MacDroid一种Android轻量级内核层强制访问控制框架.PDFVIP

第 44 卷第11A 期 Vo l. 44 No. 11A 计算机科学 2017 年 11 月 COMPUTER SCIENCE Nov.2017 MacDroid: 一种 Android 轻量级内核层强制访问控制框架 李尼格马攘攘陈牧陈璐徐敏 (全球能源互联网研究院信息通信研究所 南京 210003) 摘 要 智能移动终端已成为移动互联网时代重要的信息处理平台，其面临的安全威胁越来越严重，针对传统计算机 的安全防护架构已无法适应智能移动终端安全防护的特殊需求。通过对智能移动终端操作系统的特点和层次进行分 析，设计了一种轻量级内核层强制访问控制框架 MacDroid ，深入研究了 MacDroid 的安全策略定义、安全策略编 译、安全策略实施等关键问题。提出了 MacDroid 的安全策略描述语言 PSL，对 PSL 的词法和语法进行了形式化 定义。最后通过实验测试了 MacDroid 访问控制框架对智能移动终端不同层的恶意软件行为的控制效果。实验结果 表明，MacDroid 框架对Android 智能移动终端应用层、本地层和内核层的恶意软件行为均有较好的控制效果。 关键词 安卒，内核，强制访问控制，恶意软件检测 中固法分类号 TP309 文献标识码 A MacDroid:A Lightweight Kemel-level Mandatory Access Control Framework for Android LI Ni-ge MA Yuan-yuan CHEN Mu CHEN Lu XU Min CInstitute of Information and Communication ,Global Energy Interconnection Research Institute ,Nanjing 210003 ,China) Abstract Smart terminal has become an important information processing platform in the mobile Internet era ,and its security threats are becorning more and more serious. The security protection architecture for traditional computers has been unable to meet the special needs of smart terminal security protection. By analyzing the characteristics and levels of the smart terminal operating system ,a lightweight kernel-level mandatory access control framework(MacDroid) was de- signed. The key issues of MacDroid security policy definition ,security policy compilation ,security policy implementation and so on were deeply studied in this pape乙 The MacDroid security policy description language(PSL) was proposed and the PSL lexical and gr缸nrnar formal definition were given. Finally ,the effect of MacD