Permission Control Of Sensitive Behaviors In Third-party Libraries Of Mobile Applications

In recent years,third-party libraries have received more and more attention in mobile application development due to the features of convenience and free.In order to shorten the development cycle and reduce development cost,mobile application developers usually integrate one or more third-party libraries into their applications to enhance the functionality of the applications.However,because the third-party libraries is embedded in the applications,they will share the running environment and privacy permissions of the host applications during runtime.This makes it possible for some malicious third-party libraries to abuse the permissions of the host applications to perform sensitive operations and steal the privacy information of users with the name of the host applications.However,the permission control mechanism of Android system,the most popular mobile operating system,cannot effectively distinguish between the sensitive operations from the host applications and that from third-party libraries.Therefore,it is impossible for it to confine the sensitive behaviors of the third-party libraries which brings a great risk to user privacy and the security of the host applications.To this end,a new application layer solution is designed and implemented in this paper to confine the sensitive behaviors of third-party libraries and prevent them from abusing permissions of the host applications.Because it is located at the application layer,the solution does not require any changes to the Android framework and the underlying operating system,nor does it require root permissions,so it can be easily deployed.At the same time,compared with existing solutions,this solution can not only confine the sensitive operations of Java code in third-party libraries,but also confine and isolate the sensitive behaviors of native code in third-party libraries which achieves a full range of behavior constraints on third-party libraries.Specifically,in order to confine the sensitive operations of Java code in third-party libraries,this paper uses static bytecode rewriting technology to search and rewrite the privacy-sensitive calls in the static bytecode of third-party libraries.After rewriting,all privacy operations in Java static bytecode will be redirected to the customized API methods in which the security policy will be enforced to confine the corresponding sensitive behavior.At the same time,this paper uses the ”isolated process” security feature of the Android system to separate native code into an isolated process without any privacy permissions.Thereby,the isolated native code from the host process cannot abuse the permissions of the host application or manipulate the memory data of the host application.Since the isolation process cannot perform any permissionrelated operations,all the related operations will be redirected to the host process by a customized RPC(remote procedure call)proxy.The customized proxy will then perform authority judgment and agent execution to ensure the original functionality of the native code is not affected and achieve sensitive behavior control and isolation of native code in third-party libraries.Finally,a prototype system is implemented based on the Android 6.0 version,and 54 popular third-party libraries and 10 applications each library are collected to evaluate the prototype system.The result shows that the prototype system can effectively perform fine-grained permission control on the sensitive behavior of thirdparty libraries in mobile applications without affecting the functionality of third-party libraries,and the introduced performance overhead is small.