Crowdsourced android user security and privacy settings system and method

Abstract

The application provides a crowd-sourcing based Android user security and privacy setting system and method, the system comprises a user management module, a data collection module, a setting recommendation module, a data management module, a crowd-sourcing management module and a recommendation generation module.The security and privacy setting system generates personalized recommendations for Android users to improve security and privacy, collects security-related data from expert users, and introduces a weight-based algorithm to determine the priority and credibility of the data to create the best setting recommendations.The application can enable ordinary users to easily understand how to correctly set their devices to enhance personal security and privacy protection, and effectively improve the robustness and reliability of Android devices.

Description

Technical Field

[0001] This invention belongs to the field of software technology, and relates to Android-based mobile phone software technology, specifically to a crowdsourcing-based Android user security and privacy settings system and method. Background Technology

[0002] With the development of mobile computing, smartphones have become ubiquitous worldwide. However, our concerns about personal security and privacy continue to grow. Due to some Android applications having excessive permissions, sensitive information of Android users (such as photos and location data) is being widely leaked. Although the Android kernel is designed with permissions for security and privacy protection, they are coarse-grained and often configured by default, putting users' Android devices at risk.

[0003] Therefore, configuring one's phone correctly and reasonably is a challenge for ordinary users, as they lack understanding of reasonable security and privacy settings and are unable to apply them effectively. Furthermore, they cannot identify and determine whether granting certain permissions might jeopardize their personal security and privacy. Additionally, some applications' privacy policies are incomplete or ambiguous, which can confuse users. Summary of the Invention

[0004] To address the aforementioned issues, this invention proposes a crowdsourcing solution, disclosing a crowdsourced system and method for setting security and privacy settings for Android users. First, an application is installed on each participant's phone to collect security and privacy-related data. This data is then sent to our crowdsourcing server. Subsequently, a weighted algorithm is designed to combine similar types of data based on the participants' expertise, helping to create recommendations. Finally, reasonable security and privacy settings are recommended and applied to the user's phone. This invention provides Android users with reasonable and appropriate security and privacy settings. To help ordinary users configure their Android devices and improve their security and reliability, many participants with mobile security experience have provided suggestions.

[0005] To achieve the above objectives, the technical solution of the present invention is as follows:

[0006] A crowdsourced approach to Android user security and privacy settings includes the following steps:

[0007] Step 1: Data Collection Phase

[0008] Collect participants' personal information; automatically obtain device information with the participants' informed consent; and collect participants' specific suggestions or solutions for issues that have different impacts due to different security and privacy settings. The specific steps are as follows:

[0009] Step 2: Data Processing Stage

[0010] Crowdsourced weighting algorithms analyze and process the collected data to determine its priority and credibility. Based on the participants' expertise, data of the same type are grouped together to create recommendations.

[0011] Step 3, the recommendation generation stage, based on the collected data and algorithms, implements crowdsourced security and privacy settings for Android users, including privacy agreement descriptions, permission settings, and application selection.

[0012] Furthermore, step one specifically includes the following steps:

[0013] (1) Collect participants' personal information; divide participants into experts and ordinary users;

[0014] (2) Automatically collect participants’ device information with their knowledge and consent;

[0015] (3) Crowdsourcing participants annotate the data flow of different functions of the APP and record all execution paths in the format of (actor, action, data type, entity);

[0016] (4) Use NLP technology to parse the privacy protocol of the Android application and mark each privacy protocol in the format of (actor, action, data type, entity);

[0017] (5) Classify privacy protocols into five categories: Clear, Vague, Omitted, Ambiguous, and Incorrect.

[0018] (6) Collect data such as app ratings, user reviews, installation and runtime issues through app stores and surveys to help determine whether an app is worth installing and using;

[0019] (7) Collect permission settings information from the mobile devices of crowdsourcing participants, including five options: deny, always allow, allow while in use, ask when to use, and blank pass.

[0020] Furthermore, step two specifically includes the following steps:

[0021] (1) Select seed users, and assume that their options are the most suitable. Seed users are a group of authoritative security experts determined before the experiment.

[0022] (2) The configuration options of other crowdsourcing participants are compared with those of the seed experts, and then the user expert rate and confidence level are calculated.

[0023] The user similarity is derived by comparing the permissions of installed applications that overlap with Seed Expert, tuple (α) ij ,β ij The numbers ) represent the weighted values ​​of the same and different numbers of these options; the user has a direct connection with the seed user, so the expert level p of user i is obtained. i That is, the expert rate R of user i. i ;

[0024] User i's expert level is calculated using the following formula:

[0025] R i =α si / (α si +β si );

[0026] The confidence level of user i is calculated using the following formula:

[0027]

[0028] (3) All crowdsourcing users were rated using an iterative algorithm;

[0029] (4) The iteration stops when all participants have been tested.

[0030] Furthermore, in step (2), after the user changes the permissions, the option will be given a higher weight value.

[0031] Furthermore, the specific steps for generating the privacy agreement description function for Android users in step three are as follows:

[0032] (1) Extract information related to security and privacy from each protocol;

[0033] (2) Highlight the privacy and security statements in the privacy agreement;

[0034] (3) Analyze the privacy agreement to determine whether the application behavior is accurately described;

[0035] (4) Analyze the privacy agreement and reorganize and tag key information;

[0036] (5) Provide installation advice and highlight potential risks.

[0037] Furthermore, the specific steps for generating the permission setting function for Android users in step three are as follows:

[0038] (1) State why the application needs this permission;

[0039] (2) Explain the purpose of the application using this permission;

[0040] (3) Explain the impact of the application having this permission;

[0041] (4) Clarify the reasons why this permission is the best permission;

[0042] (5) If the Android system does not provide an option when setting permissions, select the second appropriate option.

[0043] Furthermore, the specific steps for generating the application selection function for Android users in step three are as follows:

[0044] (1) Based on the statistics of the application selection, each application will receive a score to measure whether the application is worth installing;

[0045] (2) Apps with low ratings will be blacklisted to warn users not to download them;

[0046] (3) Users only need to select the application with the highest score;

[0047] (4) When a user updates the application, first check the installation source. If it is not in the blacklist, prompt the user to continue updating.

[0048] The present invention also provides a crowdsourcing-based security and privacy settings system for Android users, including a server and a client installed on the mobile phone. The client includes a user management module, a data collection module and a settings recommendation module, and the server includes a data management module, a crowdsourcing management module and a recommendation generation module.

[0049] The user management module is used for user management of the entire system, including crowdsourcing participants and target users;

[0050] The data collection module is used for data collection for the entire system, including equipment information, questionnaire results, and security recommendations. The collected data will be transmitted to the crowdsourcing management module for further analysis.

[0051] The settings recommendation module is used to recommend the best security and privacy settings generated by the server to the user.

[0052] The data management module is used to store and manage the data of the entire system, including multiple databases for users, devices, and questionnaires. It categorizes the collected data to facilitate subsequent analysis and processing.

[0053] The crowdsourcing management module implements a crowdsourcing mechanism, bringing together participants and users. It uses a weight-based algorithm to combine similar types of data based on the participants' expertise, creating reasonable recommendations for inexperienced Android users.

[0054] The recommendation generation module creates personalized recommendations for different target users and sends the recommendation information to the front end to correctly configure the target device.

[0055] Furthermore, the crowdsourcing management module is connected to the user management module through a user interface; the crowdsourcing management module is connected to the data collection module and the data management module through a data interface. The crowdsourcing management module receives the data collected by the data collection module and transmits the unprocessed data to the data management module for classification, management, and storage; the crowdsourcing management module is connected to the recommendation generation module through a recommendation interface, transmitting the processed data to the recommendation generation module and receiving the processed data from the recommendation generation module.

[0056] The beneficial effects of this invention are as follows:

[0057] (1) This invention proposes a security enhancement solution that collects security-related data from expert users and introduces a weight-based algorithm to determine the priority and credibility of the data, recommending the best security and privacy settings to Android users. It is easy to apply and does not require modification of Android devices.

[0058] (2) This invention introduces crowdsourcing to create recommendations and designs a weight-based algorithm to analyze and process data collected from different participants, allowing experienced users to provide suggestions to unfamiliar users and quantify them, and providing optional security and privacy settings.

[0059] (3) The solution of this invention was tested on an Android device. The evaluation results show that the solution of this invention can successfully help users set up their Android devices and protect their security and privacy. This invention makes it easy for ordinary users to understand how to properly set up their devices to enhance personal security and privacy protection; this invention can effectively improve the robustness and reliability of Android devices. Attached Figure Description

[0060] Figure 1 This is a classification diagram of information disclosure in this invention.

[0061] Figure 2This is a schematic diagram of the structure of the crowdsourcing-based security and privacy settings system for Android users provided by the present invention.

[0062] Figure 3 This is a schematic diagram of a crowdsourcing-based weighting algorithm. Detailed Implementation

[0063] The technical solutions provided by the present invention will be described in detail below with reference to specific embodiments. It should be understood that the following specific embodiments are only used to illustrate the present invention and are not intended to limit the scope of the present invention.

[0064] Figure 1 The diagram shown is a classification chart of information disclosure in this system, which includes two main categories: correct and incorrect, as explained below:

[0065] Firstly, proper information disclosure includes the following two situations:

[0066] (1) Clear information disclosure: When the privacy policy contains statements that directly discuss the exact types of data and data stream entities, and there are no other policy statements that contradict it;

[0067] (2) Vague information disclosure: Privacy policies use broad terms for data types or entities only in statements that match the data flow;

[0068] Secondly, incorrect information disclosure includes the following three situations:

[0069] (1) Ignored information disclosure: The privacy policy does not contain any policy statements discussing data flow or declaring that third parties do not collect data types;

[0070] (2) Incorrect information disclosure: The privacy policy states that data streams such as negative sharing or collection statements will not occur, and there is no contradictory positive sharing statement that third parties do not collect data;

[0071] (3) Ambiguous information disclosure: The data flow in the privacy policy matches two or more contradictory policy statements, and it is unclear whether the flow will occur, i.e. there are conflicting statements about the set of data types.

[0072] Figure 2The diagram shows the system's structure, which consists of two parts: a client (front-end) and a server (back-end). The client (front-end) is developed on Windows 10 using Android Studio Bumblebee, implementing front-end functionality using the Dart language within the Flutter framework. USB debugging and Android SDK version 29.0.0 are configured. Development is based on the Android SDK's ADB toolkit, and the Android smartphone connects to the computer via USB debugging. The server (back-end) is built using the Spring Boot framework, employing IDEA as the development tool, managing JAR files via Maven, and written in Java. Development is done on Windows 10 using IntelliJ IDEA 2021, with packaging using Maven.

[0073] The client-side (front-end) comprises three main modules: a user management module, a data collection module, and a settings recommendation module. The user management module manages all users within the system, including crowdsourcing participants (experts and general participants) and target users (those requiring protection). The data collection module gathers data from the entire system, including device information, survey results, and security recommendations. This collected data is then transmitted to the crowdsourcing management module for further analysis. The settings recommendation module recommends optimal security and privacy settings generated by the server to users. The client-side (front-end) is installed on the participants' mobile phones.

[0074] The server-side (backend) consists of three main modules: a data management module, a crowdsourcing management module, and a recommendation generation module. The data management module stores and manages all system data, including multiple databases for users, devices, and surveys. It categorizes the collected data for easier analysis and processing. The crowdsourcing management module implements a crowdsourcing mechanism, bringing together participants and users. A weighted algorithm combines similar data based on participants' expertise to create reasonable recommendations for inexperienced Android users. The recommendation generation module creates personalized recommendations for different target users and sends recommendation information (such as privacy policy analysis, application behavior, market research, and application permissions) to the frontend to correctly configure the target devices.

[0075] The security and privacy settings system enhances the security and privacy of Android users by generating personalized recommendations, achieved through the collaborative efforts of six modules within the system.

[0076] The crowdsourcing management module needs to implement three sets of interfaces: user interface, data interface, and recommendation interface; these three sets of interfaces are managed uniformly by the crowdsourcing management module.

[0077] The crowdsourcing management module and the user management module are connected through a user interface to enable unified management of all users by the system.

[0078] The crowdsourcing management module is connected to the data collection module and the data management module via a data interface. The data collection module transmits the collected data to the crowdsourcing management module, which manages crowdsourcing participants through the user management module. The crowdsourcing management module and the data management module can exchange data; the crowdsourcing management module transmits unprocessed data to the data management module, which categorizes, manages, and stores the data, and then packages and sends the processed data back to the crowdsourcing management module.

[0079] The crowdsourcing management module and the recommendation generation module are connected through a recommendation interface. The crowdsourcing management module passes the processed data to the recommendation generation module, which further processes the data using a weighted algorithm. Based on the participants' professional knowledge, it combines similar types of data to create personalized recommendations for different target users and sends the processed data back to the crowdsourcing management module. The recommendation settings module displays the recommendation configuration scheme generated by the recommendation generation module in the backend to the user.

[0080] This invention also provides a crowdsourcing-based method for setting security and privacy settings for Android users, comprising the following steps:

[0081] Step 1: Data Collection Phase. First, personal information of participants is collected through the experiment, including age, gender, educational background, occupation, and years of work experience. Second, device information is automatically obtained with the participants' informed consent. Furthermore, specific suggestions or solutions from participants are collected regarding the different impacts of various security and privacy settings. The specific steps are as follows:

[0082] (1) Collect participants’ personal information. Participants’ personal information will affect their professional level, which in turn will affect the priority and credibility of the data; collect data such as age, gender, education background, occupation, and years of work experience through experiments; divide participants into experts and ordinary users;

[0083] (2) Collect participants’ device information in order to make specific recommendations for different Android devices; automatically obtain device information with the knowledge and consent of the participants;

[0084] (3) Crowdsourcing participants annotate the data flow of different functions of the APP and record all execution paths in the format of (actor, action, data type, entity);

[0085] (4) Use NLP technology to parse the privacy protocol of the Android application and mark each privacy protocol in the format of (actor, action, data type, entity);

[0086] (5) Classify privacy protocols into five categories: Clear, Vague, Omitted, Ambiguous, and Incorrect.

[0087] (6) Collect data such as app ratings, user reviews, installation and runtime issues through app stores and surveys to help determine whether an app is worth installing and using;

[0088] (7) Collect permission settings information from the mobile devices of crowdsourcing participants, including five options: deny, always allow, allow while in use, ask when to use, and blank pass.

[0089] Step two, the data processing stage, involves analyzing and processing the collected data based on crowdsourcing weighting algorithms. This includes determining the priority and credibility of the data, and grouping similar types of data together based on participants' expertise to help create recommendations. The specific steps are as follows:

[0090] (1) Select seed users (seed experts). By default, their options are the most suitable. Seed users (seedexpert) are a group of authoritative security experts determined before the experiment.

[0091] (2) The configuration options of other crowdsourcing participants (i.e., the data obtained in step one, permission settings, etc.) will be compared with the options of the seed expert, and then the user expert rate and confidence will be calculated.

[0092] Specifically, user similarity is derived by comparing the permissions of installed applications that overlap with Seed Expert, tuples (α) ij ,β ij ) represents the same and different weighted values ​​for these options; {x k ∈{0,1,...,n}|1≤k≤n} represents the number of times user i and user j have the same option in the k-th option group in the permission sequence; The correct value after the nth submission is represented by p, and the weighted value represents the same number of options. The user has a direct connection with the seed user, thus obtaining the expert level p of user i. i That is, the expert rate R of user i. i ;

[0093] User i's expert level is calculated using the following formula:

[0094] R i =α si / (α si +β si );

[0095] The confidence level of user i is calculated using the following formula:

[0096]

[0097] After a user changes permissions, this option will be given a higher weight value;

[0098] (3) All crowdsourcing users were rated using an iterative algorithm;

[0099] (4) The iteration stops when all participants have been tested.

[0100] The specific algorithm for this step is as follows: Figure 3 As shown, there are three input parameters: x k q is the count of identical settings options across different participants; q is the weight parameter for updating options; C0 is a constant for rating credibility. Then, C is calculated for participant i. i Then, the sum is used to calculate the sum. Finally, the sum is used to iterate through each group of the application permission settings set for user i to obtain the expert level for user i. The output of the algorithm is p. i p represents the professional level of participant i. i This is important reference information for security and privacy settings. (Get p) i Then, optimal settings will be created to protect the security and privacy of Android users.

[0101] Step 3, the recommendation generation stage, implements security and privacy crowdsourcing settings for Android users based on collected data and designed algorithms, including privacy agreement descriptions, permission settings, and application selection. This invention configures different security and privacy crowdsourcing settings according to different expertise levels. For example, if expert level A is 0.7 and the recommended option is A, and expert level B is 0.8 and the recommended option is A, then the recommendation level of that option is 0.75.

[0102] The specific steps for generating a privacy agreement description for Android users are as follows:

[0103] (1) Extract information related to security and privacy from each protocol;

[0104] (2) Highlight the privacy and security statements in the privacy agreement;

[0105] (3) Analyze the privacy agreement to determine whether the application behavior is accurately described;

[0106] (4) Analyze the privacy agreement and reorganize and tag key information;

[0107] (5) Provide installation advice and highlight potential risks.

[0108] The specific steps to generate permission settings functionality for Android users are as follows:

[0109] (1) State why the application needs this permission;

[0110] (2) Explain the purpose of the application using this permission;

[0111] (3) Explain the impact of the application having this permission;

[0112] (4) Clarify the reasons why this permission is the best permission;

[0113] (5) If the Android system does not provide an option when setting permissions, such as the "blank pass" option, then select the second appropriate option.

[0114] The specific steps to generate application selection functionality for Android users are as follows:

[0115] (1) Based on the statistics of the application selection, each application will receive a score to measure whether the application is worth installing;

[0116] (2) Apps with low ratings will be blacklisted to warn users not to download them;

[0117] (3) Users only need to select the application with the highest score;

[0118] (4) When a user updates the application, first check the installation source. If it is not in the blacklist, prompt the user to continue updating.

[0119] A crowdsourced Android user security and privacy settings system and methodology can effectively protect user security and privacy, and provide optimal settings recommendations.

[0120] It should be noted that the above content merely illustrates the technical concept of the present invention and should not be construed as limiting the scope of protection of the present invention. For those skilled in the art, various improvements and modifications can be made without departing from the principle of the present invention, and all such improvements and modifications fall within the scope of protection of the claims of the present invention.

Claims

1. A method for securing and privacy settings of crowd-sourced Android users, characterized in that, The method comprises the following steps: Step one, data collection stage Collecting personal information of participants; automatically collecting device information of participants with their consent; collecting specific suggestions or solutions of participants for different security and privacy settings that have different impacts; Step two, data processing stage Analyzing and processing the collected data based on the weight algorithm of crowdsourcing to determine the priority and credibility of the data, Combining the same type of data according to the professional knowledge of participants to create recommendations; specifically comprising the following steps: (1) selecting seed users, whose options are the most suitable by default, and the seed users are a group of authoritative security experts determined before the experiment; (2) comparing the configuration options of other crowdsourcing participants with the options of the seed users, and then calculating the user expert rate and confidence; Tuple (a si , b si ) represents the same and different number of weighted values of the configuration options of other crowd participants i and the options of the seed user s; The expert rate of other crowdsourcing participants i is calculated by the following formula: R i ＝α si / (α si +β si )； The confidence of other crowdsourcing participants i is calculated by the following formula: (3) rating all crowdsourcing users through an iterative algorithm; (4) stopping iteration when all participants have been tested; Step three, recommendation generation stage, based on the collected data and algorithm, realizing the security and privacy crowdsourcing settings for Android users, including privacy agreement description, permission settings and application selection.

2. The method of claim 1, wherein the method is based on crowd-sourcing of Android users' security and privacy settings, and wherein the method further comprises: The step one specifically comprises the following steps: (1) collecting personal information of participants; dividing participants into experts and ordinary users; (2) automatically collecting device information of participants with their consent; (3) crowdsourcing participants labeling data flow of different functions of APP, and recording all execution paths in the format of (actor, action, data type, entity); (4) using NLP technology to parse the privacy agreement of Android application, and marking each privacy agreement in the format of (actor, action, data type, entity); (5) classifying privacy agreements, including 5 types of privacy agreements: clear, vague, omitted, ambiguous and incorrect; (6) collecting application ratings, user comments, installation and runtime problems through application stores and questionnaires to help determine whether the application is worth installing and using; (7) collecting permission setting information from mobile devices of crowdsourcing participants, including 5 options: prohibit, always allow, allow in use, ask in use and blank pass. 3.The crowd-sourced based security and privacy settings method for Android users of claim 1, wherein, In step (2) of step two, the option will be given a higher weight value after the user changes the permission.

4. The method of claim 1, wherein the method is based on crowd-sourcing of Android users' security and privacy settings, and wherein the method further comprises: The specific steps of generating the privacy agreement description function for Android users in step three are as follows: (1) extracting information related to security and privacy from each agreement; (2) highlighting the statements related to privacy and security in the privacy agreement; (3) analyzing the privacy agreement to determine whether the application behavior is accurately described; (4) parsing the privacy agreement, reorganizing and marking key information; (5) Provide installation recommendations, highlighting potential risks.

5. The method of claim 1, wherein the method further comprises: The specific steps of generating the permission setting function for Android users in step three are as follows: (1) State the reason why the application needs the permission; (2) Explain the purpose of the application using the permission; (3) Explain the impact of the application having the permission; (4) Clarify why the permission is the best one; (5) If the Android system does not provide an option when setting permissions, choose the second appropriate option.

6. The method of crowd-sourced security and privacy settings for Android users, as claimed in claim 1, wherein, The specific steps of generating the application selection function for Android users in step three are as follows: (1) According to the statistical data of application selection, each application will get a score to measure whether the application is worth installing; (2) Applications with lower scores will be listed in the blacklist to remind users not to download; (3) Users only need to select the highest scoring application; (4) When the user updates the application, first check the installation source, if not in the blacklist, prompt the user to continue updating.

7. A system for security and privacy settings for crowd-sourced Android users, characterized by: The crowd-sourced security and privacy setting method for Android users of any one of claims 1-6; It includes a server side and a client installed on a mobile phone, the client includes a user management module, a data collection module and a setting recommendation module, the server side includes a data management module, a crowd-sourcing management module and a recommendation generation module; The user management module is used for user management of the whole system, including crowd-sourcing participants and target users; The data collection module is used for data collection of the whole system, including device information, questionnaire results and security recommendations, the collected data will be transmitted to the crowd-sourcing management module for further analysis; The setting recommendation module is used to recommend the best security and privacy settings generated by the server side to the user; The data management module is used to store and manage the data of the whole system, including user, device and questionnaire databases, and the collected data is classified for subsequent analysis and processing; The crowd-sourcing management module realizes the crowd-sourcing mechanism, gathers participants and users together, uses a weight-based algorithm, combines data of the same type according to the professional knowledge of the participants, and creates reasonable recommendations for inexperienced Android users; The recommendation generation module creates personalized recommendations for different target users and sends the recommendation information to the front end to correctly set the target device.

8. The crowd-based security and privacy settings system for Android users of claim 7, wherein: The crowd-sourcing management module is connected with the user management module through a user interface; the crowd-sourcing management module is connected with the data collection module and the data management module through a data interface, the crowd-sourcing management module receives the data collected by the data collection module, and the crowd-sourcing management module transmits the unprocessed data to the data management module for classification management and storage; the crowd-sourcing management module is connected with the recommendation generation module through a recommendation interface, and the processed data is transmitted to the recommendation generation module, and the processed data of the recommendation generation module is received.

Images