A Framework For Patching Inter-Application Vulnerabilities In Android Application

With the popularity and rapid development of smart phones, mobile phone users are now having much more powerful mobile computing capability and storage capacity. While bringing convenience to users, it also attracted the attention from global malicious attackers. Although mobile operating systems continue to enhance security, but the attackers are constantly upgrading their attack methods which makes mobile security a serious problem. Because the Android platform is very popular and earns a dominate share of the smart phone market, the number of attacks that target Android is very large. Therefore, how to secure the Android platform becomes the most important thing. Recently, an increasing number of inter-app attacks such as confused deputy attacks, data leakage attacks and collusion attacks spring up. However, there is no perfect defense method against them. As we all know, developers play an important role in android security, but their weak consciousness about the security or malicious intent may lead to inter-app attacks. Therefore, no matter how these developed applications behave, we need to propose a comprehensive to defend against such attacks in android.In this paper, we propose an automatic patch framework AutoPatchDroid, which used to protect the potential vulnerablilities of the inter-application attacks. AutoPatchDroid is composed of path extraction module and patch generation module, and the path extraction module can divide into configuration initialization stage and path calculation stage. The configuration initialization stage needs to prepare some critical points of possible security problems, including sources, sinks, entry points, exit points and permission points. The path calculation stage uses the technology of static data flow analysis to generate the path from the start points to the ends. Patch generation module mainly divided into code locating stage and patch generation phase, the code locating stage mainly locate the vulnerabilities existing in the application, and patch generation phase do the patch job form the vulnerabilities. Through the work of these two modules, a new application comes out and it can effectively protect the application from inter-application attacks.The advantages of AutoPatchDroid are as follows:1)Without the participation of developers, the framework has the ability to enhance the security of the applications. It provides a comprehensive protection of confused deputy attacks, data leakage attacks and collusion attacks.2) The framework provides a bidirectional protection of inter-application attacks, it resolves the unidirectional protection problem from both the caller and callee perspectives.3) According to different attack types, the framework offers different kinds of defense technology. First, it will extract all the possible existence of the key path through the path extraction module, then locate the key points and patch the vulnerability according to the needs.