Flow Permissions for Android

Abstract

Abstract-This paper proposes Flow Permissions, an extension to the Android permission mechanism. Unlike the existing permission mechanism our permission mechanism contains semantic information based on information flows. Flow Permissions allow users to examine and grant explicit information flows within an application (e.g., a permission for reading the phone number and sending it over the network) as well as implicit information flows across multiple applications (e.g., a permission for reading the phone number and sending it to another application already installed on the user's phone). Our goal with Flow Permissions is to provide visibility into the holistic behavior of the applications installed on a user's phone. Our evaluation compares our approach to dynamic flow tracking techniques; our results with 600 popular applications and 1,200 malicious applications show that our approach is practical and effective in deriving Flow Permissions statically.

Privacy Risk Analysis and Mitigation of Analytics Libraries in the Android Ecosystem

“…FlowDroid needed developers to predefine the source and sink APIs of the sensitive data. Holavanalli et al [47] developed a static analysis tool named "Blue Seal", which could be used to analyze data sent inter-and intraapps. Based on Blue Seal, they proposed an extension to Android permission mechanism called "Flow Permissions".…”

A secure play store for android

“…As mentioned above, the current Android permission machnism is insufficient because it does not provide detail information about how the user's data is deployed by apps. Our current work focus on a flow based extention of current Android permission mechanism, called Flow Permissions [5]. Additional information and performance results are available at: http://blueseal.cse.buffalo.edu.…”

Combining static and dynamic data flow analysis

“…Special attention has been given to mobile devices [11,10,1,3,18,36,39,12]. The most advanced approaches use either static [10,1,12] or dynamic [11] data flow analysis, and hence they are liable to the said limits of such techniques.…”