MASK Framework Isolating Mobile App Execution Environments
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The current smartphone ecosystem lacks effective unlinkability across app usages, allowing curious parties to covertly aggregate user information without consent, leading to privacy threats from mobile apps, advertising agencies, and network sniffers.
Innovation Solution
The MASK framework introduces private execution modes (Identifiable, Pseudonymous, and Anonymous) that allow users to manage app usages based on their privacy needs, creating isolated runtime environments to prevent unwanted data correlation by intercepting and anonymizing identifying information and redirecting file system operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If device identifiers and persistent storage are used to maintain app usage consistency, then app functionality and user experience are improved, but user privacy and unlinkability across apps are compromised
Solution Approach 1:
The system segments the execution environment into isolated sandboxes for each app, preventing cross-app data aggregation while maintaining app-specific functionality. Each sandbox maintains necessary persistent storage for its own operations but cannot access other apps' data, thus resolving the contradiction between functional consistency and privacy protection.
Solution Approach 2:
The system introduces an intermediary privacy manager that controls and mediates all data access between apps and the execution environment. This manager enforces privacy policies, allows necessary data sharing for functionality while blocking unauthorized aggregation, thus enabling both app operation and privacy protection.
2Loss of information
If app usages are made anonymous and unlinkable, then user privacy is enhanced, but app functionality requiring consistent state is degraded
Solution Approach 1:
The system applies different privacy levels to different apps based on their functional requirements. Apps that need consistent state (like messaging apps) receive identifiable execution environments, while apps where privacy is paramount receive anonymous sandboxed environments. This local differentiation resolves the contradiction by tailoring the solution to each app's needs.
Solution Approach 2:
The system dynamically adjusts the level of anonymity and linkability based on the app type, user preferences, and context. Execution environments can transition between identifiable and anonymous states, allowing the system to optimize both privacy and functionality depending on the specific situation rather than applying a static approach.
3Loss of time
If persistent runtime environments are maintained across sessions, then user convenience is improved, but aggregation of user data by third parties increases
Solution Approach 1:
The system extracts and removes identifying information from persistent storage in sandboxed environments. Apps can maintain their functional state and user convenience through persistent storage, but personally identifiable information is extracted and protected, preventing third-party aggregation while preserving user experience.
Solution Approach 2:
The system changes the parameters of persistent storage by applying different privacy policies to different apps. Some apps maintain full identifiability for convenience, while others use anonymized persistent storage. This parameter differentiation allows the system to balance convenience and privacy protection across the ecosystem.
Data Source
Figure 1
Figure 2
Figure 3~4
AI summary
A technique is presented for controlling behavior tracking by mobile apps executing on a mobile computing device. A set of profiles are managed by a privacy manager, where each profile represents a different isolated execution environment on the mobile computing device and defines a set of privacy rules governing an application while executing in an associated execution environment. Prior to launching the app, a user of the app is prompted by the privacy manager to select a profile for the app from the set of profiles. The privacy manager in turn applies the set of privacy rules associated with the selected profile to the app during execution of the app on the mobile computing device.