Matching Items (5)
Filtering by
- All Subjects: Mobile computing
- All Subjects: Confidential communications
- Genre: Academic theses
- Genre: Doctoral Dissertation
- Creators: Dasgupta, Partha
- Creators: An, Ho Geun
- Member of: ASU Electronic Theses and Dissertations
Description
Android is currently the most widely used mobile operating system. The permission model in Android governs the resource access privileges of applications. The permission model however is amenable to various attacks, including re-delegation attacks, background snooping attacks and disclosure of private information. This thesis is aimed at understanding, analyzing and performing forensics on application behavior. This research sheds light on several security aspects, including the use of inter-process communications (IPC) to perform permission re-delegation attacks.
Android permission system is more of app-driven rather than user controlled, which means it is the applications that specify their permission requirement and the only thing which the user can do is choose not to install a particular application based on the requirements. Given the all or nothing choice, users succumb to pressures and needs to accept permissions requested. This thesis proposes a couple of ways for providing the users finer grained control of application privileges. The same methods can be used to evade the Permission Re-delegation attack.
This thesis also proposes and implements a novel methodology in Android that can be used to control the access privileges of an Android application, taking into consideration the context of the running application. This application-context based permission usage is further used to analyze a set of sample applications. We found the evidence of applications spoofing or divulging user sensitive information such as location information, contact information, phone id and numbers, in the background. Such activities can be used to track users for a variety of privacy-intrusive purposes. We have developed implementations that minimize several forms of privacy leaks that are routinely done by stock applications.
Android permission system is more of app-driven rather than user controlled, which means it is the applications that specify their permission requirement and the only thing which the user can do is choose not to install a particular application based on the requirements. Given the all or nothing choice, users succumb to pressures and needs to accept permissions requested. This thesis proposes a couple of ways for providing the users finer grained control of application privileges. The same methods can be used to evade the Permission Re-delegation attack.
This thesis also proposes and implements a novel methodology in Android that can be used to control the access privileges of an Android application, taking into consideration the context of the running application. This application-context based permission usage is further used to analyze a set of sample applications. We found the evidence of applications spoofing or divulging user sensitive information such as location information, contact information, phone id and numbers, in the background. Such activities can be used to track users for a variety of privacy-intrusive purposes. We have developed implementations that minimize several forms of privacy leaks that are routinely done by stock applications.
ContributorsGollapudi, Narasimha Aditya (Author) / Dasgupta, Partha (Thesis advisor) / Xue, Guoliang (Committee member) / Doupe, Adam (Committee member) / Arizona State University (Publisher)
Created2014
Description
With the rise of mobile technology, the personal lives and sensitive information of everyday citizens are carried about without a thought to the risks involved. Despite this high possibility of harm, many fail to use simple security to protect themselves because they feel the benefits of securing their devices do not outweigh the cost to usability. The main issue is that beyond initial authentication, sessions are maintained using optional timeout mechanisms where a session will end if a user is inactive for a period of time. This interruption-based form of continuous authentication requires constant user intervention leading to frustration, which discourages its use. No solution currently exists that provides an implementation beyond the insecure and low usability of simple timeout and re-authentication. This work identifies the flaws of current mobile authentication techniques and provides a new solution that is not limiting to the user, has a system for secure, active continuous authentication, and increases the usability and security over current methods.
ContributorsRomo, James Tyler (Author) / Ahn, Gail-Joon (Thesis advisor) / Dasgupta, Partha (Committee member) / Burleson, Winslow (Committee member) / Arizona State University (Publisher)
Created2014
Description
In this dissertation, two interrelated problems of service-based systems (SBS) are addressed: protecting users' data confidentiality from service providers, and managing performance of multiple workflows in SBS. Current SBSs pose serious limitations to protecting users' data confidentiality. Since users' sensitive data is sent in unencrypted forms to remote machines owned and operated by third-party service providers, there are risks of unauthorized use of the users' sensitive data by service providers. Although there are many techniques for protecting users' data from outside attackers, currently there is no effective way to protect users' sensitive data from service providers. In this dissertation, an approach is presented to protecting the confidentiality of users' data from service providers, and ensuring that service providers cannot collect users' confidential data while the data is processed or stored in cloud computing systems. The approach has four major features: (1) separation of software service providers and infrastructure service providers, (2) hiding the information of the owners of data, (3) data obfuscation, and (4) software module decomposition and distributed execution. Since the approach to protecting users' data confidentiality includes software module decomposition and distributed execution, it is very important to effectively allocate the resource of servers in SBS to each of the software module to manage the overall performance of workflows in SBS. An approach is presented to resource allocation for SBS to adaptively allocating the system resources of servers to their software modules in runtime in order to satisfy the performance requirements of multiple workflows in SBS. Experimental results show that the dynamic resource allocation approach can substantially increase the throughput of a SBS and the optimal resource allocation can be found in polynomial time
ContributorsAn, Ho Geun (Author) / Yau, Sik-Sang (Thesis advisor) / Huang, Dijiang (Committee member) / Ahn, Gail-Joon (Committee member) / Santanam, Raghu (Committee member) / Arizona State University (Publisher)
Created2012
Description
Embedded Networked Systems (ENS) consist of various devices, which are embedded into physical objects (e.g., home appliances, vehicles, buidlings, people). With rapid advances in processing and networking technologies, these devices can be fully connected and pervasive in the environment. The devices can interact with the physical world, collaborate to share resources, and provide context-aware services. This dissertation focuses on collaboration in ENS to provide smart services. However, there are several challenges because the system must be - scalable to a huge number of devices; robust against noise, loss and failure; and secure despite communicating with strangers. To address these challenges, first, the dissertation focuses on designing a mobile gateway called Mobile Edge Computing Device (MECD) for Ubiquitous Sensor Networks (USN), a type of ENS. In order to reduce communication overhead with the server, an MECD is designed to provide local and distributed management of a network and data associated with a moving object (e.g., a person, car, pet). Furthermore, it supports collaboration with neighboring MECDs. The MECD is developed and tested for monitoring containers during shipment from Singapore to Taiwan and reachability to the remote server was a problem because of variance in connectivity (caused by high temperature variance) and high interference. The unreachability problem is addressed by using a mesh networking approach for collaboration of MECDs in sending data to a server. A hierarchical architecture is proposed in this regard to provide multi-level collaboration using dynamic mesh networks of MECDs at one layer. The mesh network is evaluated for an intelligent container scenario and results show complete connectivity with the server for temperature range from 25°C to 65°C. Finally, the authentication of mobile and pervasive devices in ENS for secure collaboration is investigated. This is a challenging problem because mutually unknown devices must be verified without knowledge of each other's identity. A self-organizing region-based authentication technique is proposed that uses environmental sound to autonomously verify if two devices are within the same region. The experimental results show sound could accurately authenticate devices within a small region.
ContributorsKim, Su-jin (Author) / Gupta, Sandeep K. S. (Thesis advisor) / Dasgupta, Partha (Committee member) / Davulcu, Hasan (Committee member) / Lee, Yann-Hang (Committee member) / Arizona State University (Publisher)
Created2010
Description
Mobile Cloud computing has shown its capability to support mobile devices for
provisioning computing, storage and communication resources. A distributed mobile
cloud service system called "POEM" is presented to manage the mobile cloud resource
and compose mobile cloud applications. POEM considers resource management not
only between mobile devices and clouds, but also among mobile devices. It implements
both computation offloading and service composition features. The proposed POEM
solution is demonstrated by using OSGi and XMPP techniques.
Offloading is one major type of collaborations between mobile device and cloud
to achieve less execution time and less energy consumption. Offloading decisions for
mobile cloud collaboration involve many decision factors. One of important decision
factors is the network unavailability. This report presents an offloading decision model
that takes network unavailability into consideration. The application execution time
and energy consumption in both ideal network and network with some unavailability
are analyzed. Based on the presented theoretical model, an application partition
algorithm and a decision module are presented to produce an offloading decision that
is resistant to network unavailability.
Existing offloading models mainly focus on the one-to-one offloading relation. To
address the multi-factor and multi-site offloading mobile cloud application scenarios,
a multi-factor multi-site risk-based offloading model is presented, which abstracts the
offloading impact factors as for offloading benefit and offloading risk. The offloading
decision is made based on a comprehensive offloading risk evaluation. This presented
model is generic and expendable. Four offloading impact factors are presented to show
the construction and operation of the presented offloading model, which can be easily
extended to incorporate more factors to make offloading decision more comprehensive.
The overall offloading benefits and risks are aggregated based on the mobile cloud
users' preference.
The offloading topology may change during the whole application life. A set of
algorithms are presented to address the service topology reconfiguration problem in
several mobile cloud representative application scenarios, i.e., they are modeled as
finite horizon scenarios, infinite horizon scenarios, and large state space scenarios to
represent ad hoc, long-term, and large-scale mobile cloud service composition scenarios,
respectively.
provisioning computing, storage and communication resources. A distributed mobile
cloud service system called "POEM" is presented to manage the mobile cloud resource
and compose mobile cloud applications. POEM considers resource management not
only between mobile devices and clouds, but also among mobile devices. It implements
both computation offloading and service composition features. The proposed POEM
solution is demonstrated by using OSGi and XMPP techniques.
Offloading is one major type of collaborations between mobile device and cloud
to achieve less execution time and less energy consumption. Offloading decisions for
mobile cloud collaboration involve many decision factors. One of important decision
factors is the network unavailability. This report presents an offloading decision model
that takes network unavailability into consideration. The application execution time
and energy consumption in both ideal network and network with some unavailability
are analyzed. Based on the presented theoretical model, an application partition
algorithm and a decision module are presented to produce an offloading decision that
is resistant to network unavailability.
Existing offloading models mainly focus on the one-to-one offloading relation. To
address the multi-factor and multi-site offloading mobile cloud application scenarios,
a multi-factor multi-site risk-based offloading model is presented, which abstracts the
offloading impact factors as for offloading benefit and offloading risk. The offloading
decision is made based on a comprehensive offloading risk evaluation. This presented
model is generic and expendable. Four offloading impact factors are presented to show
the construction and operation of the presented offloading model, which can be easily
extended to incorporate more factors to make offloading decision more comprehensive.
The overall offloading benefits and risks are aggregated based on the mobile cloud
users' preference.
The offloading topology may change during the whole application life. A set of
algorithms are presented to address the service topology reconfiguration problem in
several mobile cloud representative application scenarios, i.e., they are modeled as
finite horizon scenarios, infinite horizon scenarios, and large state space scenarios to
represent ad hoc, long-term, and large-scale mobile cloud service composition scenarios,
respectively.
ContributorsWu, Huijun (Author) / Huang, Dijiang (Thesis advisor) / Xue, Guoliang (Committee member) / Dasgupta, Partha (Committee member) / Mirchandani, Pitu (Committee member) / Arizona State University (Publisher)
Created2016