CN106650418A - Android access control system and method based onmulti-strategy - Google Patents
Android access control system and method based onmulti-strategy Download PDFInfo
- Publication number
- CN106650418A CN106650418A CN201611192576.8A CN201611192576A CN106650418A CN 106650418 A CN106650418 A CN 106650418A CN 201611192576 A CN201611192576 A CN 201611192576A CN 106650418 A CN106650418 A CN 106650418A
- Authority
- CN
- China
- Prior art keywords
- access
- application
- strategy
- android
- application program
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/51—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Software Systems (AREA)
- Theoretical Computer Science (AREA)
- Computer Hardware Design (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Telephonic Communication Services (AREA)
Abstract
The invention discloses an android access control system based on multi-strategy. The integral system comprises an application installation module, a runtime controller, and a policy installation module set up in the Android middleware layer which interact with one another to complete the access control for Android systems, and achieve access to the Android framework layer API level through a multi policy mechanism. The method comprises the steps of conducting extraction of API features, extracting the mostly used and most frequently used feature as sensitive API, based on application features categorizing applications including trusted applications and untrusted applications, conducting a multi-strategy design, loading corresponding multi-strategy access control algorithm to achieve control over visitors and visited parties. Compared with the prior art, through the multi-strategy, the limitation of the interface access capability of an application is completed, ICC communication is prevented, and the security of Android applications is enhanced from the access control level. Through the configuration of user policies and context policies, users can flexibly control application program behavior.
Description
Technical field
The present invention relates to many-sided neck such as softward interview control, mobile terminal safety and android system framework optimization
Domain is more particularly to a kind of to be based on shifty access control system and method.
Background technology
With flourishing for mobile terminal, the mobile device based on Android operation system is just towards diversification, intelligence
Change, high performance trend development.In recent years, android system relied on good Consumer's Experience and higher opening, by more next
More cell phone manufacturers adopt.Simultaneously developing rapidly for intelligent terminal causes the life of people increasingly convenient.
However, mobile terminal is while convenient popular, also gradually cause concern of the people to mobile phone terminal safety and privacy.Net
The data display of the newest issues of network security firm F-Secure：2013, in all of mobile class Malware, have 97% to be to attack
Android device is hit, the data only have 79% within 2012, future is it is also possible to continue to increase.These Malwares are often
User cheating is installed, and is stolen userspersonal information or is gained user's money by cheating, and the individual privacy and property for causing user is subject to very big
Threat.
Android is that, based on the system of right access control, application program can ask the user whether to authorize before the mounting
The authority applied in AndroidManifest.Attack present in Android platform and be divided into：
1st, illegal act is carried out using authority
In android system, user is once to using program authority mandate, reclaiming authority.Moreover,
User does not know application program when access right yet, and what behavior carried out using authority.These drawbacks cause malice
Software reveals the private data of user, and some consumer-targeted softwares more cause the property of user to incur loss.
2nd, privilege-escalation is attacked
As shown in figure 1, being typical privilege-escalation attack instance in Android.Wherein, App1 includes not thering is any power
The component 1 of limit, App2 includes the component 2 and the component 3 with authority P1 of the component 1 without any authority, system
Resource (System Resources) includes the component 4 with authority P1.When the component 1 of App1 and the component 2 of App2 communicate,
Scope check will not be carried out, because component 1 and component 2 all do not need authority to start.Because component 2 and component 3 are belonged to
APP2, thus component 2 can carry out normal call to component 3.Component 3 possesses authority P1, so component 3 can access ownership
The system component 4 or system resource of limit P1.In this invoked procedure, App1 just indirectly invocation component 4, so as to constitute
Privilege-escalation is attacked.
Traditional Android frameworks are not sufficient to ensure that user carries out effectively access control by authority to application software.
With the generation of these safety problems, increasing researcher attempts from the behavior of monitoring application program to start with, management application
Program, so as to reach the purpose for lifting application software safety.Correlational study work also obtains many beneficial progress, for example,
Kirin is the static rights matching system of a rule-based collection, and it attempts combining the apllied authority set of application program
Make a return journey and judge the safety of the application program, but some rogue programs seem safety, but user are carried out by privilege-escalation
Attack；Saint strategies, by defining many granular policies, are carried out about from application requirement to application object information
Beam, limits communication object to avoid attack that may be present, but Saint strategies are defined by developer, and malice developer can determine
Justice meets the malice strategy of Prerequisite and reaches its attack purpose；AppGuard is by built-in watch-dog in third party application
Interior Placement Strategy implements code, so as to be just capable of achieving control function without the need for be modified to Android source codes, but in mobile phone terminal
Processing APK needs to consume the plenty of time.
For the problems referred to above, propose that novel, effective Android access control methods are that have very much realistic meaning.From visit
Ask that control angle lifts software security, the research to Android access control methods is particularly important.
Android access controls mainly include two kinds：A) APK ends are changed, so as to reach access control purpose；B) change
Android source codes layer is so as to the control that conducts interviews.
To a certain extent, above-mentioned technology is solved the problems, such as in a certain territory of android system.For from modification
The system that APK sets about at end, can realize the access control to many granularities of APK end interfaces, and the authority that but can not solve to exist is carried
Rise risk of attack；And for the system of the access control reached from modification Android source codes, also address only and some resources are entered
Row access control or the privilege-escalation for solving to exist between application program are attacked, and the strategy for being used is single.Summary is described,
Prior art is not sufficient to ensure that requirement of the people to mobile application security.
The content of the invention
For unsolved problem in above-mentioned prior art, the present invention proposes a kind of based on shifty Android
Access control system and method, introduces RSBAC (being based on many set of policy rules) framework, improves Android security mechanisms, expands
Andriod ccf layers, using various strategies, from safety, motility, point of view of practicability, realize that one kind can be resisted various
The method of attack.
One kind of the present invention is based on shifty Android access controls system, and the system integrally includes being arranged on
Controller and policy installation module, the interphase interaction of three when the application program of Android middleware layers installs module, operation
The access control of android system is completed, by many policy mechanisms the access to Android ccf layer api classes is realized.Wherein：
The application program installs module, and for installing and uninstalling application program, the module includes application manager
Component and application information storehouse：The application manager component is when program is installed to the init state of application program
Information is collected, extracts component in application program, authority, Intent filter informations and preserve the work of initial state information
Make；The application information library storage initializes the data base of application state information；
The monitoring module during operation, including access executive module and access decision component：The access executive module exists
The access request of main body is intercepted during operation, and the object type of access request is judged according to access request；The access
Decision-making component carries out decision-making to access, according to visitor information and interviewee's information, the corresponding shifty access control of loading
Algorithm, realizes the control to visitor and interviewee；
The policy installation module, there is provided strategy installation, more New function, the module include many policy installation device assemblies and
Many strategy library components：Many policy installation device assemblies are used for shifty installation；Many policy librarys are the data bases of standard, for storing
The rule of definition；
Inter-component communication comprising application program install module assembly communication, operation when monitoring module assembly communication and
The assembly communication of policy installation module.
One kind of the present invention is based on shifty Android access controls system, and the method is comprised the following steps：
First, static analysis is carried out to selected Android application softwaries, therefrom extracts used API, completed
API feature extractions；Further these API features are analyzed, extraction use most the most frequently used as sensitive API；
Secondly, installing and uninstalling for application program is carried out by application program erector module, is collected when program is installed
Application initialization state, extracts application features, according to application features, application program is classified, and wraps
Include trusted application and insincere application program；
Carry out many strategy designs；
Utilization strategies install module and realize shifty installation and the rule storage for defining；
Then, using monitoring module during operation, judge that request object type carries out decision-making according to access request；According to access
Person's information and interviewee's information, the corresponding shifty access control algorithm of loading, realize the control to visitor and interviewee
System.
Many strategy designs are specially：Sensitive API to being extracted is modeled, that is, set up respectively using according to user
The rule of tactful these sensitive APIs are conducted interviews with contextual policies control；And, set up and use system strategy access control
Rule.
The shifty access control algorithm specifically includes following steps：
First, carry out providing a series of definition of variables, including Application Status, call relation, strategy, strategy punching
It is prominent；
Then, implementation strategy loading algorithm：
When callee is resource or service, access decision component loads the subscriber policy in many policy librarys and up and down
Literary strategy, and determine whether that user or third party software are prohibited to call or access certain api interface.If the ability is banned
Only, for this visit is asked, access decision component returns false, will otherwise give the ability of the application program access interface；
When callee is application program or component, algorithm will check the type of callee.If callee type
For insincere application program, access decision component will load called side and the Application Status of the side that is called, and system plan
Slightly.
Compared with prior art, the present invention is completed to the limit using routine access interface capability by many policy mechanisms
System, and prevent ICC from communicating, improve the safety of Android application programs from access control aspect；By configure subscriber policy and
Contextual policies, user can flexibly control application behavior.
Description of the drawings
Fig. 1 is the privilege-escalation attack process schematic diagram of android system；
Fig. 2 is the present invention based on shifty Android access controls system construction drawing；
Fig. 3 is the present invention based on shifty Android access control methods flow chart；
Fig. 4 is that API extracts display interface figure；
Fig. 5 is Android access control method strategy loading figures.
Specific embodiment
As shown in Fig. 2 being proposed by the present invention based on shifty Android access controls system framework, including apply
Controller and policy installation module when program installs module, operation.The interphase interaction of three completes the visit of android system
Control is asked, by many policy mechanisms the access to Android ccf layer api classes is realized.Wherein：
Application program installs module, be mainly responsible for installing and uninstalling application program, including application manager component with
And application information storehouse：The parsing work of APK bags when mounted, realizes the expansion of application manager component, and it is right to increase
The information of application program is collected and preserves the work of initial state information；Application information storehouse is for storing initial
The data base of application state information.Realize the expansion that standard Android installs module.
Monitoring module during operation, including access executive module and access decision component：Access executive module operationally right
The access request of main body is intercepted, and judges request object according to access request.Access decision component carries out decision-making to access,
According to visitor information and interviewee's information, corresponding strategy is loaded, realize the control to visitor and interviewee.
Policy installation module, is arranged in Android middleware layers, there is provided installation, the more New function of strategy.The module bag
Include many policy installation device assemblies and many strategy library components.Many policy librarys are the data bases of standard, for storing the rule of definition.
Inter-component communication mainly includes three parts：(1) assembly communication of monitoring module, (two) application program when running
The assembly communication of module and the assembly communication of (three) policy installation module are installed.
(1) assembly communication of monitoring module when, running
Access executive module and intercept the access request that application program sends, and object type is determined according to access request.If
Object type is resource or service, and access decision component will load subscriber policy and contextual policies in many policy librarys, and root
This visit is determined whether according to policing rule；If object type is application program or component, access decision component will be obtained
To the Intent that main body sends, and it is inferred to access object according to Intent, then access decision component judges that the Intent is
No if new access, decision-making component is stored in the Intent in application information storehouse for new, while ADM is according to accessing
Subject and object, the subscriber policy in Application Status and many policy librarys in loading application programs information bank, context plan
Slightly, system strategy, and then verify that this time whether communication connection disagrees with the rule defined in system strategy, if running counter to, hinders
Secondary access request here.
(2), application program installs the assembly communication of module
During set up applications, application management module is extracted in application program AndroidManifest.xml files
Component, authority, Intent filter informations, and these information are stored in xml form in application information storehouse.Work as unloading
During application program, application management module will perform following operation：The resource that creates when installing is deleted, and is called and is applied journey
Method deletes the strategy created for the application program in sequence information bank.
(3), the assembly communication of policy installation module
During policy installation, UI is responsible for display strategy Installation Options, and user operation is sent to into many policy installation devices.
Many policy installation devices are responsible for many policy installations to many policy librarys.Many policy librarys are responsible for installing the strategy of three types.
As shown in figure 3, the present invention based on shifty Android access control methods flow process include API feature extractions,
Application features are extracted and many strategy designs, the tactful part of loading algorithm three.API feature extractions are to determine enters to which API
Row access control, by the access control system fine granularity based on authority, and can be modeled to these API；Application program
Feature extraction is that feature is extracted when program is installed, and is defined as Application Status, and it is that access control is realized in the present invention
Necessary variable；Many strategy designs provide many policy mechanisms.
(1), API feature extractions
As shown in figure 4, in android system, authority and API mappings are many-one relationships, and its rights management mechanism is
Coarseness.In order to preferably realize access control management, the present invention utilizes static detecting tool androguard (Android
Guard) static analysis is carried out to 50 Android application softwaries popular on market, therefrom extracts used API.Enter one
Step is analyzed to these API, extracts using 25 at most the most frequently used sensitive APIs.The present invention is by these API and application program
Ability is corresponding, how tactful these abilities by during the operation for limiting application program of design.
(2), application features are extracted
Android carries out installing and uninstalling for application program by application program erector module.It is used in the present invention
It is that the Android application programs expanded install module, wherein increasing collect application initialization state when program is installed
Function.It is Application Status that the present invention defines these information.
First correspond to be classified with program, two categories below can be divided into：
A. trusted application, is system application, the primary application programs for carrying of Android.
B. insincere application program, is that user downloads from Android application markets, is marked as insincere application
Program.
Secondly, present invention change scanPackageLi components.Make it when APK file is parsed, application program is accessed into energy
Power, module information and start the Intent information of these components and stored in application information storehouse with the form of XML.
(3), many strategy designs, tactful loading algorithm
1st, many strategy designs
In the present invention, more strategy includes subscriber policy, contextual policies and system strategy.It is the sensitive API to being extracted
It is modeled, these sensitive APIs is conducted interviews control using subscriber policy and contextual policies, and is visited using system strategy
Ask the rule of control.
(1), subscriber policy
Subscriber policy is the wish according to user, and to sensitive API real time access control is carried out.The present invention determines these API
Justice is application program ability, and subscriber policy is used for constraining application program access API.In the subscriber policy, user is to " read_
The interface authority such as SMS ", " read_Contact ", " Internet " withdraws.When application program accesses these interfaces, loading is used
Family strategy, confirms whether application program possesses the authority for accessing the interface.
The restriction of docking port has refined to a certain extent Andriod authority mechanisms.Invention defines 25 user's rule
Then, following rule is for example defined：
Rule 1：<Permission name=" read_SMS " revokePerm=" true ">Reading short message API is carried out
Access and limit.
Rule 2：<Permission name=" read_Contact " revokePerm=" true ">To reading address list
API conducts interviews restriction.
(2), contextual policies
Contextual policies are proposed by Mauto Conti et al..Context can be defined as the state of some variables, for example
Reason positional information, time, problem, noise, light etc..These variables are considered android system by contextual policies, are permitted
Family allowable or the corresponding strategy of believable third party customization, limit the behavior of application program.Invention defines about 90
Literary rule.
For example：The rule for defining：Bag com.example.testcontactContext times that are on duty are inaccurate and wrap
Com.example.sendmessage is communicated.
(3), system strategy
For system strategy, the present invention is enlightening to applying software modeling based on Xmandroid, and to constraining main body and visitor
Body access consideration.
System strategy is the present invention to prevent illegal ICC communication definitions.Illegal ICC communications generally refer to application program
In communication, by cooperating with other application programs, some abilities for accessing sensitive resource are completed, and these abilities usually should
Do not have with program.XmanDroid defines system strategy, and the present invention extends the strategy, and stores in the format of a xml document
Come, each rule is limited subject and object.Two rules are described as follows：
Rule 1：Third party application does not contain CALL_PHONE authorities or CALL_PHONE authorities are retracted, then its
Can not send containing android.intent.action.DAIL's to system application com.android.phone
intent。
Rule 2：Third party application containing READ_CONTACT authorities can not be with answering containing SEND_SMS authorities
Use interprogram communication.
2nd, the tactful loading algorithm of Android access control methods
(1), variable-definition
In order to more fully understand Android access control methods, and it is modeled, the present invention is retouched with formalization method
State some variable states when program is run.The definition of variable states is given below.
Define 1 (Application Status)：The present invention by Application Status be defined as tlv triple (type, Scap,
Scompo), type is Application Type, and Scap is application program competence set, and Scompo is application component and component
The intent set of transmission.
In invoked procedure, the sandbox belonging to application program is described with Application Status.Application Status are comprising quiet
State state and dynamical state.Some information when static state is application program installation, such as application component, application program
Authority etc.；Dynamical state is the intent information that application program sends in running.
Define 2 (call relations)：Access host-guest is tlv triple (Sc, Sct, Policies).Sc is the shape of called side
State, generally third party application；Sct is called side's state, and generally resource, system application or third party should
Use program；Policys is the strategy to be loaded in invoked procedure.Sc.type represents the Application Type of called side,
Sc.Scap represents application program access ability set.Sct.Scap represents the assembly set of application program.
The present invention loads Different Strategies according to object attribute.When it is resource to access object, accesses executive module loading and use
Family strategy and contextual policies；When object communicates for ICC, executive module loading subscriber policy, contextual policies, system are accessed
Strategy come control access.
Define 3 (strategies)：The present invention includes three kinds of strategies：Subscriber policy, contextual policies and system strategy.Definition
Srule is subscriber policy collection, and S ' rule are contextual policies collection.Each rule in set of strategies is for limiting API.It is fixed
Justice these regular corresponding API are respectively I, I ', they meet：S{Sc,Sct}
I∈Srule,I′∈S′rule
I′∈Srule,I∈S′rule
Define system strategy to meet：S { Sc, Sct }, Sc are called side state, and Sct is called side's state.
In the present invention, subscriber policy and contextual policies are a kind of access control policies to sensitive API interface.And be
System strategy is then according to the design of the Application Status of communicating pair.When the caller and callee in communication meets system
During regulation in strategy, then illustrate that this visit request is ICC communications.For example：System strategy rule 2, in Application Status
In, communicating pair is all the application program of untrust types, and the communication capacity set of called side contains " Send_Sms ",
And the communication capacity set of the side that is called contains " Read_contact ".If the Application Status of caller and callee
All successful match, illustrates illegal during access request.
Define 4 (policy conflicts)：Whether the regular definition application in subscriber policy and contextual policies allows to access
API.For qi∈ Srule, S ' rule meets：
L(s,a):q1∧q2∧...∧qn
Wherein, L represents shifty decision function, and s is Sc；a∈Srule,qi∈ Srule, Srule, S ' rule distinguishes
Correspondence subscriber policy rule set and contextual policies rule set.Particularly, subscriber policy and contextual policies and
DefaultAPI interfaces meet following relation：
Table 1, many set of policy rules relations
As shown in table 1, for same API, and if only if, and contextual policies, subscriber policy and default are tactful
It is granted, then application program may have access to, otherwise denied access.
State when these application programs run is defined operationally by system maintenance, the access decision component inspection when calling
Look into, and verify these variables after many strategies of loading, if change, and correspondence decision-making can be made according to change.
(2) tactful loading algorithm
Many strategy access control algorithms are operationally loaded by access decision component, for deciding when, assorted
Strategy can be loaded in system.Simultaneous scanning strategy, judges whether this time request runs counter to strategy and process policy conflict,
Finally access request is made a policy.Algorithm includes two parts：
The row of algorithm 1～7 describes the situation that callee is resource or service.When callee is resource or service
When, access decision component loads subscriber policy and contextual policies in many policy librarys, and determines whether user or third party
Software is prohibited to call or access certain api interface.If the ability is prohibited, for this visit request, access decision component
False is returned, will otherwise the ability of the application program access interface be given.The present invention is returned from point of view of practicability, modification
Request, returns data falsification, to accessing note data storehouse or communications database to accessing geographical location information, cell phone apparatus ID etc.
Deng return null value.
The row of algorithm 8～12 describes the situation that callee is application program or component.When callee is to apply journey
When sequence or component, algorithm will check the type of callee.If callee type is insincere application program, access decision group
Part will load called side and the Application Status of the side that is called, and system strategy.Access decision analyzing component system strategy
In each rule, these information are matched with Sc and Sct.
For example, the corresponding Application Status of application program meet：
①
Sc.type=" untrust ” ＆＆ " send_Sms " ∈ SC.Scap&&“read_Contact”∈Sct.Scap
Caller and callee have run counter to system strategy rule 2, and this visit is that illegal ICC is called.If can not
Successful match, then return checkComponentPermission.
When callee is system application, access decision component will load the application journey of caller and callee
Sequence state.To be matched with the Application Status of called side and the side that is called per rule in system strategy.For example meet
It is not allow communication between the third party application and system program of following condition：
②
3. Sc.type=" untrust ” ＆＆packageName={ " com.android.phone " } ∈ Sct.Scap
Rule match defined in this time communication and system strategy 1, illustrates that this time communication is not allowed；Otherwise, will return
Return checkComponentPermission.
Under great amount of samples statistics, present invention achieves the interface level access control time is 0.399ms, the assembly communication time
Consume as 6.334ms.On the whole the inventive method has reached following beneficial effect：
API feature extractions are realized, many policy mechanisms are designed：
Static analysis is carried out to common application software in 50 Android application markets, 15 conventional API are extracted,
And be mapped to Android source code layers, analyze its function and call method, and these API are modeled, complete subscriber policy and
The design of contextual policies.
Realize that application features are extracted：
Characteristic when installing to application program is analyzed, and extracts the feature of application program, such as module information, applying right
Limit etc..These information are modeled, the system strategy based on Application Status are completed and is designed.
Android security mechanisms are improved, RSBAC frameworks are introduced：
RSBAC frameworks are introduced into Android, is realized based on shifty Android access controls system, and to 50
Android application softwaries and 118 malice samples are tested, by two kinds the designed effectiveness for realizing case proof system
And correctness.
The present invention is completed to the restriction using routine access interface capability by many policy mechanisms, and prevents ICC to lead to
Letter.In an experiment, by configuring subscriber policy and contextual policies, user can flexibly control application behavior.
Claims (4)
1. it is a kind of to be based on shifty Android access controls system, it is characterised in that the system integrally includes being arranged on
Controller and policy installation module, the interphase interaction of three when the application program of Android middleware layers installs module, operation
The access control of android system is completed, by many policy mechanisms the access to Android ccf layer api classes is realized；Wherein：
The application program installs module, and for installing and uninstalling application program, the module includes application manager component
With application information storehouse：The application manager component is when program is installed to the init state information of application program
The work be collected, extracted using component, authority, Intent filter informations in journey and preserve initial state information；It is described
Application information library storage initializes the data base of application state information；
The monitoring module during operation, including access executive module and access decision component：The access executive module is in operation
When the access request of main body is intercepted, and the object type of access request is judged according to access request；The access decision
Component carries out decision-making to access, according to visitor information and interviewee's information, the corresponding shifty access control algorithm of loading,
Realize the control to visitor and interviewee；
The policy installation module, there is provided installation, the more New function of strategy, the module includes many policy installation device assemblies and Duo Ce
Omit library component：Many policy installation device assemblies are used for shifty installation；Many policy librarys are the data bases of standard, for storing
The rule of definition；
The assembly communication and strategy of monitoring module when inter-component communication installs the assembly communication of module, operation comprising application program
The assembly communication of module is installed.
2. it is a kind of to be based on shifty Android access control methods, it is characterised in that the method is comprised the following steps：
First, static analysis is carried out to selected Android application softwaries, therefrom extracts used API, complete API special
Levy extraction；Further these API features are analyzed, extraction use most the most frequently used as sensitive API；
Secondly, installing and uninstalling for application program is carried out by application program erector module, application is collected when program is installed
Program initialization state, extracts application features, according to application features, application program is classified, including can
Letter application program and insincere application program；
Carry out many strategy designs；
Utilization strategies install module and realize shifty installation and the rule storage for defining；
Then, using monitoring module during operation, judge that request object type carries out decision-making according to access request；Believed according to visitor
Breath and interviewee's information, the corresponding shifty access control algorithm of loading, realize the control to visitor and interviewee.
3. it is as claimed in claim 2 a kind of based on shifty Android access control methods, it is characterised in that described many
The step of strategy design, is specially：Sensitive API to being extracted is modeled, that is, set up respectively using according to subscriber policy and upper
Hereafter strategy conducts interviews the rule of control to these sensitive APIs；And, set up using the rule of system strategy access control.
4. it is as claimed in claim 2 a kind of based on shifty Android access control methods, it is characterised in that described many
The access control algorithm of strategy specifically includes following steps：
First, carry out providing the definition of variable states, including Application Status, call relation, strategy, policy conflict；
Then, implementation strategy loading algorithm：
When callee is resource or service, access decision component loads subscriber policy and context plan in many policy librarys
Omit, and determine whether that user or third party software are prohibited to call or access certain api interface.If the ability is prohibited, right
In this visit request, access decision component returns false, will otherwise give the ability of the application program access interface；
When callee is application program or component, algorithm will check the type of callee.If callee type is not for
Trusted application, access decision component will load called side and the Application Status of the side that is called, and system strategy.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201611192576.8A CN106650418A (en) | 2016-12-21 | 2016-12-21 | Android access control system and method based onmulti-strategy |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201611192576.8A CN106650418A (en) | 2016-12-21 | 2016-12-21 | Android access control system and method based onmulti-strategy |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN106650418A true CN106650418A (en) | 2017-05-10 |
Family
ID=58835251
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201611192576.8A Pending CN106650418A (en) | 2016-12-21 | 2016-12-21 | Android access control system and method based onmulti-strategy |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN106650418A (en) |
Cited By (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN108399336A (en) * | 2018-02-11 | 2018-08-14 | 胡丽丽 | A kind of detection method and device of Android application malicious act |
| CN108763950A (en) * | 2018-04-20 | 2018-11-06 | 句容市宝启电子科技有限公司 | A kind of safety middleware system of facing moving terminal |
| CN109255241A (en) * | 2018-08-31 | 2019-01-22 | 国鼎网络空间安全技术有限公司 | Android privilege-escalation leak detection method and system based on machine learning |
| CN109753807A (en) * | 2019-01-09 | 2019-05-14 | 国家保密科技测评中心 | Safety detection method and device |
| CN109818937A (en) * | 2018-05-04 | 2019-05-28 | 360企业安全技术(珠海)有限公司 | For the control method of Android permission, device and storage medium, electronic device |
| WO2020136497A1 (en) * | 2018-12-26 | 2020-07-02 | International Business Machines Corporation | Detecting inappropriate activity in the presence of unauthenticated api requests using artificial intelligence |
| CN112270011A (en) * | 2020-11-19 | 2021-01-26 | 北京炼石网络技术有限公司 | Method, device and system for protecting service and data security of existing application system |
| CN112463266A (en) * | 2020-12-11 | 2021-03-09 | 微医云(杭州)控股有限公司 | Execution policy generation method and device, electronic equipment and storage medium |
-
2016
- 2016-12-21 CN CN201611192576.8A patent/CN106650418A/en active Pending
Non-Patent Citations (1)
| Title |
|---|
| 田冬冬等: "《The 11th EAI International Conference on Security and Privacy in Communication Networks》", 31 October 2015 * |
Cited By (14)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN108399336A (en) * | 2018-02-11 | 2018-08-14 | 胡丽丽 | A kind of detection method and device of Android application malicious act |
| CN108399336B (en) * | 2018-02-11 | 2020-08-28 | 侯殿君 | Detection method and device for malicious behaviors of android application |
| CN108763950A (en) * | 2018-04-20 | 2018-11-06 | 句容市宝启电子科技有限公司 | A kind of safety middleware system of facing moving terminal |
| CN109818937A (en) * | 2018-05-04 | 2019-05-28 | 360企业安全技术(珠海)有限公司 | For the control method of Android permission, device and storage medium, electronic device |
| CN109255241A (en) * | 2018-08-31 | 2019-01-22 | 国鼎网络空间安全技术有限公司 | Android privilege-escalation leak detection method and system based on machine learning |
| CN109255241B (en) * | 2018-08-31 | 2022-04-22 | 国鼎网络空间安全技术有限公司 | Android permission promotion vulnerability detection method and system based on machine learning |
| GB2594217A (en) * | 2018-12-26 | 2021-10-20 | Ibm | Detecting inappropriate activity in the presence of unauthenticated API requests using artificial intelligence |
| WO2020136497A1 (en) * | 2018-12-26 | 2020-07-02 | International Business Machines Corporation | Detecting inappropriate activity in the presence of unauthenticated api requests using artificial intelligence |
| GB2594217B (en) * | 2018-12-26 | 2023-01-04 | Ibm | Detecting inappropriate activity in the presence of unauthenticated API requests using artificial intelligence |
| US11303659B2 (en) | 2018-12-26 | 2022-04-12 | International Business Machines Corporation | Detecting inappropriate activity in the presence of unauthenticated API requests using artificial intelligence |
| CN109753807A (en) * | 2019-01-09 | 2019-05-14 | 国家保密科技测评中心 | Safety detection method and device |
| CN109753807B (en) * | 2019-01-09 | 2021-08-10 | 国家保密科技测评中心 | Security detection method and device |
| CN112270011A (en) * | 2020-11-19 | 2021-01-26 | 北京炼石网络技术有限公司 | Method, device and system for protecting service and data security of existing application system |
| CN112463266A (en) * | 2020-12-11 | 2021-03-09 | 微医云(杭州)控股有限公司 | Execution policy generation method and device, electronic equipment and storage medium |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN106650418A (en) | Android access control system and method based onmulti-strategy | |
| Peng et al. | Security challenges and opportunities for smart contracts in Internet of Things: A survey | |
| CN104462970B (en) | A kind of Android application program privilege abuse detection methods based on process communication | |
| CN110310205B (en) | Block chain data monitoring method, device, equipment and medium | |
| CN105046146B (en) | A kind of resource access method of Android system | |
| US20110276604A1 (en) | Reputation based access control | |
| CN103875003A (en) | System and method for whitelisting applications in a mobile network environment | |
| CN104809390A (en) | Safe operation method and device of system | |
| US8752130B2 (en) | Trusted multi-stakeholder environment | |
| US7770202B2 (en) | Cross assembly call interception | |
| CN100498816C (en) | Reference monitor implementing method of high safety grade operating system | |
| CN109683854A (en) | A kind of software security requirement analysis method and system | |
| CN104508676B (en) | Mandatory protection control in virtual machine | |
| Kim et al. | Attack detection application with attack tree for mobile system using log analysis | |
| CN106341369A (en) | Security control method and device | |
| CN109977644B (en) | Hierarchical authority management method under Android platform | |
| CN117113425B (en) | Privacy compliance method for lake and warehouse integrated data analysis | |
| Barthe et al. | Mobius: Mobility, ubiquity, security: Objectives and progress report | |
| CN114117410A (en) | Container safety isolation reinforcing method and device, electronic equipment and storage medium | |
| Demissie et al. | Assessing the Effectiveness of the Shared Responsibility Model for Cloud Databases: the Case of Google’s Firebase | |
| Zhang et al. | Design and implementation of efficient integrity protection for open mobile platforms | |
| Bai et al. | On cloud computing security | |
| Inshi et al. | CAPEF: Context-aware policy enforcement framework for Android applications | |
| Saif et al. | Analysis of Android applications permissions | |
| Armando et al. | Mobile App Security Analysis with the MAVeriC Static Analysis Module. |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| WD01 | Invention patent application deemed withdrawn after publication | ||
| WD01 | Invention patent application deemed withdrawn after publication |
Application publication date: 20170510 |