Flowverine: Leveraging Dataflow Programming for Building Privacy-Sensitive Android Applications

Gomes, Eduardo;Zavalyshyn, Igor;Santos, Nuno;Silva, João;Legay, Axel
(2020) The 19th IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom′20) — Location: Guangzhou, China (29.December.2020)

Files

Flowverine_Trustcom20.pdf
  • Open Access
  • Adobe PDF
  • 625.62 KB
Download

Details

Authors
  • Gomes, EduardoINESC-ID / Instituto Superior Tecnico, Universidad de Lisboa
    Author
  • Zavalyshyn, IgorINESC-ID / Instituto Superior Tecnico, Universidad de Lisboa, UCL
    Author
  • Santos, NunoINESC-ID / Instituto Superior Tecnico, Universidad de Lisboa
    Author
  • Silva, JoãoINESC-ID / Instituto Superior Tecnico, Universidad de Lisboa
    Author
  • Legay, AxelUCLouvain
    Author
Abstract
Software security is a fundamental dimension in the development of mobile applications (apps). Since many apps have access to sensitive data (e.g., collected from a smartphone's sensors), the presence of security vulnerabilities may put that data in danger and lead to privacy violations. Unfortunately, existing security solutions for Android are either too cumbersome to use by common app developers, or may require the modification of Android OS. This paper presents Flowverine, a system for building privacy-sensitive mobile apps for unmodified Android platforms. Flowverine exposes an API based on a dataflow programming model which allows for efficient taint tracking of sensitive data flows within each app. By checking such flows against a security policy, Flowverine can then prevent potential privacy violations. We implemented a prototype of our system. Our evaluation shows that Flowverine can be used to implement mobile applications that handle security-sensitive information flows while preserving compatibility with existing Android OS and incurring small performance overheads.
Affiliations

Citations

  • APA
  • Chicago
  • FWB

Gomes, E., Zavalyshyn, I., Santos, N., Silva, J., & Legay, A. (2020). Flowverine: Leveraging Dataflow Programming for Building Privacy-Sensitive Android Applications. The 19th IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom′20). Published. The 19th IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom′20), Guangzhou, China. https://hdl.handle.net/2078.5/118088 (Original work published 2020)