QQ客服 官方微博 反馈留言

	Android应用程序权限自动裁剪系统
	白小龙 ; BAI Xiao-long
	2016-03-30 ; 2016-03-30
关键词	Android应用程序 最小特权原则 权限过度声明 权限自动裁剪 Ring signcryption Certificateless public key cryptography CDH problem DBDH problem TP316
其他题名	A system for automatically tailoring Android applications' permissions
中文摘要	Android系统使用权限机制对应用程序进行控制,即应用程序需要使用哪些系统资源就必须提前声明相应的权限。为了确保安全性和可靠性,应用程序声明权限时应该满足最小特权原则,即只声明其所需要使用到的最少权限,但现实中有很多应用存在权限过度声明的现象,给用户带来安全隐患。提出了一种Android应用程序权限自动裁剪系统PTailor,通过对Android应用程序安装文件(APK文件)进行分析和修改,使其满足最小特权原则。PTailor首先从APK文件中提取程序所调用的所有系统API,并在预先生成的API权限映射表中查找该API所对应的系统权限,从而得到应用程序实际使用到的最少权限列表。然后根据该权限列表对程序的权限声明文件进行修改,裁剪掉已声明但未使用的权限。最后将裁剪过的权限声明文件与程序的其他部分重新合并成新的APK文件,新的APK文件中除了所声明权限满足最小特权原则外,其结构和语义都没有发生改变。使用PTailor对现实中的1 246个Android应用进行权限裁剪实验,实验结果表明,PTailor能够在很短的时间内完成权限分析和裁剪,而且大多数被裁剪的程序都能够正确运行。; Android uses the permission system to control application access.In the permission system,applications have to declare relevant permissions before they access some system resources.To be secure and trusted,applications should follow the principle of least privilege.However,in reality,many applications do not follow this principle,which may bring security threats.To solve this problem,we design and implement a novel system for automatically tailoring Android applications' permissions,called PTailor.PTailor analyzes and modifies the Android application installation file(APK file)so as to make it follow the principle of least privilege.Firstly,PTailor extracts the system API calls from the APK file and gets the API's corresponding required permissions from a predefined API-to-permissions map.In this way,PTailor can get the shortest permission list that this application really requires.PTailor uses this permission list to match the application's permission declaration file and removes those unused permissions.At last,the modified permission declaration file and the original code file are zipped to a new APK file that follows the principle of least privilege without changing its structure and semantics.PTailor is used to process 1246 Android applications in order to evaluate its performance.The experimental results show that APK files can be processed in a short time and PTailor has little influence on most tailored applications.
语种	中文 ; 中文
内容类型	期刊论文
源URL	[http://ir.lib.tsinghua.edu.cn/ir/item.do?handle=123456789/146948]
专题	清华大学
推荐引用方式 GB/T 7714	白小龙,BAI Xiao-long. Android应用程序权限自动裁剪系统[J],2016, 2016.
APA	白小龙,&BAI Xiao-long.(2016).Android应用程序权限自动裁剪系统..
MLA	白小龙,et al."Android应用程序权限自动裁剪系统".(2016).

个性服务

查看访问统计

相关权益政策

暂无数据

收藏/分享

除非特别说明，本系统中所有内容都受版权保护，并保留所有权利。