Research On Privacy Protection In TaintDroid Based On Access Control

With the development of Internet technology,more and more people search resources on the internet with smart phones or tablets.Android is the system with the highest market share in mobile devices.User would store a lot of sensitive data when they using device,such as short message,call records,contact information and bank account information.It will cause a great threat or loss to user when these privacy data were disclosed or used illegally.Therefore,protecting privacy data in Android system has become the significant research issues in information security field.TaintDroid is a custom Android system which protected data by dynamic detection.When private data in system was leaked out of the device,TaintDroid could detect it and alert to user.This thesis was based on TaintDroid system,and we analyzed the working principle of the TaintDroid system.We found that TaintDroid system implemented dynamic detection but it not supported for control privacy data leakage,that is,when user had received the notification from the TaintDroid system,privacy data had been sent out the device already,TaintDroid also has some limitations.This thesis proposed a privacy data control method in TaintDroid system with access control theories,and designed experiments to test the performance and practicability of the improved system.The main work of this thesis included the following points:Firstly,we studied and analyzed the working principle of TaintDroid system includes the generation,propagation,extraction and labeling of taint data.We studied tracking method of taint data in different levels.The working principle of the TaintDroid system was also the basis and prerequisite for this thesis.Secondly,because the TaintDroid system could detect whether the private data in the system was sent out the device,we tested 100 applications in the application market with TaintDroid system.The status of applications requested permission in Android was tested,then we analyzed the relationship between permission and application category.In addition,this thesis detected the leakage of private data in these sample applications with TaintDroid system.we made improvements to control these private data which were easily leaked.Then,we combined with some theories of access control to improve the TaintDroid system.The concept of redirection of access control decisions was proposed,making access control decisions not only Permit or Deny,access control decisions are more granular.In addition,the policy management module and context mechanism were introduced in the improved TaintDroid system.The policy management module has three functions: generated policy automatically,policy conflict detection and policy conflict resolution.Policy management module not only could control resources with fine-grained,but also improved the flexibility of the system and reduces the burden of the administrator greatly.This thesis focused on the lack of control of private data in TaintDroid system.It mainly used some theories and methods in the field of access control and introduced the privacy data control function for the TaintDroid system.The policy management algorithm was designed and the idea of access control redirection was proposed.It had a certain enlightening effect on privacy protection in Android system.