Android External Resource Access Control via Channel Mediation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Android devices lack effective protection for external resources such as Bluetooth accessories, NFC devices, and online services, as the existing security model is not designed to manage access to these resources securely, leading to vulnerabilities that allow unauthorized applications to access sensitive information.
Innovation Solution
A Security-Enhanced Android Channel Control (SEACAT) system that integrates Mandatory Access Control (MAC) and Discretionary Access Control (DAC) to provide fine-grained access control over external resources, using policy modules, enforcement modules, and security hooks to enforce security policies across various channels like Bluetooth, NFC, and Internet, ensuring only authorized applications can access these resources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the existing Android security model is used, then the system is simple and easy to operate, but external resources are not sufficiently protected against unauthorized access
Solution Approach 1:
The patent introduces a channel control mechanism as an intermediary layer between applications and external resources. This channel control module mediates all access requests to external resources through specific channels (Bluetooth, NFC, Internet, SMS, Audio), enforcing security policies without requiring complex changes to the existing Android security model. The channel control acts as a gatekeeper that validates whether applications are authorized to access external resources through particular channels, thereby improving security while maintaining system simplicity.
2Reliability
If fine-grained access control is implemented for external resources, then security is improved, but system complexity and overhead increase
Solution Approach 1:
The patent segments the access control mechanism into distinct channel-specific control modules. Instead of implementing a single complex fine-grained access control system for all external resources, the security model is divided into separate channel control mechanisms for Bluetooth, NFC, Internet, SMS, and Audio channels. Each channel has its own security policies and control rules, allowing fine-grained access control to be implemented in a modular, manageable way that reduces overall system complexity.
3Reliability
If existing permission-based access control is used, then the system is easy to operate, but unauthorized applications can still access sensitive information from external resources
Solution Approach 1:
The patent implements preliminary security policy configuration where access control rules for external resources are pre-defined and established before runtime operations. Security policies are configured in advance for each channel, specifying which applications are authorized to access which external resources. This preliminary configuration eliminates the need for complex runtime user interactions or permissions management, as the system automatically enforces pre-established security rules, thereby improving protection of sensitive information while maintaining ease of operation.
Data Source
AI summary
The present disclosure provides a security enhanced channel control system useable on a wireless device comprising a policy module including at least one processor and memory, the policy module configured to store, in the memory, one or more security policies and apply a compliance check to a first system layer and a second system layer; and a first policy base stored in the memory of the policy module, the first policy base being associated with a mandatory access control (“MAC”) base and defining one more security polices for access to a plurality of channels associated with the first and second system layers. The policy module cooperates with the first policy base to establish one or more access control rules that are applied to at least one of the plurality of channels to preclude an unauthorized application from accessing at least one of the channels.