期刊
COMPUTERS & SECURITY
卷 43, 期 -, 页码 205-218出版社
ELSEVIER ADVANCED TECHNOLOGY
DOI: 10.1016/j.cose.2014.02.007
关键词
Android security; Permission based security; Access control; Granularity of access control; Policy administration; Over-claim of permission; Permission escalation attack
资金
- projects of National Key Science and Technology Program [2012ZX01039-004-20]
- Natural Science Foundation of Shanghai [12ZR1402600]
- 12th Five-Year National Development Foundation for Cryptography [MMJJ201301008]
- Innovation Foundation of STCSM [12511504200]
- CNNIC DNSLab and Key Lab of Information Network Security, Ministry of Public Security [C13612]
Android security has been a hot spot recently in both academic research and public concerns due to numerous instances of security attacks and privacy leakage on Android platform. Android security has been built upon a permission based mechanism which restricts accesses of third-party Android applications to critical resources on an Android device. Such permission based mechanism is widely criticized for its coarse-grained control of application permissions and difficult management of permissions by developers, marketers, and end-users. In this paper, we investigate the arising issues in Android security, including coarse granularity of permissions, incompetent permission administration, insufficient permission documentation, over-claim of permissions, permission escalation attack, and TOCTOU (Time of Check to Time of Use) attack. We illustrate the relationships among these issues, and investigate the existing countermeasures to address these issues. In particular, we provide a systematic review on the development of these countermeasures, and compare them according to their technical features. Finally, we propose several methods to further mitigate the risk in Android security. (C) 2014 Elsevier Ltd. All rights reserved.
作者
我是这篇论文的作者
点击您的名字以认领此论文并将其添加到您的个人资料中。
推荐
暂无数据