Bring Your Own Device, Securely

Bring Your Own Device, Securely

A. Armando, G. Costa, A. Merlo, L. Verderame

28th Symposium On Applied Computing (SAC 2013)

Security Track

Agenda

I

BYOD paradigm, Android and Users;

I

Formal reasoning about Android;

I

Type and Effect System for Mobile Apps;

I

Writing and verifying BYOD policies;

The BYOD paradigm on mobile

I

The Bring Your Own Device paradigm pushes the use of

personal devices inside organizations.

I

BYOD solutions must both

1.

allow users to freely personalize devices outside the

organization;

2.

grant the security of corporate data accessed by personal

devices inside the organization.

I

Mobile OSes do not have the sufficient level of protection

Android, Security and Users

Manifests and Apps

I

Android applications come up

with a manifest file, containing

required permissions.

I

Users must accept at install time

all the required permissions.

I

Do users understand both the

meaning and the impact of such

permissions on their

Android and BYOD

Device owner

Personal Device

BYOD Policy:

« devices cannot access the network after accessing local file system in the same session»

A1, A2, , AN Corporation App market - Internet - Access SD card Manifest of AX - Access SD card Manifest of AY

BYOD through secure meta-markets

Manifests and Apps

BYOD Policy Require AY

Programming Framework

Extension of Featherweight Java (FJ) with Android

app-to-system

and

app-to-app

security sensitive interactions

L

::=

class C extends C

0

{

¯

_{D ¯}

_f

_;

_{K ¯}

_M}

_Class

K

::=

C

(

¯

D ¯

x

)

{super

(

x

¯

) ;

this

.

¯

_f

_:=

_¯

_x

_;

_}

_Constructor

M

::=

C m

(

D x

)

{return

E

;

}

Method

E

::=

null

|

u

|

x

|

new C

( ¯

E

)

|

E

.

f

|

Expressions

E

.

m

(

E

0

)

|

system

_σ

E

|

E

;

E

0

|

(

C

)

E

|

if

(

E

=

E

0

)

{

E

tt

}

else

{

E

ff

} |

thread

{

E

}

in

{

E

0

} |

A simple example

class Browser extends Receiver

{

Browser

()

{

super

();

}

void

receive

(

I

www

i

)

{

return

system

connect

i

.

data

;

}

}

class Game

{

Game

()

{

super

();

}

void start

()

{

return

system

read

∼

/sav

;

if

(

UsrAct

=

TouchAD

)

then

{

icast I

www

(”

http

:

//

ad

.

com

”)

;

}

else

{

/

∗

...

play

...

∗

/

system

write

∼

/sav

;

}

;

}

Operational Semantics (Fragment)

Small steps semantics:

ω,

E

→

ω

,

E

(

SYS

)

ω,

system

u

→

ω

·

σ

(

u

)

,

null

(

METH

)

mbody

(

m

,

C

) =

x

,

E

ω,

(

new C

(¯

v

))

.

m

(

v

)

→

ω,

E

[

v

/

x

,

(

new C

(¯

v

))

/

this

]

(

EXPC

)

new

C

(¯

v

)

∈

receiver

(

α

)

ω,

ecast C

I

(

u

)

→

ω,

(

new

C

(¯

v

))

.

receive

(

I

(

u

))

(

IMPC

)

new

C

(¯

v

)

∈

receiver

(

α

)

ω,

icast

I

(

u

)

→

ω,

new

C

(¯

v

)

.

receive

(

I

(

u

))

(

DATA

)

ω,

I

(

v

)

.

data

→

ω,

v

History Expressions

I

Syntax

H

,

H

::=

ε

|

h

|

α

u

)

|

α

¯

h

.

H

|

σ(

u

)

|

H

·

H

|

H

+

H

|

H

k

H

|

µ

h

.

H

I

Semantics

σ(

u

)

−−−→

ε

α

(

u

)

−−−−→

ε

H

−−−−→

H

_H

˙

₌

P

H

_{

_α

(

u

)/

h

}

s.t.

α

¯

h

.

H

∈

ρ

(

α

)

and

χ

<

C

H

−

→

_H

˙

H

₋

_→

_H

H

k

H

−

→

H

k

H

H

−

→

H

H

k

H

−

→

H

k

H

H

−

→

H

H

·

H

−

→

H

·

H

H

−

→

H

H

+

H

₋

_→

_H

H

−

→

H

H

+

H

₋

_→

_H

H

{

µ

h

.

H

/

h

}

−

→

H

µ

h

.

H

−

→

H

Type and Effect System

I

Types and type environment

τ, τ

::=

1

| U | I

(

U

)

|

C

Γ

,

Γ

::=

∅ |

Γ

{

τ /

x

}

Γ

`

E

:

τ .

H

I

Typing rules

(

T

−

SYS

)

Γ

`

E

:

U

.

H

Γ

`

system

E

:

1

.

H

·

P

σ(

u

)

(

T

−

INT

)

Γ

`

E

:

U

.

H

Γ

`

E

:

τ .

H

Γ

`

I

(

E

,

E

) :

I

(

U

, τ

)

.

H

·

H

(

T

−

IMPC

)

Γ

`

E

:

I

(

U

)

.

H

Γ

`

icast

E

:

1

.

H

·

P

α

(

u

)

(

T

−

EXPC

)

Γ

`

E

:

I

(

U

)

.

H

Γ

`

ecast C

E

:

1

.

H

·

P

α

(

u

)

Type and Effect System: Properties

Lemma

For each closed (i.e., without free variables) expression E ,

environment

Γ

, history expression H, type

τ

and trace

ω

, if

Γ

`

E

:

τ .

H then either E is a value or

ω,

E

→

ω

0

,

E

0

(for some

ω

0

,

E

0

).

Theorem

For each closed expression E , history expression H, type

τ

and

trace

ω

, if

∅ `

E

:

τ .

H and

·

,

E

→

∗

ω,

E

0

then there exist H

0

and

Security Policies

Policies language = Hennessy-Milner Logic (HML with negation and

parametric actions)

ϕ, ϕ

::=

tt

| ¬

ϕ

|

ϕ

∧

ϕ

| h

σ

( ˙

x

)

i

.ϕ

Validation of history expressions against policies (

H

|

=

ϕ

)

H

|

=

tt

(true)

H

|

=

¬

ϕ

⇐⇒

H

6|

=

ϕ

(negation)

H

|

=

ϕ

∧

ϕ

⇐⇒

H

|

=

ϕ

and

H

|

=

ϕ

(conjunction)

H

|

=

h

σ

(

u

)

i

.ϕ

⇐⇒

H

−−→

H

and

H

|

=

ϕ

(c-diamond)

Policy compliance in our Example

Assumptions:

I

H

=

read

(

∼

/

sav

)

·

(

www

(”

http

:

//

ad

.

com

”) +

write

(

∼

/

sav

))

I

ϕ

=

h

read

(

x

)

i

.

h

connect

(

y

)

i

.

ff

.

I

ρ(

www

)

=

{

www

h

.

connect

(”

http

:

//

ad

.

com

”)

}

Does

H|

=ϕ

?

Proof:

read

(

∼

/

sav

)

·

(

www

?

(”

http

:

//

ad

.

com

”) +

write

(

∼

/

sav

))

|

=

h

read

(

x

)

i

.

h

connect

(

y

)

i

.

ff

⇐⇒

(a-diamond)

www

?

(”

http

:

//

ad

.

com

”) +

write

(

∼

/

sav

)

|

=

h

connect

(

y

)

i

.

ff

=

⇒

(HE choice)

www

?

(”

http

:

//

ad

.

com

”)

|

=

h

connect

(

y

)

i

.

ff

=

⇒

(HE intent)

connect

(”

http

:

//

ad

.

com

”)

|

=

h

connect

(

y

)

i

.

ff

⇐⇒

(a-diamond)

Partial Model Checking

I

Problem: check a new application against the current device

configuration and the policy.

I

PMC allows to partially evaluate a formula against a model, using

reduction rules for

transferring information

from the model to the

formula to satisfy.

I

PMC has been originally defined for

µ

-calculus, we adapted it to HML

by redefining the operator

·

for the partial evaluation against parallel

composition:

tt

//

H

=

tt

(

¬

ϕ

)

//

H

=

¬

ϕ

//

H

(

ϕ

∧

ϕ

0

)

//

H

=

ϕ

//

H

∧

ϕ

0

//

H

(

h

σ

(

u

)

i

.ϕ

)

_//

_H

=

h

σ

(

u

)

i

.ϕ

//

H

∨

W

H

−

−−

→

H

ϕ

//

H

(

h

σ

(

x

)

i

.ϕ

)

_//

_H

=

h

σ

(

x

)

i

.ϕ//

H

∨

W

H

−

−−

→

H

ϕ

{

u

/

x

}

_//

_H

Theorem

H

|

=

ϕ

=

⇒

H

k

H

|

=

ϕ

Security Policy Manager

j

A

₁

j

//A1

j

//A1//A3

A

3

d

d

A

Device Registration phase

Install

A

Attemp to install A

I

A

1

:

UI

;

I

A

2

:

Game

;

I

A

3

:

Browser

;

Conclusion

Open Issues and Future Developments:

I

Expressiveness of policies

→

other policy languages (e.g. ConSpec);

I

inconclusive analysis and run-time policies

→

instrumenting and

monitoring of applications;

I

uninstalling applications is cumbersome

→

design solutions for inhibit

execution of non-compliant applications;

I

BYODroid works on a single BYOD policy

→

enhancements for

supporting many policies and policy switching.

THANK YOU !!!