Document Type
Article
Publication Date
2015
Publication Title
Dependable and Secure Computing, IEEE Transactions on
Abstract
In this paper, we present a security and privacy enhancement (SPE) framework for unmodified mobile operating systems. SPE introduces a new layer between the application and the operating system and does not require a device be jailbroken or utilize a custom operating system. We utilize an existing ontology designed for enforcing security and privacy policies on mobile devices to build a policy that is customizable. Based on this policy, SPE provides enhancements to native controls that currently exist on the platform for privacy and security sensitive components. SPE allows access to these components in a way that allows the framework to ensure the application is truthful in its declared intent and ensure that the user’s policy is enforced. In our evaluation we verify the correctness of the framework and the computing impact on the device. Additionally, we discovered security and privacy issues in several open source applications by utilizing the SPE Framework. From our findings, if SPE is adopted by mobile operating systems producers, it would provide consumers and businesses the additional privacy and security controls they demand and allow users to be more aware of security and privacy issues with applications on their devices.
Repository Citation
Krupp, Brian; Sridhar, Nigamanth; and Zhao, Wenbing, "SPE: Security and Privacy Enhancement Framework for Mobile Devices" (2015). Electrical and Computer Engineering Faculty Publications. 337.
https://engagedscholarship.csuohio.edu/enece_facpub/337
Original Citation
B. Krupp, N. Sridhar and W. Zhao, "SPE: Security and Privacy Enhancement Framework for Mobile Devices," Dependable and Secure Computing, IEEE Transactions on, 2015.
DOI
10.1109/TDSC.2015.2465965
Version
Postprint
Publisher's Statement
(c) 2015 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information. This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication.
