University of Nebraska - Lincoln DigitalCommons@University of Nebraska - Lincoln Computer Science and Engineering: Theses, Computer Science and Engineering, Department of Dissertations, and Student Research Spring 4-2015 REMOTE MOBILE SCREEN (RMS): AN APPROACH FOR SECURE BYOD ENVIRONMENTS Santiago Manuel Gimenez Ocano University of Nebraska-Lincoln, [email protected] Follow this and additional works at: http://digitalcommons.unl.edu/computerscidiss Part of the Digital Communications and Networking Commons, and the Hardware Systems Commons Gimenez Ocano, Santiago Manuel, "REMOTE MOBILE SCREEN (RMS): AN APPROACH FOR SECURE BYOD ENVIRONMENTS" (2015). Computer Science and Engineering: Theses, Dissertations, and Student Research. 86. http://digitalcommons.unl.edu/computerscidiss/86 This Article is brought to you for free and open access by the Computer Science and Engineering, Department of at DigitalCommons@University of Nebraska - Lincoln. It has been accepted for inclusion in Computer Science and Engineering: Theses, Dissertations, and Student Research by an authorized administrator of DigitalCommons@University of Nebraska - Lincoln. REMOTE MOBILE SCREEN (RMS): AN APPROACH FOR SECURE BYOD ENVIRONMENTS by Santiago Gimenez Ocano A THESIS Presented to the Faculty of The Graduate College at the University of Nebraska In Partial Fulfillment of Requirements For the Degree of Master of Science Major: Computer Science Under the Supervision of Professor Byrav Ramamurthy Lincoln, Nebraska April, 2015 REMOTE MOBILE SCREEN (RMS): AN APPROACH FOR SECURE BYOD ENVIRONMENTS Santiago Gimenez Ocano, M.S. University of Nebraska, 2015 Adviser: Byrav Ramamurthy Bring Your Own Device (BYOD) is a policy where employees use their own personal mobile devices to perform work-related tasks. Enterprises reduce their costs since they do not have to purchase and provide support for the mobile devices. BYOD increases job satisfaction and productivity in the employees, as they can choose which device to use and do not need to carry two or more devices. However, BYOD policies create an insecure environment, as the corporate net- work is extended and it becomes harder to protect it from attacks. In this scenario, the corporate information can be leaked, personal and corporate spaces are not sep- arated, it becomes difficult to enforce security policies on the devices, and employees are worried about their privacy. Consequently, a secure BYOD environment must achieve the following goals: space isolation, corporate data protection, security policy enforcement, true space isolation, non-intrusiveness, and low resource consumption. We found that none of the currently available solutions achieve all of these goals. We developed Remote Mobile Screen (RMS), a framework that meets all the goals for a secure BYOD environment. To achieve this, the enterprise provides the employee with a Virtual Machine (VM) running a mobile operating system, which is located in the enterprise network and to which the employee connects using the mobile device. We provide an implementation of RMS using commonly available software for an x86 architecture. We address RMS challenges related to compatibility, scalability and latency. For the first challenge, we show that at least 90.2% of the productivity applications from Google Play can be installed on an x86 architecture, while at least 80.4% run normally. For the second challenge, we deployed our implementation on a high-performance server and run up to 596 VMs using 256 GB of RAM. Further, we show that the number of VMs is proportional to the available RAM. For the third challenge, we used our implementation on GENI and conclude that an application latency of 150 milliseconds can be achieved. iv ACKNOWLEDGMENTS To my advisor, Dr. Byrav Ramamurthy, for his continued support, encouragement and guidance. Being his student and advisee has been inspiring and a privilege from the very first day. My research topic was suggested by him while I was a student in his Data and Network Security class, which was the most influential class I have taken. I would also like to thank Dr. Yong Wang, from Dakota State University, for his continuous help and advice on my research. His suggestions and comments helped my research greatly. I am also thankful to the members of my MS Thesis committee, Dr. Witawas Srisa-an and Dr. David Swanson for their service and reviewing my thesis. Their feedback and suggestions helped me improve this work. A note of thanks to the members of the Networking Lab. I would specially thank Adrian Lara, Sara El Alaoui and Pan Yi. I would also like express my gratitude to Rigoberto Wong for all his help. Part of this work was performed on computers from the Holland Computing Cen- ter. I am thankful to its director, Dr. David Swanson, and Garhan Attebury for allowing me the use of these assets as well as for helping me. Finally, I would like to thank my love, Nicole, my parents and my sister for their love, support and understanding. This research was partially supported by a National Science Foundation (NSF) Grant No. CNS-1345277. My education at UNL was supported by the Argentinian Presidential Fellowship coordinated by Fulbright Commission in Argentina and Jefatura the Gabinete de Ministros de la Republica Argentina. v Contents List of Figures vii List of Tables ix List of Acronyms x 1 Introduction 1 1.1 Description of BYOD . 2 1.2 Contribution . 4 1.3 Outline of Thesis . 5 2 Background 6 2.1 Threats on Mobile Devices . 6 2.2 Security Challenges Related to BYOD Environment . 14 2.3 Goals for a Secure BYOD Environment . 15 3 Related Work 19 3.1 Mobile Virtual Machine (MVM) . 20 3.2 Agent-based Solutions . 25 3.3 Cloud-based Solutions . 36 3.4 Virtual Private Network (VPN) . 43 vi 3.5 Trusted Environments . 47 3.6 Framework . 52 3.7 Comparison of Solutions . 61 4 Remote Mobile Screen (RMS): Description and Experiments 65 4.1 BYOD Security Framework (BSF) . 65 4.2 Architecture presented by RMS . 68 4.3 Session Initiation and Termination . 72 4.4 Features Offered by RMS . 73 4.5 Implementation . 75 4.6 Security Analysis . 77 4.7 Challenges Presented by RMS . 79 4.8 Compatibility, Scalability and Latency Experiments . 86 5 Conclusion and Future Work 111 5.1 Conclusions . 111 5.2 Directions for Future Work . 113 A List and Description of Mobile Applications Tested in the Usability Experiment 115 B Scripts Used in the Scalability Test 118 C Scripts Used in the Latency Test 122 Bibliography 129 vii List of Figures 1.1 Representation of a BYOD environment. 2 2.1 Flow of a malware attack on mobile devices. 7 3.1 Taxonomy of BYOD solutions. 19 4.1 BSF’s architecture. 67 4.2 RMS architecture. 69 4.3 Implementation using an Apple iPhone 5S accessing Android-x86 as cor- porate space. 76 4.4 Implementation using an Apple iPad Mini accessing Android-x86 as cor- porate space. 77 4.5 Implementation using a Samung Focus accessing AndroVM as corporate space. 77 4.6 Results of compatibility experiment. 87 4.7 RAM usage as a function of the number of concurrent Virtual Machines (VMs). 90 4.8 CPU usage as a function of the number of concurrent VMs. 91 4.9 Load of the system as a function of the number of concurrent VMs. 92 4.10 Number of threads as a function of the number of concurrent VMs. 92 viii 4.11 Start Time as a function of the number of concurrent VMs. 93 4.12 Restart Time as a function of the number of concurrent VMs. 94 4.13 Number of concurrent VMs as a function of the available RAM. 94 4.14 Distribution and order of the clients across the country. 96 4.15 Application delay as a function of the number of concurrent clients, and its regression curve. 98 4.16 Average of the application delay for each of the clients. 98 4.17 Application delay as a function of ping delay for single clients and multiple clients. 99 4.18 Distribution of the clients across the country. 101 4.19 Average of the application delay for each of the clients for single server and multiple servers. 101 4.20 Application delay as a function of ping delay for single clients and multiple clients, for Kettering University server. 102 4.21 Application delay as a function of ping delay for single clients and multiple clients, for UCLA server. 103 4.22 Application delay as a function of ping delay for single clients and multiple clients, for Georgia Tech server. 104 4.23 Average of the application delay for different values of δ. 108 ix List of Tables 2.1 Percentage of corporate accessed data. 11 2.2 Percentage of personal accessed data. 11 3.1 Comparison between the different types of MDM solutions. 35 3.2 Comparison between different consumer-oriented cloud-based solutions. 42 3.3 Comparison between the different type of solutions based on their type, goals they achieve and support for mobile OSes. 62 3.4 Comparison between the different type of solutions based on their type, goals they achieve and support to mobile OSes (contd.). 63 4.1 List of clients used in the first latency experiment. 97 4.2 Ping delay of each client to each server for the third scenario. 100 4.3 List of clients used in the fourth latency experiment. 106 4.4 Ping delay of each client to each server for the fourth scenario. 107 4.5 Average application delay in seconds provided by the OPL/CPLEX and the Matlab simulations. 109 A.1 List of mobile applications analyzed. 116 A.2 List of mobile applications analyzed (contd.). 117 x List of Acronyms 2TAC 2-Tier Access Control. BSF BYOD Security Framework. BYOD Bring Your Own Device. EEM Enterprise Mobility Management.