Deepdroid: Dynamically Enforcing Enterprise Policy on Android Devices
Total Page：16
File Type：pdf, Size：1020Kb
DeepDroid: Dynamically Enforcing Enterprise Policy on Android Devices Xueqiang Wang∗y, Kun Sunz, Yuewu Wang∗ and Jiwu Jing∗ ∗ Data Assurance and Communication Security Research Center, Institute of Information Engineering, Chinese Academy of Sciences fwangxueqiang, ywwang, [email protected] yUniversity of Chinese Academy of Sciences zDepartment of Computer Science, College of William and Mary [email protected] Abstract—It is becoming a global trend for company to influence the design and usage of mobile devices in employees equipped with mobile devices to access compa- the enterprise environments. While users are blurring the ny’s assets. Besides enterprise apps, lots of personal apps lines between company and personal usage, enterprises from various untrusted app stores may also be installed demand a secure and robust mobile device management on those devices. To secure the business environment, to protect their business assets. For instance, in a building policy enforcement on what, how, and when certain apps can access system resources is required by enterprise IT. that forbids any audio recording, all mobile devices’ However, Android, the largest mobile platform with a microphones should be disabled when the users check market share of 81.9%, provides very restricted interfaces in the building and be enabled when the users check for enterprise policy enforcement. In this paper, we present out. DeepDroid, a dynamic enterprise security policy enforce- ment scheme on Android devices. Different from existing The permission model on Android, the largest mobile approaches, DeepDroid is implemented by dynamic mem- platform with a market share of 81% [2], only grants ory instrumentation of a small number of critical system an “all-or-nothing” installation option for mobile users processes without any firmware modification. DeepDroid to either accept all the permissions an app asks for or can be easily deployed on various smartphone platforms simply decline to install the app. After installation, the with a wide range of Android versions. Moreover, based on the context information extracted from Binder intercep- app can keep accessing the approved system resources tion, a fine-grained policy can be enforced. We develop a all the time. In Android 4.3, an experimental feature prototype of DeepDroid and test it on various smartphones called “App Ops” [3] is added to permit mobile users and Android versions. The experimental results show to configure one app’s runtime permissions. However, that DeepDroid can effectively enforce enterprise resource this feature has been removed from Android 4.4.2 due access policies with negligible performance overhead. to “the increasing burden for user configuration and the impacts on advertisement market” [4]. SEAndroid has I. INTRODUCTION evolved from Permissive mode in Android 4.2 and 4.3 to Enforcing mode in Android 4.4 and later to provide Nowadays, an increasing number of employees are flexible mandatory access control (MAC) mechanism in allowed to use mobile devices in workplace and con- the Linux kernel. However, until now, even the newest nect to enterprise assets. Cisco surveyed that 51% of Android 5.0 has not fully integrated MAC mechanism end users rely on smartphones to perform their daily in Android middleware [5]. Moreover, SEAndroid is business activities in 2013 [1]. This trend will continue not available on legacy systems running old versions of Android. Permission to freely reproduce all or part of this paper for non- commercial purposes is granted provided that copies bear this notice Since Android 2.2, Google provides Device Adminis- and the full citation on the first page. Reproduction for commercial tration APIs [6] to help enforce enterprise security poli- purposes is strictly prohibited without the prior written consent of the cies; however, these APIs only provide a limited set of Internet Society, the first-named author (for reproduction of an entire functionalities that vary among different Android releas- paper only), and the author’s employer if the paper was prepared within the scope of employment. es. The Mobile Device Management concept (MDM) [7] NDSS ’15, 8-11 February 2015, San Diego, CA, USA has also been introduced to enterprise administrators Copyright 2015 Internet Society, ISBN 1-891562-38-X for a long time; however, OEMs usually develop their http://dx.doi.org/10.14722/ndss.2015.23263 own proprietary MDM solutions [8], [9]. For instance, Second, it is flexible to provide fine-grained Samsung Knox provides a complete enterprise solution, enterprise-level control over each app. The enterprise including secure boot, kernel integrity checking, and administrators can dynamically update the policy rules SEAndroid [9]; however, it is only available on Samsung for each mobile device’s individual app. We cannot only devices [10]. enforce a general rule to constrain one specific service/re- source access for an app, but also achieve a context- In this paper, we propose an enterprise-level security aware access control by inspecting the communications policy enforcement mechanism called DeepDroid that between apps and service processes through Android can be easily ported on various Android devices to Binder. In this paper, we focus on providing security dynamically enforce a fine-grained system service and re- mechanisms instead of developing detailed policy rules source access control policy by enterprise administrators. given an enterprise’s security requirements. The basic idea is to apply dynamic memory instrumen- tation on the app runtime environment in Android. All Finally, it has minimal impacts on user experience. current versions of Android share a common structure DeepDroid is transparent to mobile users and supports feature that system services and resource access are location-aware automatic configuration. For instance, the controlled by a small number of system processes. Thus, enterprise policy enforcement mechanism only needs to we only need to instrument these system processes whose be enabled when a user enters the workplace; when the structures are almost the same on all Android versions. user leaves the workplace, the policy enforcement mech- DeepDroid dynamically hooks system server process in anism can be automatically disabled. Moreover, since Android and uses it as a centralized controller to enforce our mechanism only needs to instrument a very small the enterprise-level permissions when an app requests to number of critical Android processes and perform simple access a system service. It also tracks the zygote process checkings, it has negligible performance overhead. to authorize native code’s access requests. Moreover, In summary, we make the following contributions. DeepDroid can intercept the Binder interactions between apps and a few system processes to retrieve details of • We solve the portability problems of enforcing apps’ requests for a fine-grained access control. enterprise’s security policies on various Android de- DeepDroid needs root privilege to instrument and vices. Our approach is based on dynamic code instru- track system processes. It can be satisfied in a corporate mentation and process tracing, which enforce access environment where companies usually either rent or control policies in Android middleware and Linux purchase mobile devices from telecommunication com- kernel, respectively. Our system can be ported on panies and request vendors to customize the software different Android mobile devices with small changes. image before distributing the devices to employees. S- • We can achieve a fine-grained control policy over ince DeepDroid does not need to statically change the each Android app. By hooking and tracing critical Android middleware and the Linux kernel, it carries little Android components, we can extract request details to burden on vendors for device customization. better regulate one app’s operations. Thus, it enables enterprise administrators to set fine-grained policy Our enterprise-level policy enforcement solution has rules considering temporal and spatial constraints for several good properties. First, it is portable. Our solution each app. can be deployed on almost all Android mobile devices • We minimize the impacts of our mechanism on with very small customization efforts. Instead of tailoring Android system. Only a few critical processes (e.g., various Android systems from different OEMs, we use system server) need to be dynamically instrumented dynamic instrumentation and process tracing techniques in their memory spaces, and the performance overhead to hook the Android app runtime environment. The code is minimal. Also, its impacts on Android system base of our system remains largely unchanged when is temporary and can be easily removed when the deployed on different Android versions. Our solution policies are no longer desired. It is compatible with only requires minimal configuration changes in Android the existing permission mechanism. OS during the installation stage and does not need any • We develop a DeepDroid prototype and evaluate changes on any app. We have evaluated our system on a its effectiveness and efficiency on a number of main- variety of Android devices from different OEMs running stream Android devices with various Android versions. Android 2.3 through Android 4.4. The evaluation results show that DeepDroid can work 2 process ensures that supplementary groups are properly settings. For instance, it should be quickly activated set to the app process by initiating setgroups. Next, the when the user enters