A system call-level monitoring method for Android user privacy data access

Abstract

The invention discloses a system call level monitoring method for accessing to private data of an Android user. The system call level monitoring method comprises the following steps: 1, marking a private system service; 2, processing a private service accessing request; 3, processing a monitoring affair; 4, processing private accessing, and returning a result. According to the system call level monitoring method, by identification of private data accessing and starting of monitoring, a third-party thread carries out system call level monitoring on a thread providing a service; a third-party service acquires system call information of the monitored thread by expanding a ServiceManager service of an original system and applying ptrace () system call; meanwhile, in the overall monitoring process, an attribute system in the original system fulfills the aims that the monitored thread cyclically waits for the starting of the monitoring thread and the serving thread achieves the purpose of enabling the monitoring thread to stop monitoring . The system call level monitoring method realizes monitoring of the accessing to the private data at the system call level, so that accessing auditing and protection strategies can be performed on the private data in a finer-grained manner at a deeper level.

Description

technical field [0001] The invention relates to the field of protection of privacy data of smart mobile terminal users, in particular to a system call-level monitoring method based on binder-driven Android user privacy data access. Background technique [0002] As the most popular open source mobile device operating platform, the number and importance of user privacy data stored in the Android system are increasing. With the prevalence of applications based on the Android platform, the behavior of accessing system services by third-party mobile applications has gradually become normalized, but the behavior of obtaining other privacy permissions when their own functions are not required can easily lead to the leakage of user privacy data, and further harm users. Unnecessary loss of life and even property. [0003] When a third-party application accesses private data, Android uses the binder inter-process communication mechanism to remotely call system services to achieve acc...

AI Technical Summary

Problems solved by technology

Compared with the above two types of monitoring mechanisms, the analysis time of the static mechanism is long and the accuracy is not high, but the operation is simple

The dynamic mechanism implements fine-grained access control for applications, but the implementation is relatively complicated, and it will reduce the execution efficiency of the application and the stability of the system. Risks such as proxy attacks

One of the main reasons for these problems is that when security software performs dynamic access management, it analyzes the control at the API interface level of the Android framework layer. The granularity is not fine enough, the depth of the system is not deep enough, and it cannot prevent service programs from being hijacked. Security attacks, the granularity is relatively coarse for post-event audit and analysis

Images