A Proposed Framework for Enhancing Security and Privacy on Unmodified Mobile Operating Systems Brian Krupp, Nigamanth Sridhar, and Wenbing Zhao Electrical and Computer Engineering Cleveland State University Email: b.krupp@vikes.csuohio.edu, {n.sridhar1,w.zhao1}@csuohio.edu Abstract—Mobile device utilization continues to experience considerable growth and the privacy and security of these devices are becoming more critical with their continued rise in utilization. In this paper, we discuss the components of a mobile device that require enhancements in the security and privacy controls that are inherent in modern mobile operating systems. We then propose a policy that can be used to provide the semantics of defining additional security and privacy controls. From this policy, we propose a framework that can be utilized by an application to enforce a user-defined policy while taking into account the computing constraints of a mobile platform. We then evaluate the results of implementing a limited prototype of this framework and demonstrate its effectiveness in enforcing a user- defined policy. I. I NTRODUCTION Traditional computing platforms have a significant ad- vantage over mobile platforms in that they typically have more processing power, memory capacity, and an unlimited supply of power. Even with these advantages, the resource consumption of software security systems such as antivirus and intrusion detection have a negative impact on the user experience. With a tighter constraint on resources in mobile platforms, traditional security systems are not an option and it is even more critical to not affect the user experience on these systems. Any security system for a mobile platform must be cognizant of the limited resources available. With these resource constraints, there is a lack of essential security and privacy controls on mobile platforms and exploita- tion of these devices is becoming more prevalent and expected to grow. For example one study found that mobile malware family count rose from 6 in January 2011 to 67 by January 2012 [1]. Another study found 11,138 malware samples in 2010 and 28,472 samples in 2011, a 155% increase over one year [2]. Additionally in malware discovered in Google Play, 322 of the samples reported zero-day vulnerabilities between September and October of 2011 [3]. Contributing to this rise is the focus on mobility where smartphones began to outsell personal computers in 2011 [1]. The growth of malware on mobile devices and their rise in utilization are requiring stronger security and privacy controls to reduce the risk of exploitation on these devices. Mobile devices by their very nature pose additional security and privacy risks as well. These devices are equipped with sensors not typically found on traditional platforms including GPS, accelerometer, camera, sound recording, and more. These sensors along with the ability to share data at virtually any location present more risk than traditional computing platforms by allowing privacy leakage to be more frequent. Additionally, the controls that are available on these platforms do not provide more fine-grained policies to be defined. For example, if a user permits a weather application in iOS to use their location they are unable to provide additional policies around the permission of using that location such as the permitted accuracy. A more fine grained policy for location would allow the user to specify a policy that the application can use a general location that anonymizes their exact location but still provides valuable data to the consuming application. These fine grained policies lack in today’s modern mobile operating systems. In the following sections we identify and discuss the pri- vacy and security sensitive components that warrant additional controls. From these components, we then present a model to define the policy to protect these sensitive components. We then propose a framework that will provide the additional security and privacy controls that a user would seek, verify the trustworthiness of an application, and efficiently utilize the available computing resources and power available of a mobile platform. This framework in addition will not require modification to the mobile operating system which has been a common requirement in recent research to provide additional security and privacy controls [4]–[6]. Finally, we will evaluate the effectiveness of a limited prototype of the framework in implementing the user-defined policies. II. POLICY MODEL To provide the user with more fine grained security and privacy controls, we need a well-defined policy model that can be used by the framework. In this section we define the policies that will be utilized for security and privacy sensitive components and define the model that will contain these policies. To categorize these components, we define them as either having a privacy or security context. Within a privacy context, we further categorize components with the categories of sensors, multimedia, or a generic category of other privacy data. With security, we further categorize the components into communication, data persistence, and credentials. A. Privacy Each component within the privacy category will inherit general characteristics of privacy data. For these additional policies we included the following permissions to be set by a user: Data Accessible, Allow to Send Over Communication Link, and Allow to Persist Locally. Data being accessible by an application is enforced in popular mobile operating systems today however on a per