Android Secondary Storage Access Control via SELinux Labeling
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Android devices do not allow exclusive access to secondary storage for television applications, leading to potential unauthorized access by other system applications to stored content.
Innovation Solution
Creating an application domain for the desired application and assigning a Security-Enhanced Linux (SELinux) label to provide exclusive access to secondary storage, ensuring only the designated application can access external storage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If Android devices allow multiple system applications to access Media Storage, then storage accessibility is improved, but security and exclusive access control deteriorate
Solution Approach 1:
The patent segments storage access by creating separate application domains with distinct SELinux labels for different applications. Each application receives a unique label (e.g., tvapp_label for television applications) that partitions the Media Storage access rights, allowing multiple applications to access storage simultaneously while maintaining exclusive control within each domain.
Solution Approach 2:
The patent introduces SELinux labels as an intermediary layer between applications and Media Storage. This intermediary mechanism mediates access requests by enforcing domain-specific policies, allowing the system to grant storage access to multiple applications while preventing unauthorized cross-access through the label-based mediation layer.
2Reliability
If exclusive access to Media Storage is granted to a specific application, then security is improved, but storage accessibility deteriorates
Solution Approach 1:
The patent divides Media Storage access into segmented domains, where each application operates within its own labeled domain. This segmentation enables exclusive access within each domain while maintaining overall accessibility across multiple domains, resolving the contradiction between security and accessibility.
Solution Approach 2:
The patent creates a universal labeling system that can be applied to multiple applications simultaneously. The SELinux label mechanism provides a multi-functional framework that supports both exclusive access control and broad accessibility by allowing different applications to be assigned appropriate labels for their specific needs.
3Manufacturing precision
If SELinux labels are implemented for storage access control, then access control precision is improved, but system complexity increases
Solution Approach 1:
The patent uses SELinux labels as reusable templates or copies of security policies. Instead of creating complex unique access control lists for each application, the system copies and applies standardized label definitions to multiple applications, achieving high access control precision while minimizing system complexity through policy reuse.
Data Source
AI summary
A method, an Android device, and a non-transitory computer readable medium for providing exclusive access to Android storage. The method includes: creating, on an Android device, an application domain for a desired application; creating, on the Android device, a Security-Enhanced Linux (SELinux) label for Media Storage on the Android device; and giving, on the Android device, permission only to the desired application to access external storage on the Android device with the SELinux label.