Title

PINPOINT: Efficient and Effective Resource Isolation for Mobile Security and Privacy

Author(s)/Creator(s)

Paul Ratazzi, Syracuse UniversityFollow
Ashok Bommisetti, Syracuse University
Nian Ji, Syracuse University
Wenliang Du, Syracuse University

Document Type

Conference Document

Date

Spring 5-21-2015

Keywords

android, security, privacy, isolation, virtualization

Language

English

Disciplines

Computer and Systems Architecture | Electrical and Computer Engineering | Information Security

Description/Abstract

Virtualization is frequently used to isolate untrusted processes and control their access to sensitive resources. However, isolation usually carries a price in terms of less resource sharing and reduced inter-process communication. In an open architecture such as Android, this price and its impact on performance, usability, and transparency must be carefully considered. Although previous efforts in developing general-purpose isolation solutions have shown that some of these negative sideeffects can be mitigated, doing so involves overcoming significant design challenges by incorporating numerous additional platform complexities not directly related to improved security. Thus, the general purpose solutions become inefficient and burdensome if the end-user has only specific security goals.

In this paper, we present PINPOINT, a resource isolation strategy that forgoes general-purpose solutions in favor of a “building block” approach that addresses specific end-user security goals. PINPOINT embodies the concept of Linux Namespace lightweight isolation, but does so in the Android Framework by guiding the security designer towards isolation points that are contextually close to the resource(s) that need to be isolated. This strategy allows the rest of the Framework to function fully as intended, transparently. We demonstrate our strategy with a case study on Android System Services, and show four applications of PINPOINTed system services functioning with unmodified market apps. Our evaluation results show that practical security and privacy advantages can be gained using our approach, without inducing the problematic side-effects that other general-purpose designs must address.

Additional Information

This work is licensed CCBYSA 4.0

Recommended Citation

Ratazzi, Paul; Bommisetti, Ashok; Ji, Nian; and Du, Wenliang, "PINPOINT: Efficient and Effective Resource Isolation for Mobile Security and Privacy" (2015). Electrical Engineering and Computer Science - All Scholarship. 251.
https://surface.syr.edu/eecs/251