Policy-based Secure Application Framework for Mobile Devices

Chen Zhong

2005-01-01

Abstract:In this paper,a policy-based secure application framework for mobile devices is proposed.This framework uses XML to describe access control policy,integrates authentication,trusted channel and other security mechanisms to control the user’s secure access to the device’s resources and network services through devices.

What problem does this paper attempt to address?

Authentication scheme based on biometric encryption for pervasive computing environments

YAO Lin,FAN Qing-na,KONG Xiang-wei

DOI: https://doi.org/10.3778/j.issn.1002-8331.2010.32.030

2010-01-01

Abstract:Pervasive computing raises new challenges to the security and privacy of the Internet communication,and conventional authentication protocols cannot meet the requirements of this new pervasive environment.A novel mutual authentication and key establishment scheme to secure the interactions between mobile users and service providers is proposed.Highly integrating biometric encryption and the Diffie-Hellman key exchange,the proposed protocol achieves mutual authentication without revealing any privacy information of the user.Secure session key establishment is enabled by the proposed algorithm.Differentiated service access control is also achieved with the biometric encryption.It is shown that the protocol can resist most of the attacks,especially the denial of service attack.
SPA: Inviting Your Friends to Help Set Android Apps.

Zeqing Guo,Weili Han,Liangxing Liu,Wenyuan Xu,Ruiqi Bu,Minyue Ni

DOI: https://doi.org/10.1145/2752952.2752974

2015-01-01

Abstract:More and more powerful personal smart devices take users, especially the elder, into a disaster of policy administration where users are forced to set personal management policies in these devices. Considering a real case of this issue in the Android security, it is hard for users, even some programmers, to generally identify malicious permission requests when they install a third-party application. Motivated by the popularity of mutual assistance among friends (including family members) in the real world, we propose a novel framework for policy administration, referring to Socialized Policy Administration (SPA for short), to help users manage the policies in widely deployed personal devices. SPA leverages a basic idea that a user may invite his or her friends to help set the applications. Especially, when the size of invited friends increases, the setting result can be more resilient to a few malicious or unprofessional friends. We define the security properties of SPA, and propose an enforcement framework where users' friends can help users set applications without the leakage of friends' preferences with the supports of a privacy preserving mechanism. In our prototype, we only leverage partially homomorphic encryption cryptosystems to implement our framework, because the fully homomorphic encryption is not acceptable to be deployed in a practical service at the moment. Based on our prototype and performance evaluation, SPA is promising to support major types of policies in current popular applications with acceptable performance.
Application Policy Security Mechanisms of Android System.

Lin Sun,ShuTao Huang,YunWu Wang,MeiMei Huo

DOI: https://doi.org/10.1109/hpcc.2012.258

2012-01-01

Abstract:This article describes the basic structure of the Android and mobile devices on the application environment. A preliminary analysis of the Android security control structure and sandbox model are presented. We describe the features of Java security model. Mobile code security enhancements in Java are also discussed briefly. The policy-based sandbox code access security is designed to apply special policy on application individually in runtime.
A New Security Architecture for Mobile Communication

Chen Tianzhou,Huang Yu,Chen Feng,Hu Wei

2006-01-01

Abstract:There are many security defects in existing mobile communication systems, such as unidirectional authentication and cipher key transmission in plaintext. With the expansion of the mobile communication services, the mobile security becomes more and more important, but the existing communication systems can not prevent hostile attacks to supply high-quality service because of their defects in security. To solve these problems, we propose a new Security Architecture for Mobile Communication (SAMC), which employs new authentication protocols, chooses different encryption algorithms for different requirements and implements integrity control mechanism. Good security is developed in an open environment with the collaboration of experts. It has the robust security and the outstanding performance, just a slight and acceptable loss.
Towards a multilayered permission-based access control for extending Android security.

Rui Chang,Liehui Jiang,Wenzhi Chen,Hong-qi He,Shuiqiao Yang,Hang Jiang,Wei Liu,Yong Liu

DOI: https://doi.org/10.1002/cpe.4180

2018-01-01

Abstract:This paper discusses security issues on the user equipment, which is the last mile of social networks. One of the main Achilles' heel of social networks is not the organization of networks themselves, but the user devices, typically Android ones. The existing system of privileges makes it easy to infiltrate the network via applications installed on users' devices. Conventional signature-based and static analysis methods are vulnerable. Access to privacy- and security-relevant parts of the application programming interface is controlled by the corresponding permission in a manifest file. While requesting access to permissions, it may offer opportunities to malicious codes, which will cause security issues. Few works among permission analysis, however, pay attention to the prevention of permission leakage on both hardware and software frameworks. In this paper we tackle the challenge of providing our multilayered permission-based security extension scheme on Android platforms. We propose a usage and access control model and an effective method of preventing permission leakage based on ARM TrustZone security extension mechanism. In contrast to previous work, the proposed security architecture provides a permission-based mandatory access control on Android middleware, Linux kernel, and hardware layers. The evaluation results demonstrate the effectiveness of the proposed scheme in mitigating permission leakage vulnerabilities.
DESIGN OF A SECURE FRAMEWORK TO SECURELY EXCHANGE(XML-BASED)DOCUMENTS OVER THE INTERNET

安南,张申生

2002-01-01

Abstract:This paper designed and implemented a secure framework that provides XML signature function, XML element-wise encryption function, smart card based crypto API library and Public Key Infrastructure (PKI) security functions to achieve confidentiality, integrity, message authentication, and/or signer authentication services for XML documents and existing non-XML documents that are exchanged by Internet for e-commerce application.
A Management Framework for Secure Home Network Applications

Qin Xia,Lu Liu

DOI: https://doi.org/10.1109/cyber.2011.6011794

2011-01-01

Abstract:Home network is a residential local area network where digital home appliances are connected with each other. In a home network, access control is an essential factor to provide a proper service to an authorized user. In this environment, there is a home server, which manages user's accesses to external sources. It prevents unauthorized users from accessing home appliances on the network. In this paper, we propose a role-based access control (RBAC) framework using mobile agents in home network environments. This framework controls the users' authorities based on RBAC so that it manages the access control list in each device independently. Also, it guarantees secure role assignment using the role tickets introduced in the proposed framework.
A Implement of Access Control Based Multi-Polices Using XML

Tao Peng,Minghua Jiang,Ming Hu

DOI: https://doi.org/10.4028/www.scientific.net/amr.121-122.558

2010-01-01

Advanced Materials Research

Abstract:A multi-polices access control model is proposed, with the model, access control based on policy regulation and XML based policy description is given. At the same time, We use the XSD(XML Schema Definition) to describe the content and the structure of the xml documents, and check the validity of the xml documents. Based on the description of the access control, an application system is realized we construct the runtime platform and choose some access control polices to test our system. The result is well.
Mobile security service system based on security level negotiation

QIAN Wei-zhong,QIN Zhi-guang,GUO Chen-xuan,CHEN Jian-yong

2007-01-01

Journal of Computer Applications

Abstract:The different security requirements of applications on mobile communication environment were introduced,and the security policy and its structure were designed.On the basis of the policy,a model of mobile security service system was proposed,and the security level negotiation between network elements in different security levels was presented.The research production can provide a solution for allocating security services based on user requirements and be a technology guarantee for mobile communication operator to implement value-added security service.
A security framework model for mobile computing

Kun Gao,Lifeng Xi,Jifang Li

2006-01-01

Abstract:In this paper, we present a framework model for E-commerce. We divide the framework model into three layers, discuss the problem related to security respectively, and defined the key research issues in each layer. we present some basic security problem at first, then discuss security issues in mobile networks, propose a brief classification of applications finally. This model can led to the further investigation of E-commerce security.
Secure remote mobile payment architecture and application

Xi Li,Wei Zhu,Mingxing He

DOI: https://doi.org/10.1109/3CA.2010.5533752

2010-01-01

Abstract:Emerging electronic commerce becomes popular together with the considerable increase of mobile device. Since mobile payments will become one of the most important mobile services. However, most people do not have a fancy for remote mobile payment, or only is limited to micro-payment. The most important problem they worry about is the security of the mobile devices and the applications along with the complexity of payment process. The paper presents a secure remote payment architecture based on smart card in mobile devices that simplifies the payment process and takes a finance measure to permit a more fairly allocation of risks between merchants and consumers. Furthermore, security policies between the security properties of the payment application and the resource limitations are defined. It not only provides strong security but also makes the system open to common payment. Finally, ID-based signature mechanism has advantages over the others based on CA in terms of key distribution and scalability of increasing security level for remote mobile payment service.
A Security Protocol for Mobile E-service Oriented Architecture (MSOA): Design and Implementation

Mingjun Xin,Zhangwei Huang,Quan Qian

DOI: https://doi.org/10.1109/NSWCTC.2009.252

2009-01-01

Abstract:In this paper, it first analyzes the present security protocol for mobile communications. Furthermore, a security framework for the Mobile E-Service is proposed. In the mean time, using the inherent security and expansibility of J2ME, we design a security message flow model to support communication protocol for the Mobile E-Service Oriented Architecture (MSOA), which emphasizes the authentication and the security of information transmission to the cooperative mobile users. Finally, under the background application of county-level mobile E-Service platform, we validate the security and feasibility of the communication protocol, thus providing firm and satisfactory technical support for the county-level mobile E-Government system.
Research and Implementation Key Technology of Security Mobile Office

Feng Qiu,Xiaoqian Li

DOI: https://doi.org/10.1007/978-3-319-49145-5_11

2016-01-01

Abstract:To address the information leakage problems existed in the smartphone mobility office of enterprises and institutions, we propose security mobile office architecture and design application security authentication mechanism, software and hardware resource control mechanism, security storage isolation mechanism, which provide safe protection for sensitive data. To evaluate the propose schemes, we implement them in the android system and cloud service platform. The evaluation results verify the feasibility and effectiveness of the security mobile office technology.
ON ACCESS CONTROL ENHANCEMENT MECHANISM FOR SENSITIVE DATA AND CAPACITIES IN ANDROID

Wei Wang,Tao Zhou,Weili Han

DOI: https://doi.org/10.3969/j.issn.1000-386x.2016.08.067

2016-01-01

Abstract:Sensitive data and perception capacities in Android devices face severe security threats.Current security mechanism cannot efficiently protect the sensitive data of users and perception capacity of devices,because it only provides a coarse-grained access control on application level.Therefore,this paper proposes an access control enhancement mechanism for sensitive data and capacities in Android, which is based on cryptography and fine-grained security policy drive.First,with the help of key management and fine-grained encryption policy,it leverages a high-strength symmetric encryption algorithm to encrypt the sensitive data and this solves the secure storage problem of sensitive data;Then,the mechanism leverages a fine-grained security policy-based access control mechanism to control the access privilege of perception capacities on layer of Android platform to reach the goal of perception data protection.Through prototype system and performance testing,the proposed access control enhancement mechanism for sensitive data and capacity of Android is able to operate on current Android platform with acceptable performance.
A Hybrid Security Framework of Mobile Code

Long Qin,Si Duanfeng,Han Xinhui,Zou Wei

DOI: https://doi.org/10.1109/cmpsac.2004.1342868

2004-01-01

Abstract:Mobile code can potentially be malicious. To protect the local system against malicious mobile code, a hybrid security framework of mobile code is proposed, which combines different static and dynamic techniques to provide a general solution to mobile code security. For a given mobile code and a set of security policies that the code needs to enforce, a static analysis tool is used to verify the mobile code against the policy. If the static analysis shows that the mobile code will never violate the policy, nothing needs to do; otherwise it never rejects the code simply but adds dynamic checks to enforce the policy when necessary. Several static analysis optimizing algorithms is also proposed to improve performance of dynamic enforcement.
An Approach to Secure Mobile Enterprise Architectures

Florian G. Furtmueller

DOI: https://doi.org/10.48550/arXiv.1304.0076

2013-03-30

Networking and Internet Architecture

Abstract:Due to increased security awareness of enterprises for mobile applications operating with sensitive or personal data as well as extended regulations form legislative (the principle of proportionality) various approaches, how to implement (extended) two-factor authentication, multi-factor authentication or virtual private network within enterprise mobile environments to ensure delivery of secure applications, have been developed. Within mobile applications it will not be sufficient to rely on security measures of the individual components or interested parties, an overall concept of a security solution has to be established which requires the interaction of several technologies, standards and system components. These include the physical fuses on the device itself as well as on the network layer (such as integrated security components), security measures (such as employee agreements, contract clauses), insurance coverage, but also software technical protection at the application level (e.g. password protection, encryption, secure container). The purpose of this paper is to summarize the challenges and practical successes, providing best practices to fulfill appropriate risk coverage of mobile applications. I present a use case, in order to proof the concept in actual work settings, and to demonstrate the adaptability of the approach.
Towards Efficient and Secure Access Control System for Mobile Cloud Computing

Tu Shanshan,Huang Yongfeng

DOI: https://doi.org/10.1109/cc.2015.7385527

2015-01-01

China Communications

Abstract:This paper proposes a new access architecture onmobile cloud, which introduces a middle layer sitting between mobile devices and their cloud infrastructure. This middle layer is composed of cloudlets which are deployed by cloud services providers, such as wireless network access points (APs), to improve the performance of mobile cloud servicesand be different from traditional mobile operator mode. Then based on this new architecture,we improve our previous (Attribute-basedencryption) ABE access control scheme on cloud for mobile cloud, which is proposed to offload the main amount of computations to the cloudlet as the function of cloud. Simulationresults demonstratethe new access control scheme takes into consideration response time constraints and network statusof access task execution, while satisfying certain network security for mobile cloud.
A Robust Middleware Architecture for Mobile Communication Security

Chen Tianzhou,Mao Haixia,Dai Hongjun

2006-01-01

Abstract:This paper briefly analyzes the security mechanisms of GSM/UMTS and finds their security defects, such as unidirectional authentication and cipher key transmission without encryption. For these defects, existing mobile communication systems can not prevent hostile attacks to satisfy high-level security demands. To solve these problems, we propose the robust Middleware Architecture for Mobile Communication Security (MAMCS), which employs new Authentication and Key Agreement (AKA) protocols, chooses different encryption algorithms for different applications and implements integrity control mechanism. In the end, we analyze the performance of MAMCS and show that MAMCS gets a 200%~2% improvement in security only at the cost of 1.51% descent in bandwidth and 18.14 ms extra latency.
Making Distributed Mobile Applications SAFE: Enforcing User Privacy Policies on Untrusted Applications with Secure Application Flow Enforcement

Adriana Szekeres,Irene Zhang,Katelin Bailey,Isaac Ackerman,Haichen Shen,Franziska Roesner,Dan R. K. Ports,Arvind Krishnamurthy,Henry M. Levy

DOI: https://doi.org/10.48550/arXiv.2008.06536

2020-08-14

Cryptography and Security

Abstract:Today's mobile devices sense, collect, and store huge amounts of personal information, which users share with family and friends through a wide range of applications. Once users give applications access to their data, they must implicitly trust that the apps correctly maintain data privacy. As we know from both experience and all-too-frequent press articles, that trust is often misplaced. While users do not trust applications, they do trust their mobile devices and operating systems. Unfortunately, sharing applications are not limited to mobile clients but must also run on cloud services to share data between users. In this paper, we leverage the trust that users have in their mobile OSes to vet cloud services. To do so, we define a new Secure Application Flow Enforcement (SAFE) framework, which requires cloud services to attest to a system stack that will enforce policies provided by the mobile OS for user data. We implement a mobile OS that enforces SAFE policies on unmodified mobile apps and two systems for enforcing policies on untrusted cloud services. Using these prototypes, we demonstrate that it is possible to enforce existing user privacy policies on unmodified applications.
Secure Session on Mobile: an Exploration on Combining Biometric, Trustzone, and User Behavior

Tao Feng,Nicholas DeSalvo,Lei Xu,Xi Zhao,Xi Wang,Weidong Shi

DOI: https://doi.org/10.4108/icst.mobicase.2014.257767

2014-01-01

Abstract:With the rise of Internet connected mobile devices, applications have migrated from PCs to mobile computing platforms. An important aspect, payment processing, faces new security challenges from these developments. Inasmuch, these advancements demand efforts from researchers and industry to meet increasing security needs. Threats can ensue from data loss, theft from lost, stolen, or decommissioned devices, information-stealing malware, and password peeping. We propose a secure framework for sensitive session driven applications which combines biometric-based continuous and implicit tracking of user identities, and TrustZone. This framework is accomplished through monitoring fingerprint authentication logs as well as detecting events when the phone has left the user's hands, all while in TrustZone, a platform for secure computation and storage on mobile devices. This solution leverages multiple onboard sensors as well as the ARM architecture to accomplish these feats. We conducted two user-studies acquiring smartphone users' usage statistics to investigate security and usability needs of our identity-tracking solution. To monitor these subtle gestures in real-world uncontrolled environments, multi-session data collection has been conducted to iteratively improve system performance. The evaluation results have demonstrated the feasibility of this framework as a secure session-based payment system.

Policy-based Secure Application Framework for Mobile Devices

Authentication scheme based on biometric encryption for pervasive computing environments

SPA: Inviting Your Friends to Help Set Android Apps.

Application Policy Security Mechanisms of Android System.

A New Security Architecture for Mobile Communication

Towards a multilayered permission-based access control for extending Android security.

DESIGN OF A SECURE FRAMEWORK TO SECURELY EXCHANGE(XML-BASED)DOCUMENTS OVER THE INTERNET

A Management Framework for Secure Home Network Applications

A Implement of Access Control Based Multi-Polices Using XML

Mobile security service system based on security level negotiation

A security framework model for mobile computing

Secure remote mobile payment architecture and application

A Security Protocol for Mobile E-service Oriented Architecture (MSOA): Design and Implementation

Research and Implementation Key Technology of Security Mobile Office

ON ACCESS CONTROL ENHANCEMENT MECHANISM FOR SENSITIVE DATA AND CAPACITIES IN ANDROID

A Hybrid Security Framework of Mobile Code

An Approach to Secure Mobile Enterprise Architectures

Towards Efficient and Secure Access Control System for Mobile Cloud Computing

A Robust Middleware Architecture for Mobile Communication Security

Making Distributed Mobile Applications SAFE: Enforcing User Privacy Policies on Untrusted Applications with Secure Application Flow Enforcement

Secure Session on Mobile: an Exploration on Combining Biometric, Trustzone, and User Behavior