Android storage application sandbox and communication method based on application virtualization

Abstract

The invention discloses an Android storage application sandbox based on application program virtualization, which includes an agent and a target. There is a strong security circle between the target and the agent for safely isolating untrusted applications; the agent is an application program process, which has All platform permissions assigned by the system can interact with Android middleware normally and act as a mandatory proxy for all interactions between the target and the Android system; the proxy includes API layer, core logic layer and virtual layer: the target has no platform permissions, cannot access Android firmware and cannot Change the file system, including sandbox services, Binder inter-process communication interceptors and system call interceptors. The present invention utilizes the security provided by the isolated process, avoids modifying the operating system and the untrusted application program by dynamically loading and executing the untrusted application program in the process, and at the same time allows the untrusted application program to perform input / output operations in a controllable method and access to system resources, encapsulating untrusted applications within a sandbox environment.

Description

technical field [0001] The invention belongs to the technical field of communication, and in particular relates to an Android storage application sandbox based on application virtualization and a communication method. Background technique [0002] With the ubiquity of Android and the popularity of the open source system, the privacy of smartphone users, especially Android OS users, is compromised by many different threats. These threats include increasingly sophisticated malware and spyware, developer negligence, and the lack of fail-safe defaults in the Android SDK. To address this situation, developing new ways to protect end-user privacy has become an active topic in the Android security field in recent years. [0003] Existing methods for deploying Android Security Extensions are OS Security Extensions and Inline Reference Monitoring. OS Security Extensions demonstrates a user identifier-centric Android security architecture that, while providing strong security guaran...

AI Technical Summary

Problems solved by technology

As an alternative, inline reference monitoring moves the reference monitor to the application layer and allows users to install security extensions in the form of applications. However, the reference monitor and untrusted applications share the same process space, which is less secure, and at the same time The inline reference watcher needs to be modified and the application needs to be re-signed, which violates Android's signature-based same-origin model

Images