a permission verification approach for android mobile applications：安卓移动应用程序的权限验证方法.pdf

c o m p u t e r s s e c u r i t y 4 9 ( 2 0 1 5 ) 1 9 2 e2 0 5 Available online at ScienceDirect journal homepage: /locate/cose A Permission verification approach for android mobile applications Dimitris Geneiatakis a, *, Igor Nai Fovino a, Ioannis Kounelis a,b, Paquale Stirparo a,b a Institute for the Protection and Security of the Citizen, Joint Research Centre (JRC), European Commission, Ispra, VA, Italy b Royal Institute of Technology (KTH), Stockholm, Sweden a r t i c l e i n f o a b s t r a c t Article history: Mobile applications build part of their security and privacy on a declarative permission Received 2 January 2014 model. In this approach mobile applications, to get access to sensitive resources, have to Received in revised form define the corresponding permissions in a manifest. However, mobile applications may 6 October 2014 request access to permissions that they do not require for their execution (over-privileges) Accepted 14 October 2014 and offer opportunities to malicious software to gain access to otherwise inaccessible re- Available online 7 November 2014 sources. In this paper, we investigate on the declarative permissions model on which se- curity and privacy services of Android rely upon. We propose a practical and efficient Keywords: permission certification technique, in the direction of risk management assessment. We Android combine b