a certified reference validation mechanism for the
play

A certified reference validation mechanism for the permission model - PowerPoint PPT Presentation

Jan 24, 2023 •115 likes •850 views

Motivation Introduction Specification Verification A certified reference validation mechanism for the permission model of Android Gustavo Betarte Juan Campo Felipe Gorostiaga Carlos Luna InCo, Facultad de Ingenier a, Universidad de

  1. Motivation Introduction Specification Verification A certified reference validation mechanism for the permission model of Android Gustavo Betarte Juan Campo Felipe Gorostiaga Carlos Luna InCo, Facultad de Ingenier´ ıa, Universidad de la Rep´ ublica, Uruguay. IMDEA Software Institute, Spain. October 16, 2017 Gustavo Betarte, Juan Campo, Felipe Gorostiaga, Carlos Luna LOPSTR 2017

  2. Motivation Introduction Specification Verification Table of contents Motivation 1 Gustavo Betarte, Juan Campo, Felipe Gorostiaga, Carlos Luna LOPSTR 2017

  3. Motivation Introduction Specification Verification Table of contents Motivation 1 Introduction 2 Gustavo Betarte, Juan Campo, Felipe Gorostiaga, Carlos Luna LOPSTR 2017

  4. Motivation Introduction Specification Verification Table of contents Motivation 1 Introduction 2 Specification 3 Gustavo Betarte, Juan Campo, Felipe Gorostiaga, Carlos Luna LOPSTR 2017

  5. Motivation Introduction Specification Verification Table of contents Motivation 1 Introduction 2 Specification 3 Verification 4 Gustavo Betarte, Juan Campo, Felipe Gorostiaga, Carlos Luna LOPSTR 2017

  6. Motivation Introduction Specification Verification Summary Motivation 1 Introduction 2 Specification 3 Verification 4 Gustavo Betarte, Juan Campo, Felipe Gorostiaga, Carlos Luna LOPSTR 2017

  7. Motivation Introduction Specification Verification Why Android? Present in more than a billion mobile devices. Target of many attacks. Informal and incomplete documentation. Gustavo Betarte, Juan Campo, Felipe Gorostiaga, Carlos Luna LOPSTR 2017

  8. Motivation Introduction Specification Verification Summary Motivation 1 Introduction 2 Specification 3 Verification 4 Gustavo Betarte, Juan Campo, Felipe Gorostiaga, Carlos Luna LOPSTR 2017

  9. Motivation Introduction Specification Verification Introduction to Android Open-source operating system for mobile devices. Developed by Google and the Open Handset Alliance (OHA) Gustavo Betarte, Juan Campo, Felipe Gorostiaga, Carlos Luna LOPSTR 2017

  10. Motivation Introduction Specification Verification Introduction to Android Two kinds of applications: System applications shipped with the Android distribution 1 Eg. Clock, Contacts User applications developed by third parties 2 Eg. WhatsApp, Facebook Gustavo Betarte, Juan Campo, Felipe Gorostiaga, Carlos Luna LOPSTR 2017

  11. Motivation Introduction Specification Verification Introduction to Android Two kinds of applications: System applications shipped with the Android distribution 1 Eg. Clock, Contacts User applications developed by third parties 2 Eg. WhatsApp, Facebook Both kinds of applications have access to the device’s resources/services, as well as to other applications’ resources. Gustavo Betarte, Juan Campo, Felipe Gorostiaga, Carlos Luna LOPSTR 2017

  12. Motivation Introduction Specification Verification Application components Activities They comprise the application screens They handle the user’s interaction with the application Content Providers They handle data sharing between applications Interface between data and external applications Services Broadcast Receivers Gustavo Betarte, Juan Campo, Felipe Gorostiaga, Carlos Luna LOPSTR 2017

  13. Motivation Introduction Specification Verification Application components Activities They comprise the application screens They handle the user’s interaction with the application Content Providers They handle data sharing between applications Interface between data and external applications Services Broadcast Receivers Gustavo Betarte, Juan Campo, Felipe Gorostiaga, Carlos Luna LOPSTR 2017

  14. Motivation Introduction Specification Verification Application components Activities They comprise the application screens They handle the user’s interaction with the application Content Providers They handle data sharing between applications Interface between data and external applications Services Broadcast Receivers Gustavo Betarte, Juan Campo, Felipe Gorostiaga, Carlos Luna LOPSTR 2017

  15. Attachments Motivation Introduction Specification Verification Application components: an example Activities Inbox New mail Content Providers Attachments Gustavo Betarte, Juan Campo, Felipe Gorostiaga, Carlos Luna LOPSTR 2017

  16. Motivation Introduction Specification Verification Comunication between Components Access to Content Providers: Queries to URI s Access to any other component: Intents Gustavo Betarte, Juan Campo, Felipe Gorostiaga, Carlos Luna LOPSTR 2017

  17. Motivation Introduction Specification Verification Android’s security model Access to device and external applications must be regulated to keep: Data integrity and confidentiality Costs control by the user System’s proper functioning . . . Gustavo Betarte, Juan Campo, Felipe Gorostiaga, Carlos Luna LOPSTR 2017

  18. Motivation Introduction Specification Verification Principle Of Least Privilege Gustavo Betarte, Juan Campo, Felipe Gorostiaga, Carlos Luna LOPSTR 2017

  19. Motivation Introduction Specification Verification Principle Of Least Privilege Application sandbox Gustavo Betarte, Juan Campo, Felipe Gorostiaga, Carlos Luna LOPSTR 2017

  20. Motivation Introduction Specification Verification Principle Of Least Privilege Application sandbox Permission system Gustavo Betarte, Juan Campo, Felipe Gorostiaga, Carlos Luna LOPSTR 2017

  21. Motivation Introduction Specification Verification AndroidManifest XML file which every Android application must provide It includes static declarations like: Requested permissions 1 Custom permissions 2 Application’s components 3 . . . 4 Gustavo Betarte, Juan Campo, Felipe Gorostiaga, Carlos Luna LOPSTR 2017

  22. Motivation Introduction Specification Verification AndroidManifest : Example <manifest package="com.cpexample" ... > . . . <uses-permission android:name="android.permission.SEND SMS" /> <application android:permission="android.permission.SET WALLPAPER" ... > <activity android:name="com.cpexample.MainActivity" android:permission="android.permission.CALL PHONE" ... > </activity> <provider android:name="com.cpexample.MiProvider" android:permission="android.permission.SEND SMS" ... > </provider> . . . </application> </manifest> Gustavo Betarte, Juan Campo, Felipe Gorostiaga, Carlos Luna LOPSTR 2017

  23. Motivation Introduction Specification Verification Permission delegation Permission delegation between components Permissions granted until revocation Two delegation mechanisms: Pending intents URI permissions Gustavo Betarte, Juan Campo, Felipe Gorostiaga, Carlos Luna LOPSTR 2017

  24. Motivation Introduction Specification Verification Permission delegation: URI permissions uri1 App 1 uri2 CProvider uri3 App 2 Gustavo Betarte, Juan Campo, Felipe Gorostiaga, Carlos Luna LOPSTR 2017

  25. Motivation Introduction Specification Verification Permission delegation: URI permissions uri1 App 1 uri2 CProvider uri3 App 2 Gustavo Betarte, Juan Campo, Felipe Gorostiaga, Carlos Luna LOPSTR 2017

  26. Motivation Introduction Specification Verification Permission delegation: URI permissions uri1 App 1 uri2 CProvider uri3 App 2 Gustavo Betarte, Juan Campo, Felipe Gorostiaga, Carlos Luna LOPSTR 2017

  27. Motivation Introduction Specification Verification Summary Motivation 1 Introduction 2 Specification 3 Verification 4 Gustavo Betarte, Juan Campo, Felipe Gorostiaga, Carlos Luna LOPSTR 2017

  28. State i Motivation Introduction Specification Verification General characteristics Formalization of Android’s security system Developed using the proof assistant Coq Specially focused on: Permission system Interaction between components and the system High order specification based on state machines Gustavo Betarte, Juan Campo, Felipe Gorostiaga, Carlos Luna LOPSTR 2017

  29. State i Motivation Introduction Specification Verification General characteristics Formalization of Android’s security system Developed using the proof assistant Coq Specially focused on: Permission system Interaction between components and the system High order specification based on state machines Gustavo Betarte, Juan Campo, Felipe Gorostiaga, Carlos Luna LOPSTR 2017

  30. Current permission delegations Installed applications Motivation Introduction Specification Verification General characteristics Formalization of Android’s security system Developed using the proof assistant Coq Specially focused on: Permission system Interaction between components and the system High order specification based on state machines Gustavo Betarte, Juan Campo, Felipe Gorostiaga, Carlos Luna LOPSTR 2017

  31. Motivation Introduction Specification Verification General characteristics Formalization of Android’s security system Developed using the proof assistant Coq Specially focused on: Permission system Interaction between components and the system High order specification based on state machines Gustavo Betarte, Juan Campo, Felipe Gorostiaga, Carlos Luna LOPSTR 2017

Recommend

Overview of project Aim: to establish and maintain SI traceability of global Fiducial Reference

Overview of project Aim: to establish and maintain SI traceability of global Fiducial Reference

FRM4STS: Fiducial Reference measurements for validation of Surface Temperature from Satellites (ceos cv8) Nigel Fox (Chair CEOS WGCV IVOS) NPL (ESA Project) WGCV Plenary # 40 Working Group on Calibration and Validation Overview of project

658 views • 61 slides
CPAchem - UP TO NEW HORIZONS December 2017 Contents No Section Page CPAchems Overview

CPAchem - UP TO NEW HORIZONS December 2017 Contents No Section Page CPAchems Overview

CPAchem - UP TO NEW HORIZONS December 2017 Contents No Section Page CPAchems Overview 3-13 &quot; Certified Reference Materials 14-31 &quot; Inorganic Certified Reference Materials 19-26 &quot; Organic Certified Reference

617 views • 37 slides
Form Validation 1 CS380 What is form validation? 2 validation: ensuring that form's values

Form Validation 1 CS380 What is form validation? 2 validation: ensuring that form's values

Form Validation 1 CS380 What is form validation? 2 validation: ensuring that form's values are correct some types of validation: preventing blank values (email address) ensuring the type of values integer, real number,

284 views • 24 slides
Data Mining II Model Validation Heiko Paulheim Why Model Validation? We have seen so far

Data Mining II Model Validation Heiko Paulheim Why Model Validation? We have seen so far

Data Mining II Model Validation Heiko Paulheim Why Model Validation? We have seen so far Various metrics (e.g., accuracy, F-measure, RMSE, ) Evaluation protocol setups Split Validation Cross Validation Special

1.04k views • 55 slides
10/15/2018 About Me Professional Certified Coach ( 900+ certified hours) MBTI and ELI

10/15/2018 About Me Professional Certified Coach ( 900+ certified hours) MBTI and ELI

10/15/2018 About Me Professional Certified Coach ( 900+ certified hours) MBTI and ELI Certified Practitioner 12 Years as Trade Association Executive Director Lifelong Entrepreneur (Apparel, Fitness, Coaching) Podcaster, The

325 views • 11 slides
Chapter 5 Analysis: Four Level for Validation Vis/Visual Analytics, Chap 5 Validation 1 CGGM

Chapter 5 Analysis: Four Level for Validation Vis/Visual Analytics, Chap 5 Validation 1 CGGM

Chapter 5 Analysis: Four Level for Validation Vis/Visual Analytics, Chap 5 Validation 1 CGGM Lab., CS Dept., NCTU Jung Hong Chuang Contents Why Validate? Validation Approaches Domain Why is Validation Abstraction

724 views • 47 slides
Certified Laboratories OAC 3745 300 04 Certified Professional 8 Hour Training VAP CL

Certified Laboratories OAC 3745 300 04 Certified Professional 8 Hour Training VAP CL

Certified Laboratories OAC 3745 300 04 Certified Professional 8 Hour Training VAP CL Rule In order to demonstrate that applicable standards are met for a property, VAP Certified Laboratory analysis must be performed on all COCs in all

173 views • 6 slides
Capital Quality Validation Webinar Sept. 17, 2020 Agenda Validation Overview

Capital Quality Validation Webinar Sept. 17, 2020 Agenda Validation Overview

Capital Quality Validation Webinar Sept. 17, 2020 Agenda Validation Overview Validation Timeline Authorized Representative Validation Process How to Log In to QuickBase How to Reset Your Password How to

451 views • 43 slides
Occams Razor Sampling Bias : generate the data carefuly Data Snooping : handle the data

Occams Razor Sampling Bias : generate the data carefuly Data Snooping : handle the data

recap: Validation and Cross Validation Validation Cross Validation D ( N ) D 1 D 2 D N D train Learning From Data D ( N K ) g 1 g 2 g N Lecture 14 ( x 1 , y 1 ) ( x 2 , y 2 ) ( x N , y N ) Three Learning Principles D

486 views • 15 slides
AngularJS &amp; Bootstrap Form Validation HTML default validation Browsers have built-in

AngularJS &amp; Bootstrap Form Validation HTML default validation Browsers have built-in

AngularJS &amp; Bootstrap Form Validation HTML default validation Browsers have built-in HTML validation These work when the type attribute is given to an input element We might want better validation than is provided by the web

328 views • 13 slides
CERTIFIED PAYROLL CERTIFIED PAYROLL Introductions Introductions WORKSHOP WORKSHOP

CERTIFIED PAYROLL CERTIFIED PAYROLL Introductions Introductions WORKSHOP WORKSHOP

Certified Payroll Workshop District 2 April 2, 2012 CERTIFIED PAYROLL CERTIFIED PAYROLL Introductions Introductions WORKSHOP WORKSHOP Presenters: Hosted by Vinu Patel M Squared Engineering, LLC Minal Hahm, PE, CFM on behalf

346 views • 9 slides
Module 4 19/05/2015 2 Agenda 1. What is validation? 2. Three-part empathy 3. What is

Module 4 19/05/2015 2 Agenda 1. What is validation? 2. Three-part empathy 3. What is

VALIDATION SKILLS Module 4 19/05/2015 2 Agenda 1. What is validation? 2. Three-part empathy 3. What is involved? 4. Why, when and how to use validation 3 What is validation? Validation = saying something People with BPD are much

265 views • 8 slides
VALIDATION The goal of validation is to judge the quality of the soft- ware from the users

VALIDATION The goal of validation is to judge the quality of the soft- ware from the users

VALIDATION The goal of validation is to judge the quality of the soft- ware from the users point of view; e.g., reliability. The goal of all validation techniques is: to reveal failures, to localize the faults that caused the

281 views • 14 slides
Verification and Validation Steven Zeil February 13, 2013 Verification and Validation

Verification and Validation Steven Zeil February 13, 2013 Verification and Validation

Verification and Validation Verification and Validation Steven Zeil February 13, 2013 Verification and Validation Outline The Process 1 Non-Testing V&amp;V 2 Code Review Mathematically-based verification Static analysis tools

790 views • 55 slides
LaGov LaGov Version 2.2 Updated: 12/17/08 Visit our website for Blueprint Presentations,

LaGov LaGov Version 2.2 Updated: 12/17/08 Visit our website for Blueprint Presentations,

Inventory and Warehouse Management Inventory and Warehouse Management Inventory and Warehouse Management Validation Session Validation Session Validation Session LOG- -IM/WM IM/WM- -Validation Validation LOG LOG-IM/WM-Validation January

1.59k views • 146 slides
Certified Payrolls Cheryl Catron Certified Payrolls What we know. REQUIRED -- All

Certified Payrolls Cheryl Catron Certified Payrolls What we know. REQUIRED -- All

Certified Payrolls Cheryl Catron Certified Payrolls What we know. REQUIRED -- All federally funded construction projects WAGES -- Prevailing Wage Rates apply PAY WEEKLY -- Wages paid weekly REPORT -- Certified Payrolls

598 views • 56 slides
Certified Professionals OAC 3745 300 05 Certified Professional 8 Hour Training CP

Certified Professionals OAC 3745 300 05 Certified Professional 8 Hour Training CP

Certified Professionals OAC 3745 300 05 Certified Professional 8 Hour Training CP qualification requirements Minimum Bachelors Degree Acceptable Majors: biology, chemistry, environmental sciences, geology, hydrogeology,

571 views • 18 slides
Workshop on process validation General concepts on process validation Kowid Ho Scope /

Workshop on process validation General concepts on process validation Kowid Ho Scope /

Workshop on process validation General concepts on process validation Kowid Ho Scope / background Process evaluation/validation of biotechnology derived proteins used as active substance in the manufacture of medicinal products (i.e.

346 views • 16 slides
Learning From Data Lecture 13 Validation and Model Selection The Validation Set Model Selection

Learning From Data Lecture 13 Validation and Model Selection The Validation Set Model Selection

Learning From Data Lecture 13 Validation and Model Selection The Validation Set Model Selection Cross Validation M. Magdon-Ismail CSCI 4100/6100 recap: Regularization Regularization combats the effects of noise by putting a leash on the

349 views • 31 slides
Policy vs. Mechanism Policy Decisions about what should be done. Mechanism

Policy vs. Mechanism Policy Decisions about what should be done. Mechanism

Processes and Threads Marie Roch Tanenbaum 2.1-2.2 Policy vs. Mechanism Policy Decisions about what should be done. Mechanism Algorithms and data structures that implement policy 2 1 Processes Process program in

264 views • 13 slides
Second Monitoring Committee The EEA FINANCIAL MECHANISM and The NORWEGIAN FINANCIAL MECHANISM

Second Monitoring Committee The EEA FINANCIAL MECHANISM and The NORWEGIAN FINANCIAL MECHANISM

Second Monitoring Committee The EEA FINANCIAL MECHANISM and The NORWEGIAN FINANCIAL MECHANISM 20092014 National Focal Point Malta Leonie Aquilina Xuereb, 29 January 2013 EEA and Norway Grants 2009-2014 Overall Objectives: To reduce

553 views • 18 slides
The SDL adjustment mechanism 28 June 2018 Outline of presentation What is the SDL adjustment

The SDL adjustment mechanism 28 June 2018 Outline of presentation What is the SDL adjustment

The SDL adjustment mechanism 28 June 2018 Outline of presentation What is the SDL adjustment mechanism? Phased assessment process Operation of the mechanism Reconciliation The SDL adjustment mechanism Basin Plan is

346 views • 11 slides
CSc 337 LECTURE 23: REGULAR EXPRESSIONS What is form validation? validation : ensuring that

CSc 337 LECTURE 23: REGULAR EXPRESSIONS What is form validation? validation : ensuring that

CSc 337 LECTURE 23: REGULAR EXPRESSIONS What is form validation? validation : ensuring that form's values are correct some types of validation: preventing blank values (email address) ensuring the type of values integer, real

524 views • 20 slides
CSE 154 LECTURE 11: REGULAR EXPRESSIONS What is form validation? validation : ensuring that

CSE 154 LECTURE 11: REGULAR EXPRESSIONS What is form validation? validation : ensuring that

CSE 154 LECTURE 11: REGULAR EXPRESSIONS What is form validation? validation : ensuring that form's values are correct some types of validation: preventing blank values (email address) ensuring the type of values integer, real

920 views • 25 slides

More recommend