Android storage application sandbox based on application program virtualization, and communication method thereof

Abstract

The invention discloses an Android storage application sandbox based on application program virtualization. The Android storage application sandbox comprises an agent and a target, wherein a strong secure boundary used for securely isolating untrusted application programs exists between the target and the agent; the agent is an application program process, owns all platform permissions distributed by a system, can normally interact with Android middleware and is used as all interactive compulsory agents between the target and an Android system; the agent comprises an API (Application Program Interface) layer, a core logic layer and a virtual layer; and the target does not have a platform permission, can not access Android firmware, can not change a file system and comprises sandbox service, a Binder interprocess communication interceptor and a system calling interceptor. Safety provided by an isolation process is used, and the untrusted application programs are dynamically loaded and executed in the process to avoid revising an operating system and the untrusted application programs. Meanwhile, a controllable method is used for permitting the untrusted application programs to execute an input / output operation and access system resources, and the untrusted application programs are packaged in the sandbox environment.

Description

technical field [0001] The invention belongs to the technical field of communication, and in particular relates to an Android storage application sandbox based on application virtualization and a communication method. Background technique [0002] With the ubiquity of Android and the popularity of the open source system, the privacy of smartphone users, especially Android OS users, is compromised by many different threats. These threats include increasingly sophisticated malware and spyware, developer negligence, and the lack of fail-safe defaults in the Android SDK. To address this situation, developing new ways to protect end-user privacy has become an active topic in the Android security field in recent years. [0003] Existing methods for deploying Android Security Extensions are OS Security Extensions and Inline Reference Monitoring. OS Security Extensions demonstrates a user identifier-centric Android security architecture that, while providing strong security guaran...

AI Technical Summary

Problems solved by technology

As an alternative, inline reference monitoring moves the reference monitor to the application layer and allows users to install security extensions in the form of applications. However, the reference monitor and untrusted applications share the same process space, which is less secure, and at the same time The inline reference watcher needs to be modified and the application needs to be re-signed, which violates Android's signature-based same-origin model

Images