Bring Your Own Device, Securely

Size: px

Start display at page:

Download "Bring Your Own Device, Securely"

Reginald Hancock
8 years ago
Views:

1 A. Armando, G. Costa, A. Merlo, L. Verderame 28th Symposium On Applied Computing (SAC 2013) Security Track March 19, 2013

2 Agenda BYOD paradigm, Android and Users; Formal reasoning about Android; Type and Effect System for Mobile Apps; Writing and verifying BYOD policies; BYODroid prototype.

3 The BYOD paradigm on mobile The Bring Your Own Device paradigm pushes the use of personal devices inside organizations. BYOD solutions must both 1. allow users to freely personalize devices outside the organization; 2. grant the security of corporate data accessed by personal devices inside the organization. Mobile OSes do not have the sufficient level of protection for supporting the BYOD paradigm.

allow users to freely personalize devices outside the organization; 2.

4 Android, Security and Users Device owner Manifest of AX - Internet - Access SD card Manifest of AY - Access SD card App market Manifests and Apps Personal Device A1, A2,, AN Android applications come up with a manifest file, containing required permissions. Users must accept at install time all the required permissions. Do users understand both the meaning and the impact of such permissions on their security/privacy?

with a manifest file, containing required permissions.

5 Android and BYOD App market Corporation Manifest of AX Manifests and Apps - Internet - Access SD card BYOD Policy: «devices cannot access the network after accessing local file system in the same session» Device owner Manifest of AY - Access SD card Personal Device A1, A2,, AN

the network after accessing local file system in the same session»

6 BYOD through secure meta-markets App market Manifests and Apps Corporation Require AY BYOD Policy Approve/reject installation Personal Device Secure Meta-market A1, A2,, AN

7 Programming Framework Extension of Featherweight Java (FJ) with Android app-to-system and app-to-app security sensitive interactions L ::= class C extends C { D f; K M} Class K ::= C( D x){super( x) ; this. f := x ; } Constructor M ::= C m(d x){return E; } Method E ::= null u x new C(Ē) E.f Expressions E.m(E ) system σ E E;E (C)E if (E = E ){E tt } else {E ff } thread {E} in {E } I α (E) icast E ecast C E E.data

this. f := x ; } Constructor M ::= C m(d x){return E; } Method E ::= null u x new C(Ē) E.

8 A simple example class Browser extends Receiver { Browser() { super(); } void receive(i www i) { return system connect i.data; } } class Game { Game() { super(); } void start() { return system read /sav; if(usract = TouchAD) then {icast I www ( http : //ad.com ); } else {/...play... /system write /sav; } ; } }

data; } } class Game { Game() { super(); } void start() { return system read

9 Operational Semantics (Fragment) Small steps semantics: ω, E ω, E (SYS 2) ω, system σ u ω σ(u), null (METH 3) (EXPC 2) mbody(m, C) = x,e ω, (new C( v)).m(v ) ω, E[v /x, (new C( v))/this] new C( v) receiver(α) ω, ecast C I α(u) ω, (new C( v)).receive(i α(u)) (IMPC 2) new C( v) receiver(α) ω, icast I α(u) ω, new C( v).receive(i α(u)) (DATA 2) ω, I α(v).data ω, v

m(v ) ω, E[v /x, (new C( v))/this] new C( v) receiver(α) ω, ecast C I α(u) ω, (new C( v)).

10 History Expressions Syntax H, H ::= ε h α χ(u) ᾱ C h.h σ(u) H H H+H H H µh.h Semantics σ(u) σ(u) ε α χ(u) αχ(u) ε H αχ(u) H Ḣ = H {α? (u)/h} s.t. ᾱ C h.h ρ(α) and χ C H a H H H a H H H a H H + H a H H Ḣ H a H H H a H H H a H H + H a H H a H H H a H H H{µh.H/h} a H µh.h a H

11 Type and Effect System Types and type environment τ, τ ::= 1 U I α(u) C Γ, Γ ::= Γ{τ/x} Γ E : τ H Typing rules Γ E : U H (T SYS) Γ system σ E : 1 H σ(u) u U Γ E : U H Γ E : τ H (T INT) Γ I α(e, E ) : I α(u, τ) H H Γ E : I α(u) H (T IMPC) Γ icast E : 1 H α? (u) u U Γ E : I α(u) H (T EXPC) Γ ecast C E : 1 H α C (u) u U

Γ E : U H Γ E : τ H (T INT) Γ I α(e, E ) : I α(u, τ) H H Γ E : I α(u) H (T

12 Type and Effect System: Properties Lemma For each closed (i.e., without free variables) expression E, environment Γ, history expression H, type τ and trace ω, if Γ E : τ H then either E is a value or ω, E ω, E (for some ω, E ). Theorem For each closed expression E, history expression H, type τ and trace ω, if E : τ H and, E ω, E then there exist H and ω such that H ω H, E : τ H and ω = ω.

is a value or ω, E ω, E (for some ω, E ).

13 Security Policies Policies language = Hennessy-Milner Logic (HML with negation and parametric actions) ϕ, ϕ ::= tt ϕ ϕ ϕ σ(ẋ).ϕ Validation of history expressions against policies (H = ϕ) H = tt (true) H = ϕ H = ϕ (negation) H = ϕ ϕ H = ϕ and H = ϕ H = σ(u).ϕ H σ(u) H and H = ϕ (conjunction) (c-diamond) H = σ(x).ϕ u.h σ(u) H and H = ϕ{u/x} (a-diamond)

ϕ Validation of history expressions against policies (H = ϕ) H = tt (true) H = ϕ H = ϕ

14 Policy compliance in our Example Assumptions: H = read( /sav) (www? ( http : //ad.com ) + write( /sav)) ϕ = read(x). connect(y).ff. ρ(www) = {www Browserh.connect( http : //ad.com )} Does H =ϕ? Proof: read( /sav) (www? ( http : //ad.com ) + write( /sav)) = read(x). connect(y).ff (a-diamond) www? ( http : //ad.com ) + write( /sav) = connect(y).ff = (HE choice) www? ( http : //ad.com ) = connect(y).ff connect( http : //ad.com ) = connect(y).ff = (HE intent) (a-diamond) ε = ff H = ϕ

com ) + write( /sav)) = read(x). connect(y).ff (a-diamond) www? ( http : //ad.com ) + write( /sav) = connect(y).

15 Partial Model Checking Problem: check a new application against the current device configuration and the policy. PMC allows to partially evaluate a formula against a model, using reduction rules for transferring information from the model to the formula to satisfy. PMC has been originally defined for µ-calculus, we adapted it to HML by redefining the operator // for the partial evaluation against parallel composition: tt //H = tt ( ϕ) //H = ϕ //H (ϕ ϕ ) //H = ϕ //H ϕ //H ( σ(u).ϕ) //H = σ(u).ϕ //H ϕ //H H H σ(u) ( σ(x).ϕ) //H = σ(x).ϕ //H ϕ{u/x} //H H H σ(u) Theorem H = ϕ //H = H H = ϕ

16 BYODroid

17 Security Policy Manager Device Registration phase j A 1 j //A1 d A 1 : UI; A 2 : Game; A 3 Install A 3 A 3 : Browser; Attemp to install A 2 A 2 j //A1//A3 d

18 Conclusion Open Issues and Future Developments: Expressiveness of policies other policy languages (e.g. ConSpec); inconclusive analysis and run-time policies instrumenting and monitoring of applications; uninstalling applications is cumbersome design solutions for inhibit execution of non-compliant applications; BYODroid works on a single BYOD policy enhancements for supporting many policies and policy switching. We plan to release BYODroid in mid-2013.

uninstalling applications is cumbersome design solutions for inhibit execution of non-compliant applications;

19 THANK YOU!!! QUESTIONS?!?

Securing the Bring Your Own Device Policy

Securing the Bring Your Own Device Policy Alessandro Armando Fondazione Bruno Kessler Trento, Italy armando@fbk.eu Gabriele Costa Università degli Studi di Genova Genova, Italy gabriele.costa@unige.it