Enhanced Permission Constraint Mechanism Research For Third-party Applications On Android OS

Among the many mobile operating systems for smartphones, GoogleAndroid OS has overwhelming superiority because of its full open source naturewhich has attracted a large number of developers and users. However, as adouble edged sword, full open source nature of Android OS creates a hazard inaddition to benefits to developers and users. Many third-party applications fromvarious Android software markets have a lot of security issues. In particularabuse of authority can easily cause application privilege escalation attacks onAndroid. The existing security mechanisms in Android OS only prompts theuser permissions list at install-time, but end users don’t have ability todistinguish the useful permissions and extra permissions. They are less likely toadopt effective measures to deal with the redundant authorization problem.In this paper, an enhanced Android framework model is proposed to helpusers to solve this problem. The author has analyzed the problem for redundantauthorized third-party applications on Android and told that redundant access ofapplication is one of the important reasons which can cause hidden danger toAndroid security. On the basis of original Android system source code, anenhanced Android model is constructed which can identify the redundantpermissions at runtime and automatically eliminate redundant permissions afteroperation. The model helps to avoid the privilege escalation attacks.A series of experiments have been done to test functionality andperformance of the enhanced Android model. The results have confirmed thatthe model can effectively solve the problem of redundant authorized third-partyapplications, but did not cause significant consumption of system resources,which achieved the design goals.