移动用户隐私保护机制若干技术研究

发布时间：2018-02-16 11:05

本文关键词： 移动用户隐私保护访问控制灰名单权限削减　出处：《宁波大学》2014年硕士论文　论文类型：学位论文

【摘要】：移动互联网和智能终端设备改变了人们的生活生产方式，越来越多的移动用户已经习惯使用智能终端处理自己的生活事务、社交关系和商业信息，因而产生了大量的用户隐私数据。从传统的PC平台到现在的移动平台，隐私保护一直是安全领域的研究重点和难点，用户隐私的潜在商业价值和移动平台无缝式数据访问机制，让用户隐私面临空前的安全威胁。在现有移动互联网环境下，，维系一个纯净的、安全的移动终端环境变得极其困难，现有的隐私保护机制也无法满足快速的社会移动化进程。本文从移动用户隐私数据特征和面临的威胁出发，结合移动平台系统框架和安全机制，对移动用户隐私数据保护机制进行研究，具体内容如下： (1)分析现有移动系统平台资源访问管理模型和应用权限授予模式的优缺点，根据现有的资源管理框架和移动平台理念，总结归纳出易拓展的隐私数据访问控制框架MDAC。此框架可根据某些特定场景，结合特定系统框架拓展实现一套更为完善和实际可行的用户隐私保护方案。 (2)针对Android平台粗粒度权限授予模型的缺点，在Android组件式交互模型的基础上，提出了基于灰名单的用户隐私数据保护方案。该方案在原有权限授予和审核的基础上，添加应用是否用户可信的强制访问控制框架，进一步确保隐私数据的安全性。 (3)在工作一的基础上，结合诸多学者提出的应用安全等级评价方法和应用恶意度评估机制，在Android系统环境中实现信任阈值可设定的隐私数据保护方案，在系统资源管理模块中添加数据访问请求代受理模块，对低于用户设定的信任阈值的数据访问请求者提供虚假服务，以保证隐私数据的安全。 (4)针对Android应用间数据通信缺少的隐私监管机制，制定应用交互权限削减机制，以防御应用协同攻击和权限提升攻击。同时将已安装应用抽象成有向图中的节点，比拟应用间的信息交互，着重探讨权限削减机制下应用权限集合表示和存储方案，并进一步对应用交互图进行简化。根据提出的研究和改进方案，本文针对开放的Android系统作为实验环境进行了方案实现和评估。通过对方案实现结果的评估分析，表明本文所提出的方案能够针对特定的场景和平台获得期望的结果，并且可以在真实环境中部署实施。
[Abstract]:The mobile Internet and smart terminal devices have changed the way people live, and more and more mobile users have become accustomed to using smart terminals to handle their own life affairs, social relationships and business information. From the traditional PC platform to the current mobile platform, privacy protection has been the focus and difficulty of security research, the potential commercial value of user privacy and the seamless data access mechanism of mobile platform. Make user privacy face unprecedented security threat. In the current mobile Internet environment, it becomes extremely difficult to maintain a pure, secure mobile terminal environment. The existing privacy protection mechanism can not meet the rapid social mobility process. Based on the features and threats of mobile user privacy data, this paper combines the mobile platform system framework and security mechanism. The research on privacy data protection mechanism of mobile users is as follows:. 1) analyzing the advantages and disadvantages of the existing mobile system platform resource access management model and application privilege granting model, according to the existing resource management framework and mobile platform concept, In this paper, an extensible privacy data access control framework (MDAC) is summarized. This framework can implement a more perfect and practical user privacy protection scheme according to some specific scenarios and the extension of specific system framework. Aiming at the shortcomings of the coarse-grained permission granting model of Android platform, a scheme of user privacy data protection based on grey list is proposed on the basis of Android component-based interactive model, which is based on the original authority grant and verification. Add a user-trusted mandatory access control framework to further ensure the security of private data. 3) on the basis of work 1, combined with the application security grade evaluation method and the malice degree evaluation mechanism proposed by many scholars, the privacy data protection scheme which can set the trust threshold in Android system environment is realized. The data access request processing module is added to the system resource management module to provide false service to the data access requester who is below the trust threshold set by the user, so as to ensure the security of the privacy data. 4) aiming at the lack of privacy supervision mechanism in data communication between Android applications, an interactive privilege reduction mechanism is developed to protect against application cooperative attacks and privilege escalation attacks. At the same time, the installed applications are abstracted into nodes in the directed graph. Compared with the information interaction between applications, this paper focuses on the representation and storage scheme of the application permission set under the privilege reduction mechanism, and further simplifies the application interaction graph. According to the proposed research and improvement scheme, this paper implements and evaluates the open Android system as the experimental environment. It is shown that the proposed scheme can obtain the desired results for specific scenarios and platforms and can be deployed in real environment.
【学位授予单位】：宁波大学
【学位级别】：硕士
【学位授予年份】：2014
【分类号】：TP393.08

【共引文献】