Android操作系统广泛应用于手机等移动设备,但并未根据移动设备的空间移动特性加入有针对性的访问控制,从而带来安全隐患。通过对现有Android权限模型的形式化分析,证明其无法针对空间位置信息进行有效的访问控制。给出一种将空间访问控制集成至Android权限模型的实现方法,并给出其有效性的形式化证明。经过实验分析发现该方法能够有效地根据空间位置信息对系统中的敏感操作做出保护,同时并不影响系统的可用性。
Android operating system is widely used in mobile phones and other mobile devices,but the targeted access control according to spatial mobile characteristic of mobile devices has not been taken into consideration,which brings potential security pitfall. In this paper, with formal analysis on existing Android permission model,we prove that it cannot give effective access control aiming at the spatial location information. We provide an implementation approach for integrating the spatial-aware access control into Android permission model,and give a formal proof of its effectiveness. We find through experimental analyses that the proposed method can effectively protect the sensitive operations in system according to the spatial location information,while not affect the usability of the system.