DeepDroid Dynamically Enforcing Enterprise Policy Manwoong (Andy) Choi

Introduction Motivation: Company’s require a means of limiting access to resources in mobile devices belonging to employees to protect company assets.  Android  market share of 81%  “all-or-nothing” installation option  continuous access of approved permissions  Solutions  Android 4.3, experimental feature called “App Ops”  Device Administration APIs provided by Google  DeepDroid

Android Resource Access  Resource Access through Android Middleware  Resource Access through Linux kernel  Binder encapsulates inter-process communication (IPC) messages and interprets them to corresponding procedure calls  system_server acts as permission checking center with built-in permissions  Native code can bypass middleware permission checking mechanism  Group of IDs which are responsible for determining accessible resources for the app

DeepDroid  Portability  Fine Granularity  Trustworthy  Ease to Use  Solution is deployed on different Android versions and devices with minimum configuration  Various enterprise policies are supported by supervising and regulating  Access control policy rules are strictly enforced, so that no app can violate any rules  How easy the solution is deployed on different Android versions and devices

DeepDroid Enterprise Policy Center  Authenticate mobile devices  Distribute enterprise policies  Monitor mobile devices DeepDroid On-device  Device Monitor  Bridge between the mobile device and Enterprise Policy Center  Privilege Enforcement  Authorises access privilege to apps  Permission Configurator - middleware  Process Creation Guard - kernel  Context Enforcement  Monitor resource access  Trace system calls to regulate app operations  Policy Engine  Stores and maintains policy rules

Evaluations & Results Functional EvaluationPortability Evaluation Performance Evaluation

Summary  Dynamic enterprise security policy enforcement scheme on Android  Memory instrumentation  Evaluation  Portable  Negligible performance overhead

Criticism  Collusion Attack  Combination of privileges to cause malicious behavior  Communication through a covert channel  Policy rules are user defined  In report assumed to be trustworthy  May not be the case, no tracking of policies

Questions????