐私的迷你应用生态系统。我们的研究有望为开发实用的解决方案铺平道路，这些解决方案可以迅速被超级应用程序和迷你应用程序开发者采用，以应对该领域的紧迫安全和隐私挑战。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

The rapidly evolving miniapp paradigm within mobile computing is revolutionizing user engagement with mobile applications. Super apps, functioning as hosts with multiple services, facilitate the installation and operation of miniapps within their platforms, thereby cultivating an ecosystem akin to that of Google Play and Apple App Store. This approach, already adopted by leading social apps like WeChat, TikTok, and SnapChat, greatly enhances user convenience and interactivity. However, alongside these advancements, the miniapp paradigm ushers in distinct security and privacy challenges demanding urgent resolution. As the prevalence of miniapps continues to escalate, the establishment of proper safeguards struggles to keep pace. Existing security policies for managing system resources across modern mobile operating systems (OSs) often exhibit opacity and dispersion, impeding effective isolation of miniapps and concealing complexities inherent to diverse mobile OSs. Additionally, super apps, with their capacity to amass substantial user data from numerous miniapps, frequently avoid recognizing themselves as data controllers. This lack of transparency in data practices generates potential privacy threats and regulatory issues. This proposal aims to take the first step towards systematic understanding and safeguarding of the security and privacy of the emerging miniapp paradigm in mobile super apps. We recognize the pressing concerns related to this paradigm and aim to investigate new security and privacy threats, such as cross-platform support, the design and implementation of miniapp APIs, and the management of sensitive data with respect to access control and security and privacy policies. Our research will also explore innovative techniques for risk assessment and vulnerability detection within the miniapp ecosystem. Moreover, we propose to employ formal methods to rigorously reason about these policies and standardize the design and implementation of the APIs, enabling a more secure and privacy-compliant miniapp ecosystem. Our research is expected to pave the way for the development of practical solutions that can be rapidly adopted by super apps and miniapp developers to tackle the urgent security and privacy challenges in this field.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.