Research On Third-party Code Security Enhancement Method In Android Applications

Android — the leader of modern mobile operating system — provide efficient, stable operating environment for mobile applications, and manage more private data with respect to personal computer. In order to obtain better service, users usually do not mean to pay their own private data, and application can take advantage of these data to provide a more appropriate service, and this creates a balance between the privacy of users and the service. The Android ecosystem’s openess has led to third-party code’s widespread use within the application, such third-party code framework will improve the developer’s productivity. However, this framework bring a certain degree of security risk — might break the balance between privacy and service.The cause of the problem lies in the application and the third party code belonging to different development unit, and Android does not distinguish them during evaluating, so the third-party code can use application permissions to access user privacy data. This paper proposed a new security enhancement scheme based on the hazards and causes of the problem — TPCDroid. The purpose of TPCDroid is dynamic evaluating request from third-party code, and compatible with the original application structure and the original third party code framework. TPCDroid take advantage of exception stack information to determine whether the request come from the application itself at runtime and place the third-party code library package name list in the access control evaluation engine as a policy, and controlling access.TPCDroid proposed a security enhancement scheme for third-party code based Android 4.0.1. The experimental results demonstrate our design compatible with the original application structure and the original third party code framework, protect user privacy from third-party code and has no effect on other module. The overall performance of TPCDroid compared to the Android only decreased by about 2%.