DMCA
Apex: Extending Android Permission Model and Enforcement with User-defined Runtime Constraints
| Citations: | 154 - 2 self |
BibTeX
@MISC{Nauman_apex:extending,
author = {Mohammad Nauman and Sohail Khan and Xinwen Zhang},
title = {Apex: Extending Android Permission Model and Enforcement with User-defined Runtime Constraints},
year = {}
}
Share
 |
 |
 |
 |
||
OpenURL
Abstract
Android is the first mass-produced consumer-market open source mobile platform that allows developers to easily create applications and users to readily install them. However, giving users the ability to install third-party applications poses serious security concerns. While the existing security mechanism in Android allows a mobile phone user to see which resources an application requires, she has no choice but to allow access to all the requested permissions if she wishes to use the applications. There is no way of granting some permissions and denying others. Moreover, there is no way of restricting the usage of resources based on runtime constraints such as the location of the device or the number of times a resource has been previously used. In this paper, we present Apex – a policy enforcement framework for Android that allows a user to selectively grant permissions to applications as well as impose constraints on the usage of resources. We also describe an extended package installer that allows the user to set these constraints through an easy-touse interface. Our enforcement framework is implemented through a minimal change to the existing Android code base and is backward compatible with the current security mechanism.
Keyphrases
user-defined runtime constraint extending android permission model serious security concern policy enforcement framework runtime constraint third-party application mobile phone user impose constraint android code base minimal change security mechanism enforcement framework easy-touse interface current security mechanism extended package installer
