An Efficient Mobile Platform Recording And Playback System

With rapid development of modern mobile applications and ecosystem, data security on mobile platforms has become a trending topic for current researches. Data security mainly consists of privacy and integrity. Privacy insures private data unexposed from unauthorized persons, while integrity keeps data from permanent damage. Most traditional security solutions cannot be applied directly on mobile platforms, due to limited computing resources, storage capacity, and battery volume of mobile devices, as well as disparate characteristics of mobile applications. This makes security on mobile platforms an even harder problem.This paper is based on ReDroid system developed by our laboratory. ReDroid is a security system designed to protect users’ critical data on mobile devices from permanent damage, using record and replay mechanism. The key idea of ReDroid is to record all data modifications during normal device usage. And when the user finds out some application to be evil, he or she can install a clean version of the infested application, or choose to remove the application totally, and then ReDroid will recover his or her data. During recovery, ReDroid will keep all benign changes made by other applications and benign part of original application, while eliminating damages or changes introduced by malwares or malicious injected code.Before this paper, ReDroid had support for database record and replay. However, database record and replay alone can only provide a coarse-grained recovery mechanism, and is not sufficient for cases with data dependency or applications which contain both benign and malicious changes. To overcome its defects, we designed and implemented an event-based record and replay system for ReDroid, as well as a hybrid replay mode to combine database replay with event-based replay, so that the user can benefit from advantages of the both replay schemes. Event-based record and replay system mainly targets at user events (touch events, key press events, etc.) and low-level system events (randomization and timing). We designed a Hash based application state identification algorithm to allow fast forward in user event replay, and also logging services to record low-level system call results for multi-threading applications in Android.We conduct several experiments to evaluate ReDroid system. These experiments shows are ReDroid system has acceptable space and computing overhead, low battery consumption, and hardly any impact on interactive latency.