TC: Small: Security Architectures for Smartphones

苹果、谷歌和其他公司的现代智能手机具有非常复杂的安全需求。从各种第三方供应商安装的应用程序必须彼此分开，因为有些应用程序可能有漏洞或恶意，但它们还必须以各种方式进行通信和共享，包括显示多媒体、共享身份验证凭据，以及充当远程互联网站点的本地代理以支持支付服务、广告等。我们利用谷歌的开源Android项目设计、实施和评估新型智能手机机制。例如，当应用程序协作时，我们仔细控制如何在电话中管理权限。我们必须击败“困惑副手”攻击，在这种攻击中，特权但有漏洞的应用程序无意中允许调用者行使敏感权限，但我们的基础设施也必须使“有意副手”能够在提供安全接口的同时利用危险的特权。我们的工作还考虑了用户对安全功能的看法。许多应用程序需要用户频繁地重新键入密码，这不仅惹恼了用户，还使他们容易受到欺骗攻击，因为攻击者可以伪造一个像素完美的对话框。我们正在研究各种提高安全性和可用性的方法，包括让应用程序彼此共享凭据的更好方法(避免对话框)，以及让多个应用程序共享屏幕空间的更好方法(避免授予单例应用程序不必要的权限)。我们所有的研究成果都将在合适的开源许可下提供，帮助我们的工作影响手机供应商，并最终对庞大的智能手机用户群产生影响。

Modern smartphones from Apple, Google, and others have remarkably complex security needs. Applications, installed from a variety of third-party vendors, must be separated from one other, since some might be buggy or malicious, yet they must also communicate and share in a variety of ways, including displaying multimedia, sharing authentication credentials, and acting as local proxies for remote Internet sites to support payment services, advertisements, and so forth.We design, implement, and evaluate novel smartphone mechanisms, leveraging Google's open-source Android project. For example, we carefully control how privileges are managed within the phone as applications collaborate. We must defeat "confused deputy" attacks, where privileged-but-buggy applications inadvertently allow their callers to exercise sensitive privileges, yet our infrastructure must also enable "intentional deputies" who are trusted to leverage dangerous privileges while offering safe interfaces.Our work also considers the user's view of security features. Many applications require users to frequently retype passwords, annoying users and also making them vulnerable to spoofing attacks, because an attacker can fake a pixel-perfect dialog. We are studying a variety of approaches to improve security and usability, including better ways for applications to share credentials with one another (avoiding dialog boxes), and better ways for multiple applications to share screen real-estate (avoiding the need for singleton applications to be granted unnecessary privileges).All of our research output will be available under suitable open-source licenses, helping our work to influence phone vendors and ultimately to have impact on the huge installed base of smartphone users.