Mechanism for Security Enhancement in Mobile Application Installation

Abstract:

Mobile operating systems (e.g., iOS, Android, Windows Mobile, etc) are becoming powerful platforms on which various applications can be installed and run. Each mobile OS offers application store (e.g., Apple App Store, Android Play, etc) for developers to easily publish applications and earn profits. However, existing mobile platforms provide little means for mobile users to evaluate risks on allowing certain security permissions when installing mobile applications. Since mobile users may not be able to justify the risks on allowing certain permissions required by an application, mobile users may install malware with extra permissions, which leads to security risk for mobile users, e.g., private information leaked, etc. In this paper, we present process and visual User Interface for mobile users to understand and justify the risks on permissions required by mobile applications during installation. We also present two algorithms for calculating the risks.

• Periodical: Advanced Materials Research (Volumes 756-759)
• Pages: 4382-4387
• DOI: https://doi.org/10.4028/www.scientific.net/AMR.756-759.4382
• Online since: September 2013
• Authors: Peng Zhang, Han Lin Sun, Zheng Yan
• Keywords: Application Installation, Mobile OS, Permission, Trust, User Interface

References

[1] A. Rodriguez, Android's permission problems, http: /www. pcworld. com/article/251824/androids_permission_problems. html. (2012).

[2] M. A. Sasse and I. Flechais, Usable Security: Why Do We Need It? How Do We Get It?" In: Cranor, LF and Garfinkel, S, (eds. ) Security and Usability: Designing secure systems that people can use. O, Reilly: Sebastopol, US. pp.13-30.

[3] J Rode, C Johansson, P DiGioia, and K Nies. Seeing further: extending visualization as a basis for usable security,. Proceedings of the second symposium on usable privacy and security, 2006, pp.145-155, doi: 10. 1145/1143120. 1143138.

DOI: 10.1145/1143120.1143138

[4] D. Ferebee and D. Dasgupta, Security visualization survey,. Proceedings of the 12th colloquium for information systems security education, Jun. 2008, pp.119-126.

[5] R. Balebako, P. G. Leon, H. Almuhimedi, P. G. Kelley, J. Mugan, and A. Acquisti et al. Nudging users towards privacy on mobile devices,. The human-computer interaction(CHI) 2011 workshop , Vancouver, BC , May (2011).

[6] K. P. Mahaffey, System and method for server-coupled malware prevention,. US patent application, (2011).

[7] M. Nauman, S. Khan, and X. Zhang, Apex: extending android permission model and enforcement with user-defined runtime constraints,. Proceeding of the 5th ACM symposium on infomration, computer and communication security, 2010, pp.328-332.

DOI: 10.1145/1755688.1755732

[8] A. Zlotnick, Verification system and method for accessing resources in a computing environment, US patent, US20070294530, (2007).

[9] K. E. Corby, A. Goldfeder, and J. M. Hawkins, Method and system for ensuring that computer programs are trustworthy, US patent, US20060090192, (2006).

[10] R. Belani and A. Higbee, Methods and systems for rating privacy risk of applications for smart phones and other mobile platforms, US patent, US20120072991, (2012).

[11] A.P. Felt, E. Ha, S. Egelman, A. Haney, E. Chin, and D. Wagner, Android permissions: user attention, comprehension, and behavior., Technical report UCB/EECS-2012-26, University of California at Berkeley (2012).

DOI: 10.1145/2335356.2335360