【作者】 张源；

【导师】 臧斌宇；

【作者基本信息】 复旦大学 ， 计算机系统结构， 2014， 博士

【摘要】 互联网技术的进步推动了计算模型的深刻变革。继云计算之后,移动计算是现如今炙手可热的新型计算模型。通过移动互联技术,移动设备可以方便地接入互联网,这使得传统在移动终端上难以满足的复杂计算需求可以便捷地转移到云平台中。与此同时,移动设备提供的强大编程能力以及便携的特点,极大丰富了移动互联计算能够带来的服务。基于对移动智能终端飞速发展的前景预期,IT工业界各大巨头如谷歌、苹果、微软均推出自己的移动智能终端平台。在移动计算中,得益于开源、免费特性的安卓平台在全球范围内获得了巨大的成功,目前已广泛应用于日常消费领域、企业领域、政府及军队、汽车、工业制造等领域。随着安卓平台在关系到国计民生的各个领域发挥越来越大的作用,其安全性问题变得不容忽视。目前,安卓平台恶意软件泛滥、软件漏洞层出不穷,安全性增强技术已经成为安卓平台在各个领域应用中亟需研究的一个问题。然而,安卓平台在系统结构、应用分发模式、版本管理、编程模型及运行平台方面的独有特征在为安卓平台普及化助力的同时,也为安卓平台安全性增强技术的研究带来了诸多挑战,面临的突出问题有：1)海量安卓应用的分析,针对安卓应用的分析技术必须支持海量应用的自动化分析。2)多层软件栈的协同,针对安卓平台的安全性增强研究需要合理地协同Linux内核与安卓框架层来实现完备的安全性增强方案。3)灵活的部署能力,考虑到安卓版本的碎片化问题,针对安全漏洞的修复技术需要不依赖于对系统或者应用程序的修改。4)对性能的影响,由于安卓平台运行在计算能力受限的无源设备中,安全性增强研究需要兼顾到系统性能的优化技术。当前,安卓平台及其生态系统正在快速发展,针对安卓平台安全性的研究也在不断进行。现有研究主要集中在以下几个方面：1)恶意软件分析与检测,致力于通过对软件行为的分析提取代表恶意软件的行为特征,以实现对已知和未知恶意软件的检测。例如DroidScope通过在本地代码执行级别识别Java代码的执行,从而可以有效地分析安卓恶意软件中Java代码的行为。2)漏洞分析与检测,致力于通过对安卓平台编程机制的剖析,分析攻击场景并采用代码分析技术检测现有应用程序中的漏洞。例如CHEX通过数据流分析和代码切片枚举技术实现了对应用程序中组件劫持漏洞的精确检测。3)系统安全性增强,力图通过对安卓系统现有安全机制进行增强,以防范针对安卓系统和应用软件的攻击方式。例如,IPC Inspection通过引入进程通讯自省技术,可以防范应用程序间的权限委托攻击。TrustDroid提出基于域的程序隔离技术,力图保护受信任的程序不被未受信任程序攻击。然而,当前针对安卓平台安全性的研究存在着一些问题,大部分系统安全性增强工作只能部分地解决现有针对安卓系统的攻击。由于还未完全考虑到安卓系统安全机制自身存在的问题,现有工作无法有效地在系统层面对安全性进行增强,进而无法通用地防范现有针对安卓系统的多种攻击。另外,现有软件分析工作无法有效地刻画安卓软件与系统之间的敏感行为以及安卓软件内部的敏感行为。安卓平台在系统架构、编程模型等方面的独有特征使得现有方法在分析效果、分析完整性等方面效果很差。此外,安全性技术的引入会带来显著的性能开销。目前针对安全技术的研究并未完全考虑到安卓平台运行环境受限带来的对性能的挑战。本文在充分理解安卓平台特征的基础上,针对安卓平台的两大重要组成部分一应用商城和终端系统提出了系统化的安全性增强方案。本文从软件分析、系统加固和性能优化三个角度提出了增强安卓平台安全性的关键技术,即基于权限使用行为的程序安全性分析技术、基于上下文跟踪的系统安全性增强技术、基于细粒度权限框架的安全性应用研究、基于寄存器映射的系统性能优化技术。与现有研究相比,本研究借助于对安卓平台编程模型和安全机制的深入分析,从真实的安全问题出发设计出适用于应用商城和终端系统的安全性增强技术方案,测试表明这些技术可以有效地分析安卓应用软件的行为和提高安卓系统的安全性。此外,本研究提出的性能优化技术可以显著提升系统性能,弥补安全性增强技术的引入带来的性能开销,从而更好地支持这些技术在真实环境中的应用。具体而言,本文的主要贡献如下：1.首次提出了基于权限使用行为的软件安全性分析技术,设计并实现了VetDroid分析系统以完成对安卓软件行为安全性的自动化分析。VetDroid系统基于权限使用行为,通过对安卓软件的动态分析,在分析期间自动化提取软件内部与权限有关的行为,从而离线构建出软件对权限的使用行为模型。为了全面地、精确地提取软件在执行过程中对权限的使用行为,VetDroid系统设计了系统化的权限分析技术,以识别软件对权限的显式使用和隐式使用。VetDroid系统不但可以有效分析恶意软件中存在的恶意行为,还可以分析良性软件中存在的不良行为。通过对软件分析过程进行并行化,VetDroid系统平均仅需2.2分钟即可完成对一个软件的分析。2.首次提出基于上下文跟踪的系统安全性增强技术,设计并实现了FineDroid系统以支持上下文敏感的权限管理。FineDroid系统设计了系统级的上下文跟踪技术,自动地在程序执行过程中跟踪上下文信息。FineDroid系统中的上下文信息不但包括单个应用程序内部的执行上下文,还包括多个协作应用程序之间的交互上下文。为了支持上下文信息在程序执行过程的无缝传播,FineDroid重点解决了上下文信息在程序组件交互、线程交互以及事件交互过程中的传播。为了实现灵活的权限控制,FineDroid系统设计了一套规则语言以描述上下文敏感的权限管理策略。FineDroid系统可以对程序中使用权限的行为进行灵活和强有力的控制,从源头杜绝程序对权限的滥用,从而提升系统的安全性。3.首次基于上下文敏感的细粒度权限框架进行安全性增强应用的研究,面向终端用户、系统管理员和应用开发者设计并实现了三个安全性增强系统。Aurasuim+系统提供给终端用户即时权限授予的能力。通过Aurasuim+,用户可以将每一次权限授予的决定与当时应用程序的使用场景进行关联,从而一方面可以有效地识别应用程序申请权限的目的,另一方面降低对用户的干扰。DroidFence系统提供给系统管理员自动化修复权限泄露漏洞的方法。基于DroidFence,系统管理员可以通过添加规则的方式在不修改任何应用程序和安卓系统的前提下,修复应用中存在的权限泄露漏洞。CompJail系统提供应用开发者划分程序内部细粒度权限沙箱的能力。应用开发者可以对内嵌的第三方代码插件进行单独的权限控制,从而实现对未验证的代码插件进行限制。4.首次提出基于寄存器映射的系统性能优化技术,设计并实现了Swift即时编译系统,在不牺牲生成代码质量的前提下完成对Java方法的轻量级动态编译。Swift系统针对采用虚拟寄存器的Java字节码,基于Java程序在使用虚拟寄存器时的特性,发现超过90%的Java方法使用不超过11个虚拟寄存器。由于目前安卓设备大多运行在基于RISC架构的ARM处理器上,而ARM处理器具有丰富的物理寄存器资源。Swift系统通过将物理寄存器直接映射到虚拟寄存器实现快速的寄存器分配。此外,由于在将Java代码编译到基于虚拟寄存器的字节码时已经使用了近乎最优的寄存器分配算法,因此通过寄存器映射生成的二进制代码具有较高质量的寄存器使用策略。实验证明,与安卓原有的即时编译系统相比,Swift系统可以在引入很小的内存增长的情况下,系统性能提升比达到40%。更多还原

【Abstract】 Mobile computing is currently the most popular computing wave. With the development of wireless internet, complex computations that previously can’t be afforded by mobile platform can be conveniently migrated to cloud. Meanwhile, the rich hardware facilities together with powerful programmability of mobile platform have brought dramatic experience and flexibility. In mobile computing, Android platform has been expanding its market share as the most popular platform in the world wide. Currently, it has been applied to consumer devices, enterprise, government, military, automobiles, manufacturing, etc.As the wide application of Android-powered devices to all areas of our life, one indispensable requirement of Android platform is the security of the system itself as well as the applications. However, Android ecosystem is now facing severe security threats, such as widespread malware, frequently reported vulnerabilities. Due to some specific features of Android platform, several challenges are faced when improving the security of Android platform, such as:1) security analysis of massive applications, which requires automatic analysis of application behavior; 2) coordination of multi-layer software stacks, which requires the security extension should protect resources in all software layers; 3) flexible deployment, which demands vulnerability patches distributed transparently to fragmented Android versions; 4) performance impact, that should be considered in applying security extensions practically.Generally, previous research efforts in Android security can be categorized into three aspects:1) Malware analysis and detection, which investigates techniques to figure the sensitive behavior of Android applications and extract significant malicious behavior fingerprints for detecting already-known and zero-day malware samples. For example, DroidScope proposes a technique to reconstruct Java behaviors at the level of native code execution, which contributes to comprehension of Android application behavior; 2) Vulnerability analysis and detection, which explores unknown threats to Android system and designs techniques to detect such flaws. For example, CHEX points out the flaws in component interaction, and combines data flow analysis with code split enumeration technique to achieve automatic and accurate detection of such vulnerabilities; 3) System security hardening, by retrofitting current security mechanism to support new paradigm of security service from the system layer. For example, TrustDroid introduces trust domain concept to protect trusted applications by forbidding interactions from untrusted applications.However, there are still several problems in current Android security research area. Most system hardening efforts usually focus on a separate security problem and always lack flexibility. Current work have not well observed the flaws in the security mechanism itself, while trying to fix exposed security problems one by one. For example, IPC Inspection only prevents improper permission use through application interaction, while Compac only prevents improper permission use via in-application attack. Besides, current behavior analysis work could not effectively figure sensitive behaviors inside applications as well as interactions between application and system, due to not considering the new programming model and security mechanism in Android. Additionally, security improvements always come with a price. Performance penalty is the most important problem to solve when applying security techniques to real world, while this part is less addressed in existing security research.Based on the detailed analysis of Android platform and its specific features, this dissertation proposes practical and systematic solutions to improve the security of Android platform for both its two main components:application market and end system. These solutions are invented to address limitations of current security research in Android from various aspects, i.e. from application security analysis to system security enhancement, and from security application design to system performance optimization.Specifically, the proposed solutions are composed of the following key techniques and systems that solve different difficulties:1. Practical and effective behavior analysis of Android applications by introducing systematic permission use analysis. Design and implementation of VetDroid system based on the idea. VetDroid system performs dynamic analysis and automatically collects permission-sensitive behaviors during the analysis, including explicit and implicit permission use behaviors. To cope with specific features of Android, VetDroid crafts several techniques to achieve complete permission use identification and accurate permission information extraction. As a general behavior analysis technique, VetDroid could not only analyze internal behaviors of malware samples, but also vet undesirable behaviors inside benign applications.2. General and flexible security hardening of Android system by proposing application context tracking. Design and implementation of FineDroid system based on the idea. Along with the application execution, FineDroid system automatically tracks the application context which is composed of two parts: intra-application context and inter-application context. By retrofitting key components of Android system, FineDroid provides strong guarantee in context tracking and such tracking is seamless. Combining with a policy-driven framework, FineDroid achieves flexible and context-sensitive regulations over the permission usage. The policy framework is designed to be extensible to support new applications built upon FineDroid.3. Three security applications based on FineDroid to provide different security benefits for end-users, administrators and developers. Aurasuim+ system provides in-context permission granting for end-users to balance security and usability. DroidFence technique enables administrators to transparently fix security vulnerabilities without modifying system nor applications, rendering appealing flexibility in deployment. CompJail system provides developers with the ability to declare fine-grained permission specifications to isolate untrusted in-app third-party code components.4. Lightweight and effective performance optimization of Android system by presenting register mapping based Just-In-Time compilation. Design and Implementation of Swift system based on the idea. With the observation that more than 90% Java methods use no more than 11 virtual registers, Swift performs one-to-one mapping from virtual register to physical registers to achieve fast register allocation. By exploiting the similarity between register-based bytecode and register-based processor, Swift efficiently generates code with good quality. Compared with the state-of-the-art technique, Swift achieves a further performance speedup of 40%.更多还原