Abstract:Virtualization is frequently used to isolate untrusted processes and control their access to sensitive resources. However, isolation usually carries a price in terms of less resource sharing and reduced inter-process communication. In an open architecture such as Android, this price and its impact on performance, usability, and transparency must be carefully considered. Although previous efforts in developing general-purpose isolation solutions have shown that some of these negative side effects can be mitigated, doing so involves overcoming significant design challenges by incorporating numerous additional platform complexities not directly related to improved security. Thus, the general purpose solutions become inefficient and burdensome if the end-user has only specific security goals. In this paper, we present PINPOINT, a resource isolation strategy that forgoes general-purpose solutions in favor of a "building block" approach that addresses specific end-user security goals. PINPOINT embodies the concept of Linux Namespace lightweight isolation, but does so in the Android Framework by guiding the security designer towards isolation points that are contextually close to the resource(s) that need to be isolated. This strategy allows the rest of the Framework to function fully as intended, transparently. We demonstrate our strategy with a case study on Android System Services, and show four applications of PINPOINTed system services functioning with unmodified market apps. Our evaluation results show that practical security and privacy advantages can be gained using our approach, without inducing the problematic side-effects that other general-purpose designs must address.

Research on Information Protection Model Based on Process Isolation

Research on Information Security Model and Security System Design

Different Level Security of Information Hiding

Process Stability Modeling and Attack Protection of Industrial Control System Based on Reverse Cloud Algorithm Model

Isolayer: The Case for an IoT Protocol Isolation Layer

Security Policy for Information Erasing and Leaking in Multithreaded Codes

Survivability Analysis For Information Systems

Research on Isolation Semantics Description Based on Noninterference Theory and Automated Isolation Strategy Verification Scheme

Fine-grained Protection Domain Model in a Process and Its Implementation

A Multi-Protection Domains Process Model and Its Implementation

A Privacy Protection Model for Transparent Computing System.

Research on Sensitive Data Protection of Windows Application Program

One-Way Isolation Execution Model Based on Hardware Virtualization

Two Optimization Mechanisms to Improve the Isolation Property of Server Consolidation in Virtualized Multi-core Server.

KERNEL MODULES ISOLATION MECHANISM BASED ON SEGMENTATION PROTECTION

Confining Windows Inter-Process Communications for OS-Level Virtual Machine

Research on Information Security Protection System of Industrial Control System

The Application of Virtual Machines on System Security

Dancing with Wolves: an Intra-Process Isolation Technique with Privileged Hardware.

Content-based isolation: rethinking isolation policy design on client systems.

PINPOINT: Efficient and Effective Resource Isolation for Mobile Security and Privacy